{
  "case": "2018-12-18",
  "status": 200,
  "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
  "investigation_id": "371c2f82-04c6-450e-9802-1820a761b846",
  "packet_report_original_chars": 502983,
  "handoff_report_chars": 541,
  "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14",
  "retained_packet_report_sha256": "e93804940a7874496153bbdc1a859f8145b3c4f1c2fe41106c786d9ccce66065",
  "response": {
    "id": "371c2f82-04c6-450e-9802-1820a761b846",
    "name": "Readable report handoff retest — Eggnog Soup 2018-12-18",
    "description": "Previously oversized public PCAP handoff regression; no publisher answers.",
    "status": "active",
    "domain": "enterprise-attack",
    "tlp": "TLP:AMBER+STRICT",
    "actor_ids": [],
    "technique_ids": [
      "T1071.001",
      "T1105"
    ],
    "report_ids": [],
    "evidence_nodes": [
      {
        "id": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "type": "log-pcap-analysis",
        "label": "2018-12-18-traffic-analysis-exercise.pcap",
        "report": "# PCAP evidence summary\n\nDecoded 82354 packets across 537 IP endpoints and 2668 transport flows. Observed 1793 DNS events, 1976 HTTP requests, 509 TLS ClientHello events, and 549 recovered file/message object(s). Deterministic rules produced 252 finding(s): 5 high, 235 medium, and 12 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\nFull packet evidence: /api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14\n\nWrite the concise investigation summary after enrichment.",
        "summary": "Decoded 82354 packets across 537 IP endpoints and 2668 transport flows. Observed 1793 DNS events, 1976 HTTP requests, 509 TLS ClientHello events, and 549 recovered file/message object(s). Deterministic rules produced 252 finding(s): 5 high, 235 medium, and 12 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "observables": [
          {
            "type": "domain",
            "value": "0-courier.push.apple.com",
            "confidence": 1,
            "description": "dns-query; frame 29503 / UDP stream 427, frame 29510 / UDP stream 427"
          },
          {
            "type": "domain",
            "value": "1-courier.push.apple.com",
            "confidence": 1,
            "description": "dns-query; frame 12834 / UDP stream 114, frame 12841 / UDP stream 114"
          },
          {
            "type": "domain",
            "value": "1-courier.sandbox.push.apple.com",
            "confidence": 1,
            "description": "dns-query; frame 12832 / UDP stream 112, frame 12838 / UDP stream 112"
          },
          {
            "type": "domain",
            "value": "1.courier-sandbox-push-apple.com.akadns.net",
            "confidence": 1,
            "description": "dns-cname; frame 12838 / UDP stream 112"
          },
          {
            "type": "domain",
            "value": "2-courier.push.apple.com",
            "confidence": 1,
            "description": "dns-query; frame 12835 / UDP stream 115, frame 12851 / UDP stream 115"
          },
          {
            "type": "domain",
            "value": "33xchange-1576862511.us-east-1.elb.amazonaws.com",
            "confidence": 1,
            "description": "dns-cname, dns-query; frame 23650 / UDP stream 342, frame 33751 / UDP stream 484, frame 33813 / UDP stream 484, frame 49689 / UDP stream 656"
          },
          {
            "type": "domain",
            "value": "39-courier.push.apple.com",
            "confidence": 1,
            "description": "dns-query; frame 74800 / UDP stream 890, frame 74807 / UDP stream 890"
          },
          {
            "type": "domain",
            "value": "6-courier.push.apple.com",
            "confidence": 1,
            "description": "dns-query; frame 75859 / UDP stream 901, frame 75861 / UDP stream 901"
          },
          {
            "type": "domain",
            "value": "8110696.fls.doubleclick.net",
            "confidence": 1,
            "description": "dns-query, http-host, tls-sni; frame 15846 / UDP stream 203, frame 16127 / UDP stream 203, frame 16418 / TCP stream 268, frame 17782 / TCP stream 299"
          },
          {
            "type": "domain",
            "value": "a.quora.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 27965 / UDP stream 398, frame 27989 / UDP stream 398, frame 28056 / TCP stream 577"
          },
          {
            "type": "domain",
            "value": "a1164.g.akamai.net",
            "confidence": 1,
            "description": "dns-query; frame 21645 / UDP stream 302, frame 21842 / UDP stream 302"
          },
          {
            "type": "domain",
            "value": "a1213.g.akamai.net",
            "confidence": 1,
            "description": "dns-query; frame 38748 / UDP stream 553, frame 38848 / UDP stream 553, frame 40574 / UDP stream 553, frame 41377 / UDP stream 553, frame 46286 / UDP stream 553 +1 more"
          },
          {
            "type": "domain",
            "value": "a1294.w20.akamai.net",
            "confidence": 1,
            "description": "dns-query; frame 15869 / UDP stream 194, frame 16159 / UDP stream 194, frame 31079 / UDP stream 443, frame 31085 / UDP stream 443, frame 34411 / UDP stream 486 +9 more"
          },
          {
            "type": "domain",
            "value": "a1441.g4.akamai.net",
            "confidence": 1,
            "description": "dns-query; frame 29463 / UDP stream 422, frame 29471 / UDP stream 422, frame 74779 / UDP stream 889, frame 74782 / UDP stream 889"
          },
          {
            "type": "domain",
            "value": "a1472.casalemedia.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 21054 / UDP stream 299, frame 21162 / UDP stream 299, frame 21340 / TCP stream 389"
          },
          {
            "type": "domain",
            "value": "a1843.g.akamai.net",
            "confidence": 1,
            "description": "dns-query; frame 20697 / UDP stream 287, frame 20951 / UDP stream 287, frame 46413 / UDP stream 621, frame 46452 / UDP stream 621"
          },
          {
            "type": "domain",
            "value": "a1853.g.akamai.net",
            "confidence": 1,
            "description": "dns-cname, dns-query; frame 18926 / UDP stream 262, frame 18993 / UDP stream 262, frame 31298 / UDP stream 444, frame 31359 / UDP stream 444, frame 34539 / UDP stream 492 +4 more"
          },
          {
            "type": "domain",
            "value": "a19.d.akamai.net",
            "confidence": 1,
            "description": "dns-query; frame 22722 / UDP stream 326, frame 22846 / UDP stream 326"
          },
          {
            "type": "domain",
            "value": "a267.g.akamai.net",
            "confidence": 1,
            "description": "dns-query; frame 20871 / UDP stream 289, frame 21089 / UDP stream 289"
          },
          {
            "type": "domain",
            "value": "a311.g.akamai.net",
            "confidence": 1,
            "description": "dns-query; frame 16664 / UDP stream 208, frame 17036 / UDP stream 208"
          },
          {
            "type": "domain",
            "value": "a45.g2.akamai.net",
            "confidence": 1,
            "description": "dns-query; frame 38790 / UDP stream 555, frame 38806 / UDP stream 555, frame 48769 / UDP stream 648, frame 48775 / UDP stream 648, frame 58059 / UDP stream 760 +1 more"
          },
          {
            "type": "domain",
            "value": "aa-agkn-com-https-51506257.ap-northeast-1.elb.amazonaws.com",
            "confidence": 1,
            "description": "dns-query; frame 27256 / UDP stream 388, frame 27289 / UDP stream 388"
          },
          {
            "type": "domain",
            "value": "aa.agkn.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 27099 / UDP stream 388, frame 27185 / UDP stream 388, frame 50446 / UDP stream 665, frame 50513 / UDP stream 665, frame 27325 / TCP stream 546 +1 more"
          },
          {
            "type": "domain",
            "value": "aax-us-east.amazon-adsystem.com",
            "confidence": 1,
            "description": "dns-query; frame 18612 / UDP stream 246, frame 18738 / UDP stream 246, frame 32294 / UDP stream 460, frame 32313 / UDP stream 460, frame 41006 / UDP stream 570 +9 more"
          },
          {
            "type": "domain",
            "value": "aax.amazon-adsystem.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 18335 / UDP stream 246, frame 18611 / UDP stream 246, frame 18762 / TCP stream 326, frame 28906 / TCP stream 599, frame 31314 / TCP stream 679 +15 more"
          },
          {
            "type": "domain",
            "value": "aba.gumgum.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 25059 / UDP stream 360, frame 25175 / UDP stream 360, frame 25319 / TCP stream 504"
          },
          {
            "type": "domain",
            "value": "accounts.google.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 54664 / UDP stream 722, frame 54686 / UDP stream 722, frame 54701 / TCP stream 1321"
          },
          {
            "type": "domain",
            "value": "ad.doubleclick.net",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 25608 / UDP stream 368, frame 25658 / UDP stream 368, frame 60262 / TCP stream 1436"
          },
          {
            "type": "domain",
            "value": "ade.googlesyndication.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 40882 / UDP stream 566, frame 40928 / UDP stream 566, frame 40970 / TCP stream 961"
          },
          {
            "type": "domain",
            "value": "ads-bid.l.doubleclick.net",
            "confidence": 1,
            "description": "dns-cname; frame 38828 / UDP stream 556"
          },
          {
            "type": "domain",
            "value": "ads.pubmatic.com",
            "confidence": 1,
            "description": "dns-query, http-host, tls-sni; frame 22043 / UDP stream 316, frame 22164 / UDP stream 316, frame 22250 / TCP stream 428, frame 22711 / TCP stream 428, frame 30020 / TCP stream 631 +8 more"
          },
          {
            "type": "domain",
            "value": "ads.rubiconproject.com",
            "confidence": 1,
            "description": "dns-query, http-host, tls-sni; frame 20615 / UDP stream 288, frame 20935 / UDP stream 288, frame 37993 / TCP stream 901, frame 21154 / TCP stream 380"
          },
          {
            "type": "domain",
            "value": "adserver-us.adtech.advertising.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 23564 / UDP stream 341, frame 23649 / UDP stream 341, frame 23749 / TCP stream 474, frame 23750 / TCP stream 475, frame 23755 / TCP stream 478 +15 more"
          },
          {
            "type": "domain",
            "value": "adserver.adtechus.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 26036 / UDP stream 376, frame 26068 / UDP stream 376, frame 26101 / TCP stream 517"
          },
          {
            "type": "domain",
            "value": "adserverec.adtechus.com",
            "confidence": 1,
            "description": "dns-query; frame 26341 / UDP stream 378, frame 26356 / UDP stream 378"
          },
          {
            "type": "domain",
            "value": "adservice.google.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 15521 / UDP stream 174, frame 15591 / UDP stream 174, frame 44411 / UDP stream 598, frame 44451 / UDP stream 598, frame 44675 / UDP stream 598 +2 more"
          },
          {
            "type": "domain",
            "value": "adssettings.google.com",
            "confidence": 1,
            "description": "dns-query; frame 20188 / UDP stream 284, frame 20261 / UDP stream 284"
          },
          {
            "type": "domain",
            "value": "ae.srv4j.net",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 19020 / UDP stream 268, frame 19166 / UDP stream 268, frame 19347 / TCP stream 353"
          },
          {
            "type": "domain",
            "value": "ag.innovid.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 25726 / UDP stream 374, frame 25750 / UDP stream 374, frame 60018 / UDP stream 783, frame 60036 / UDP stream 783, frame 25887 / TCP stream 512 +3 more"
          },
          {
            "type": "domain",
            "value": "ajax.googleapis.com",
            "confidence": 1,
            "description": "dns-query, http-host, tls-sni; frame 13072 / UDP stream 125, frame 13118 / UDP stream 125, frame 63810 / UDP stream 834, frame 63844 / UDP stream 834, frame 13289 / TCP stream 203 +1 more"
          },
          {
            "type": "domain",
            "value": "aktrack.pubmatic.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 30436 / UDP stream 438, frame 30455 / UDP stream 438, frame 30477 / TCP stream 652, frame 30478 / TCP stream 653, frame 31878 / TCP stream 652 +15 more"
          },
          {
            "type": "domain",
            "value": "amidt.adsafeprotected.com",
            "confidence": 1,
            "description": "dns-cname; frame 25607 / UDP stream 366"
          },
          {
            "type": "domain",
            "value": "analytics.carambo.la",
            "confidence": 1,
            "description": "dns-query, http-host; frame 15644 / UDP stream 191, frame 15719 / UDP stream 191, frame 60045 / UDP stream 784, frame 60064 / UDP stream 784, frame 63294 / UDP stream 814 +15 more"
          },
          {
            "type": "domain",
            "value": "analytics.civicplus.com",
            "confidence": 1,
            "description": "http-host; frame 53973 / TCP stream 1301, frame 54077 / TCP stream 1301"
          },
          {
            "type": "domain",
            "value": "anycast.pixel.adsafeprotected.com",
            "confidence": 1,
            "description": "dns-cname, dns-query; frame 21897 / UDP stream 306, frame 21907 / UDP stream 306, frame 22011 / UDP stream 306, frame 24662 / UDP stream 357"
          },
          {
            "type": "domain",
            "value": "anycast.sc.iasds01.com",
            "confidence": 1,
            "description": "dns-cname, dns-query; frame 25713 / UDP stream 371, frame 25714 / UDP stream 371, frame 25749 / UDP stream 371"
          },
          {
            "type": "domain",
            "value": "anycast.static.adsafeprotected.com",
            "confidence": 1,
            "description": "dns-cname, dns-query; frame 22710 / UDP stream 328, frame 22719 / UDP stream 328, frame 22778 / UDP stream 328"
          },
          {
            "type": "domain",
            "value": "ap.lijit.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 17195 / UDP stream 217, frame 17295 / UDP stream 217, frame 17523 / TCP stream 288, frame 25870 / TCP stream 513, frame 25914 / TCP stream 513 +15 more"
          },
          {
            "type": "domain",
            "value": "ape-asset-tag.timeinc.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 13078 / UDP stream 129, frame 13221 / UDP stream 129, frame 14595 / TCP stream 226"
          },
          {
            "type": "domain",
            "value": "apeassetmanager-2.98z8eyzgte.us-east-1.elasticbeanstalk.com",
            "confidence": 1,
            "description": "dns-cname, dns-query; frame 13133 / UDP stream 129, frame 13221 / UDP stream 129, frame 13461 / UDP stream 129"
          },
          {
            "type": "domain",
            "value": "api-elb-682091954.us-east-1.elb.amazonaws.com",
            "confidence": 1,
            "description": "dns-cname; frame 15536 / UDP stream 167"
          },
          {
            "type": "domain",
            "value": "api-glb-hou.smoot.apple.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 12837 / UDP stream 117, frame 12842 / UDP stream 117, frame 12857 / TCP stream 191, frame 12860 / TCP stream 192, frame 13010 / TCP stream 198"
          },
          {
            "type": "domain",
            "value": "api-ntv-elb-1185445618.us-east-1.elb.amazonaws.com",
            "confidence": 1,
            "description": "dns-cname, dns-query; frame 17049 / UDP stream 213, frame 28969 / UDP stream 413, frame 29015 / UDP stream 413"
          },
          {
            "type": "domain",
            "value": "api-ntv.sele.co",
            "confidence": 1,
            "description": "dns-query, http-host; frame 17021 / UDP stream 213, frame 17049 / UDP stream 213, frame 17178 / TCP stream 278"
          },
          {
            "type": "domain",
            "value": "api-samsungosp-com-1520562956.us-east-1.elb.amazonaws.com",
            "confidence": 1,
            "description": "dns-cname; frame 41559 / UDP stream 576"
          },
          {
            "type": "domain",
            "value": "api.amazon.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 34442 / UDP stream 487, frame 34443 / UDP stream 487, frame 34447 / TCP stream 776, frame 34760 / TCP stream 793"
          },
          {
            "type": "domain",
            "value": "api.bing.com",
            "confidence": 1,
            "description": "dns-query; frame 8440 / UDP stream 96, frame 8441 / UDP stream 97, frame 8887 / UDP stream 97, frame 8891 / UDP stream 96, frame 81718 / UDP stream 921 +3 more"
          },
          {
            "type": "domain",
            "value": "api.bounceexchange.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 27961 / UDP stream 396, frame 27970 / UDP stream 396, frame 38832 / UDP stream 557, frame 38835 / UDP stream 557, frame 48962 / UDP stream 650 +12 more"
          },
          {
            "type": "domain",
            "value": "api.samsungosp.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 41553 / UDP stream 576, frame 41559 / UDP stream 576, frame 41570 / TCP stream 974"
          },
          {
            "type": "domain",
            "value": "api.segment.io",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 14078 / UDP stream 141, frame 14160 / UDP stream 141, frame 14500 / TCP stream 221"
          },
          {
            "type": "domain",
            "value": "api.sele.co",
            "confidence": 1,
            "description": "dns-query, http-host; frame 15368 / UDP stream 167, frame 15536 / UDP stream 167, frame 15611 / TCP stream 244"
          },
          {
            "type": "domain",
            "value": "api.snapcraft.io",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 63661 / UDP stream 826, frame 63662 / UDP stream 826, frame 63666 / TCP stream 1514, frame 63691 / TCP stream 1515"
          },
          {
            "type": "domain",
            "value": "app-de.onetrust.com",
            "confidence": 1,
            "description": "dns-query; frame 15155 / UDP stream 165, frame 15529 / UDP stream 165"
          },
          {
            "type": "domain",
            "value": "apple.com",
            "confidence": 1,
            "description": "dns-query; frame 12836 / UDP stream 116, frame 12839 / UDP stream 116, frame 29460 / UDP stream 423, frame 29464 / UDP stream 423"
          },
          {
            "type": "domain",
            "value": "arcus-uswest.amazon.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 32496 / UDP stream 470, frame 32513 / UDP stream 470, frame 32556 / TCP stream 722, frame 32580 / TCP stream 724, frame 33129 / TCP stream 741 +2 more"
          },
          {
            "type": "domain",
            "value": "as.casalemedia.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 18883 / UDP stream 262, frame 18945 / UDP stream 262, frame 19044 / TCP stream 349, frame 19789 / TCP stream 358, frame 28901 / TCP stream 602 +15 more"
          },
          {
            "type": "domain",
            "value": "as.casalemedia.com.edgesuite.net",
            "confidence": 1,
            "description": "dns-query; frame 50800 / UDP stream 670, frame 50828 / UDP stream 670"
          },
          {
            "type": "domain",
            "value": "assets.bounceexchange.com",
            "confidence": 1,
            "description": "dns-query, http-host, tls-sni; frame 16962 / UDP stream 211, frame 17119 / UDP stream 211, frame 17183 / TCP stream 279, frame 28258 / TCP stream 582, frame 29310 / TCP stream 582 +1 more"
          },
          {
            "type": "domain",
            "value": "assets.nymag.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 76006 / UDP stream 907, frame 76013 / UDP stream 907, frame 76045 / TCP stream 1608, frame 76105 / TCP stream 1611, frame 76114 / TCP stream 1612"
          },
          {
            "type": "domain",
            "value": "assets.rubiconproject.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 21401 / UDP stream 302, frame 21678 / UDP stream 302, frame 21881 / TCP stream 403"
          },
          {
            "type": "domain",
            "value": "assets.time.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 13083 / UDP stream 131, frame 13198 / UDP stream 131, frame 13498 / TCP stream 209"
          },
          {
            "type": "domain",
            "value": "assets.vidora.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 15604 / UDP stream 185, frame 15659 / UDP stream 185, frame 15740 / TCP stream 251"
          },
          {
            "type": "domain",
            "value": "b-code.liadm.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 27966 / UDP stream 399, frame 27988 / UDP stream 399, frame 28059 / TCP stream 576"
          },
          {
            "type": "domain",
            "value": "b.scorecardresearch.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 15726 / UDP stream 194, frame 15964 / UDP stream 194, frame 44198 / UDP stream 592, frame 44438 / UDP stream 592, frame 16288 / TCP stream 264 +15 more"
          },
          {
            "type": "domain",
            "value": "bam.nr-data.net",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 28266 / UDP stream 402, frame 28324 / UDP stream 402, frame 28361 / TCP stream 583, frame 36518 / TCP stream 855, frame 44075 / TCP stream 1002 +3 more"
          },
          {
            "type": "domain",
            "value": "bandaid-redirector.l.google.com",
            "confidence": 1,
            "description": "dns-cname; frame 38989 / UDP stream 558"
          },
          {
            "type": "domain",
            "value": "bcmls2.glpals.com",
            "confidence": 1,
            "description": "dns-query; frame 41526 / UDP stream 574, frame 41533 / UDP stream 574"
          },
          {
            "type": "domain",
            "value": "bcp.crwdcntrl.net",
            "confidence": 1,
            "description": "dns-query, http-host; frame 22535 / UDP stream 325, frame 22669 / UDP stream 325, frame 22783 / TCP stream 435, frame 22865 / TCP stream 435, frame 27984 / TCP stream 569 +1 more"
          },
          {
            "type": "domain",
            "value": "beacon-perf-iad2.rubiconproject.net.akadns.net",
            "confidence": 1,
            "description": "dns-cname; frame 22945 / UDP stream 332"
          },
          {
            "type": "domain",
            "value": "beacon-us-iad2.rubiconproject.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 22795 / UDP stream 332, frame 22945 / UDP stream 332, frame 23126 / TCP stream 452, frame 23128 / TCP stream 451, frame 38089 / TCP stream 909 +5 more"
          },
          {
            "type": "domain",
            "value": "bid.g.doubleclick.net",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 38825 / UDP stream 556, frame 38828 / UDP stream 556, frame 38837 / TCP stream 935"
          },
          {
            "type": "domain",
            "value": "bidder.criteo.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 24329 / UDP stream 354, frame 24386 / UDP stream 354, frame 49678 / UDP stream 657, frame 49706 / UDP stream 657, frame 24480 / TCP stream 490 +15 more"
          },
          {
            "type": "domain",
            "value": "bigsea-europe-prod-elb-windtrap-1315640609.eu-west-1.elb.amazonaws.com",
            "confidence": 1,
            "description": "dns-cname, dns-query; frame 27190 / UDP stream 389, frame 50448 / UDP stream 666, frame 50525 / UDP stream 666"
          },
          {
            "type": "domain",
            "value": "blocklists-settings.prod.mozaws.net",
            "confidence": 1,
            "description": "dns-cname; frame 73531 / UDP stream 864"
          },
          {
            "type": "domain",
            "value": "blocklists.settings.services.mozilla.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 73529 / UDP stream 864, frame 73531 / UDP stream 864, frame 73540 / TCP stream 1554"
          },
          {
            "type": "domain",
            "value": "bluegrassheritage.org",
            "confidence": 1,
            "description": "dns-query, http-host; frame 76299 / UDP stream 915, frame 76304 / UDP stream 915, frame 76410 / UDP stream 919, frame 76411 / UDP stream 919, frame 76310 / TCP stream 1622 +15 more"
          },
          {
            "type": "domain",
            "value": "bsw.digitru.st",
            "confidence": 1,
            "description": "dns-query, http-host; frame 21787 / UDP stream 307, frame 21922 / UDP stream 307, frame 22065 / TCP stream 412"
          },
          {
            "type": "domain",
            "value": "bxapi-alb-1398302086.us-east-2.elb.amazonaws.com",
            "confidence": 1,
            "description": "dns-cname; frame 27970 / UDP stream 396, frame 38835 / UDP stream 557, frame 48996 / UDP stream 650, frame 58952 / UDP stream 774"
          },
          {
            "type": "domain",
            "value": "c.amazon-adsystem.com",
            "confidence": 1,
            "description": "dns-query, http-host, tls-sni; frame 17040 / UDP stream 215, frame 17160 / UDP stream 215, frame 18599 / TCP stream 321, frame 17266 / TCP stream 281"
          },
          {
            "type": "domain",
            "value": "c.betrad.com",
            "confidence": 1,
            "description": "dns-query, http-host, tls-sni; frame 15598 / UDP stream 181, frame 15642 / UDP stream 181, frame 15754 / TCP stream 254, frame 60552 / TCP stream 1445"
          },
          {
            "type": "domain",
            "value": "c.brightcove.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 19588 / UDP stream 271, frame 19733 / UDP stream 271, frame 55253 / UDP stream 729, frame 55267 / UDP stream 729, frame 19851 / TCP stream 359 +15 more"
          },
          {
            "type": "domain",
            "value": "c.evidon.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 60630 / UDP stream 796, frame 60713 / UDP stream 796, frame 60743 / TCP stream 1455"
          },
          {
            "type": "domain",
            "value": "c.gumgum.com",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 24305 / UDP stream 350, frame 24383 / UDP stream 350, frame 24465 / TCP stream 489"
          },
          {
            "type": "domain",
            "value": "c.liadm.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 28570 / UDP stream 411, frame 28616 / UDP stream 411, frame 28666 / TCP stream 598, frame 28688 / TCP stream 598"
          },
          {
            "type": "domain",
            "value": "c.performmedia.com",
            "confidence": 1,
            "description": "dns-query, http-host; frame 22564 / UDP stream 326, frame 22807 / UDP stream 326, frame 23003 / TCP stream 442, frame 23016 / TCP stream 443, frame 23017 / TCP stream 444"
          },
          {
            "type": "domain",
            "value": "c.sharethis.mgr.consensu.org",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 4646 / UDP stream 76, frame 4741 / UDP stream 76, frame 55593 / UDP stream 736, frame 55772 / UDP stream 736, frame 4857 / TCP stream 143 +2 more"
          },
          {
            "type": "domain",
            "value": "c1.adform.net",
            "confidence": 1,
            "description": "dns-query, tls-sni; frame 33226 / UDP stream 477, frame 33227 / UDP stream 477, frame 33231 / TCP stream 743"
          },
          {
            "type": "domain",
            "value": "ca.brightcove.net",
            "confidence": 1,
            "description": "dns-cname; frame 37389 / UDP stream 540, frame 47432 / UDP stream 633"
          },
          {
            "type": "domain",
            "value": "cache.prod.ad-council.psdops.com",
            "confidence": 1,
            "description": "dns-query; frame 50234 / UDP stream 660, frame 50436 / UDP stream 660"
          },
          {
            "type": "domain",
            "value": "carambola-d.openx.net",
            "confidence": 1,
            "description": "dns-query, http-host; frame 17216 / UDP stream 220, frame 17359 / UDP stream 220, frame 17525 / TCP stream 287, frame 29964 / TCP stream 625, frame 29983 / TCP stream 626 +1 more"
          }
        ],
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap"
        ],
        "source_sha256": "d35d186bb34fe0bf6a2e8787ebd71f44ec3ed0b90b3bbc890a97bad8823d92b8",
        "semantic_sha256": "e93804940a7874496153bbdc1a859f8145b3c4f1c2fe41106c786d9ccce66065",
        "observable_count": 5362,
        "assessment_sha256": "b44f54b9bdf636106044429a776e8e81559612511519630e9b69170098f11100",
        "evidence_copy_scope": "bounded-preview-full-evidence-retained-in-source-analysis",
        "ioc_candidate_count": 38,
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "suspicious_findings": [
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 139 / TCP stream 6, frame 182 / TCP stream 6",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 172 / TCP stream 10, frame 1441 / TCP stream 10",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 203 / TCP stream 11, frame 1271 / TCP stream 11",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 220 / TCP stream 13, frame 368 / TCP stream 13",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 1565 / TCP stream 21, frame 1706 / TCP stream 21",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 1844 / TCP stream 25, frame 2421 / TCP stream 25",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 3625 / TCP stream 126, frame 3757 / TCP stream 126",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 3721 / TCP stream 109, frame 3855 / TCP stream 109",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 3877 / TCP stream 109, frame 4182 / TCP stream 109",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 3912 / TCP stream 111, frame 3959 / TCP stream 111",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 3917 / TCP stream 108, frame 3954 / TCP stream 108",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 3920 / TCP stream 98, frame 3966 / TCP stream 98",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 3925 / TCP stream 110, frame 3972 / TCP stream 110",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 3963 / TCP stream 108, frame 4135 / TCP stream 108",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 3969 / TCP stream 111, frame 4145 / TCP stream 111",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 3984 / TCP stream 98, frame 4165 / TCP stream 98",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 3994 / TCP stream 110, frame 4154 / TCP stream 110",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 4138 / TCP stream 108, frame 4336 / TCP stream 108",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 4151 / TCP stream 111, frame 4341 / TCP stream 111",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 4185 / TCP stream 110, frame 4352 / TCP stream 110",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 4199 / TCP stream 98, frame 4366 / TCP stream 98",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 4214 / TCP stream 109, frame 4369 / TCP stream 109",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 4338 / TCP stream 108, frame 4459 / TCP stream 108",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 4345 / TCP stream 111, frame 4485 / TCP stream 111",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 4356 / TCP stream 110, frame 4517 / TCP stream 110",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 4375 / TCP stream 98, frame 4502 / TCP stream 98",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 4377 / TCP stream 109, frame 4505 / TCP stream 109",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 4466 / TCP stream 108, frame 4587 / TCP stream 108",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 4494 / TCP stream 111, frame 4605 / TCP stream 111",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 4504 / TCP stream 98, frame 4624 / TCP stream 98",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 4507 / TCP stream 109, frame 4638 / TCP stream 109",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 4537 / TCP stream 110, frame 4626 / TCP stream 110",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 4592 / TCP stream 108, frame 4659 / TCP stream 108",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 4607 / TCP stream 111, frame 4666 / TCP stream 111",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 13089 / TCP stream 200, frame 13529 / TCP stream 200",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 13190 / TCP stream 202, frame 13711 / TCP stream 202",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 13289 / TCP stream 203, frame 13489 / TCP stream 203",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 13416 / TCP stream 207, frame 13805 / TCP stream 207",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 14067 / TCP stream 199, frame 14104 / TCP stream 199",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 14068 / TCP stream 200, frame 14097 / TCP stream 200",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 14069 / TCP stream 201, frame 14116 / TCP stream 201",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 14107 / TCP stream 200, frame 14250 / TCP stream 200",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 14112 / TCP stream 199, frame 14293 / TCP stream 199",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 14121 / TCP stream 201, frame 14197 / TCP stream 201",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 14131 / TCP stream 215, frame 14245 / TCP stream 215",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 14132 / TCP stream 217, frame 14450 / TCP stream 217",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 14133 / TCP stream 216, frame 14249 / TCP stream 216",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 14181 / TCP stream 220, frame 14567 / TCP stream 220",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 14215 / TCP stream 201, frame 14390 / TCP stream 201",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 14270 / TCP stream 215, frame 14944 / TCP stream 215",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 14286 / TCP stream 216, frame 14432 / TCP stream 216",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 14397 / TCP stream 222, frame 15395 / TCP stream 222",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 14398 / TCP stream 223, frame 14612 / TCP stream 223",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 15180 / TCP stream 239, frame 15514 / TCP stream 239",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 15725 / TCP stream 249, frame 16147 / TCP stream 249",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 15752 / TCP stream 252, frame 16157 / TCP stream 252",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 15753 / TCP stream 253, frame 15939 / TCP stream 253",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 15754 / TCP stream 254, frame 15883 / TCP stream 254",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 15788 / TCP stream 256, frame 15958 / TCP stream 256",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 15795 / TCP stream 255, frame 15998 / TCP stream 255",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 16010 / TCP stream 262, frame 16277 / TCP stream 262",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 16354 / TCP stream 267, frame 17007 / TCP stream 267",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 16605 / TCP stream 269, frame 16749 / TCP stream 269",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 17029 / TCP stream 275, frame 17147 / TCP stream 275",
            "severity": "medium"
          },
          {
            "reason": "An HTTP request exposed a token-, key-, auth-, or session-like value in the URI. This is a review lead and a credential-exposure concern even when the application is legitimate. Rule cleartext-tokenized-api@pcap-rules-v5; confidence 80%.",
            "category": "Authentication-like token in cleartext HTTP URI",
            "evidence": "frame 17159 / TCP stream 277, frame 18093 / TCP stream 277, frame 19001 / TCP stream 277",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 17183 / TCP stream 279, frame 17568 / TCP stream 279",
            "severity": "medium"
          },
          {
            "reason": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review. Rule repeated-http-posts@pcap-rules-v5; confidence 72%.",
            "category": "Repeated outbound HTTP POST activity",
            "evidence": "frame 17246 / TCP stream 258, frame 17375 / TCP stream 284, frame 17419 / TCP stream 285, frame 29924 / TCP stream 258, frame 29930 / TCP stream 284 +7 more",
            "severity": "medium"
          },
          {
            "reason": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review. Rule repeated-http-posts@pcap-rules-v5; confidence 72%.",
            "category": "Repeated outbound HTTP POST activity",
            "evidence": "frame 17543 / TCP stream 290, frame 29919 / TCP stream 601, frame 29961 / TCP stream 624, frame 33475 / TCP stream 601, frame 33489 / TCP stream 624",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 17781 / TCP stream 297, frame 18145 / TCP stream 297",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 18284 / TCP stream 308, frame 19831 / TCP stream 308",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 18309 / TCP stream 309, frame 18421 / TCP stream 309",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 18599 / TCP stream 321, frame 18725 / TCP stream 321",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 18807 / TCP stream 306, frame 18877 / TCP stream 306",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 18808 / TCP stream 264, frame 18879 / TCP stream 264",
            "severity": "medium"
          },
          {
            "reason": "Repeated requests have a stable cadence consistent with automated callback or beacon behavior. Rule periodic-http-callbacks@pcap-rules-v5; confidence 88%.",
            "category": "Periodic HTTP callback pattern",
            "evidence": "frame 18895 / TCP stream 290, frame 28899 / TCP stream 601, frame 31301 / TCP stream 601, frame 32296 / TCP stream 601, frame 34541 / TCP stream 601 +16 more",
            "severity": "high"
          },
          {
            "reason": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review. Rule repeated-http-posts@pcap-rules-v5; confidence 72%.",
            "category": "Repeated outbound HTTP POST activity",
            "evidence": "frame 18895 / TCP stream 290, frame 28899 / TCP stream 601, frame 31301 / TCP stream 601, frame 32296 / TCP stream 601, frame 34541 / TCP stream 601 +16 more",
            "severity": "medium"
          },
          {
            "reason": "Repeated requests have a stable cadence consistent with automated callback or beacon behavior. Rule periodic-http-callbacks@pcap-rules-v5; confidence 88%.",
            "category": "Periodic HTTP callback pattern",
            "evidence": "frame 19789 / TCP stream 358, frame 28994 / TCP stream 358, frame 31431 / TCP stream 358, frame 32371 / TCP stream 358, frame 34737 / TCP stream 358 +16 more",
            "severity": "high"
          },
          {
            "reason": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review. Rule repeated-http-posts@pcap-rules-v5; confidence 72%.",
            "category": "Repeated outbound HTTP POST activity",
            "evidence": "frame 19789 / TCP stream 358, frame 28994 / TCP stream 358, frame 31431 / TCP stream 358, frame 32371 / TCP stream 358, frame 34737 / TCP stream 358 +16 more",
            "severity": "medium"
          },
          {
            "reason": "Repeated requests have a stable cadence consistent with automated callback or beacon behavior. Rule periodic-http-callbacks@pcap-rules-v5; confidence 88%.",
            "category": "Periodic HTTP callback pattern",
            "evidence": "frame 19869 / TCP stream 360, frame 28988 / TCP stream 606, frame 31384 / TCP stream 657, frame 32346 / TCP stream 657, frame 34650 / TCP stream 657 +14 more",
            "severity": "high"
          },
          {
            "reason": "Repeated requests have a stable cadence consistent with automated callback or beacon behavior. Rule periodic-http-callbacks@pcap-rules-v5; confidence 88%.",
            "category": "Periodic HTTP callback pattern",
            "evidence": "frame 19954 / TCP stream 360, frame 29010 / TCP stream 606, frame 31416 / TCP stream 657, frame 32363 / TCP stream 657, frame 34679 / TCP stream 657 +14 more",
            "severity": "high"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 20186 / TCP stream 366, frame 20378 / TCP stream 366",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 21092 / TCP stream 378, frame 21491 / TCP stream 378",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 21180 / TCP stream 382, frame 21750 / TCP stream 382",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 22177 / TCP stream 414, frame 22463 / TCP stream 414",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 22433 / TCP stream 431, frame 22731 / TCP stream 431",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 22436 / TCP stream 432, frame 22740 / TCP stream 432",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 22711 / TCP stream 428, frame 22762 / TCP stream 428, frame 30020 / TCP stream 631, frame 30045 / TCP stream 631, frame 30159 / TCP stream 631 +11 more",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 22796 / TCP stream 367, frame 22985 / TCP stream 367",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 22834 / TCP stream 440, frame 23021 / TCP stream 440",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 23017 / TCP stream 444, frame 23625 / TCP stream 444",
            "severity": "medium"
          },
          {
            "reason": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review. Rule repeated-http-posts@pcap-rules-v5; confidence 72%.",
            "category": "Repeated outbound HTTP POST activity",
            "evidence": "frame 23067 / TCP stream 445, frame 29185 / TCP stream 607, frame 31738 / TCP stream 698, frame 32955 / TCP stream 737, frame 35543 / TCP stream 836",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 23224 / TCP stream 366, frame 23547 / TCP stream 366",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 23652 / TCP stream 414, frame 23847 / TCP stream 414",
            "severity": "medium"
          },
          {
            "reason": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review. Rule repeated-http-posts@pcap-rules-v5; confidence 72%.",
            "category": "Repeated outbound HTTP POST activity",
            "evidence": "frame 23779 / TCP stream 477, frame 23783 / TCP stream 481, frame 24374 / TCP stream 477, frame 30794 / TCP stream 477, frame 30897 / TCP stream 477 +7 more",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 23996 / TCP stream 483, frame 24197 / TCP stream 483",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 24520 / TCP stream 492, frame 24616 / TCP stream 492",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 24525 / TCP stream 493, frame 24707 / TCP stream 493",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 24744 / TCP stream 495, frame 24997 / TCP stream 495",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 25662 / TCP stream 508, frame 25688 / TCP stream 508",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 25870 / TCP stream 513, frame 25894 / TCP stream 513",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 25968 / TCP stream 515, frame 25981 / TCP stream 515",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 26043 / TCP stream 516, frame 26060 / TCP stream 516",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 26336 / TCP stream 513, frame 26347 / TCP stream 513",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 26337 / TCP stream 515, frame 26350 / TCP stream 515",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 26344 / TCP stream 516, frame 26354 / TCP stream 516",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 26828 / TCP stream 275, frame 26880 / TCP stream 275",
            "severity": "medium"
          },
          {
            "reason": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review. Rule repeated-http-posts@pcap-rules-v5; confidence 72%.",
            "category": "Repeated outbound HTTP POST activity",
            "evidence": "frame 27102 / TCP stream 284, frame 27104 / TCP stream 258, frame 27107 / TCP stream 285, frame 31268 / TCP stream 258, frame 31304 / TCP stream 258 +7 more",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 27960 / TCP stream 528, frame 27992 / TCP stream 528",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 28027 / TCP stream 573, frame 28128 / TCP stream 573",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 28059 / TCP stream 576, frame 28171 / TCP stream 576",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 28329 / TCP stream 573, frame 28369 / TCP stream 573",
            "severity": "medium"
          },
          {
            "reason": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review. Rule repeated-http-posts@pcap-rules-v5; confidence 72%.",
            "category": "Repeated outbound HTTP POST activity",
            "evidence": "frame 29947 / TCP stream 622, frame 29975 / TCP stream 627, frame 33521 / TCP stream 749, frame 37986 / TCP stream 900, frame 45054 / TCP stream 1033 +2 more",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 30143 / TCP stream 573, frame 30165 / TCP stream 573",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 30146 / TCP stream 637, frame 30179 / TCP stream 637",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 30153 / TCP stream 635, frame 30346 / TCP stream 635",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 30435 / TCP stream 637, frame 30443 / TCP stream 637",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 31088 / TCP stream 622, frame 31095 / TCP stream 622, frame 34226 / TCP stream 772, frame 34253 / TCP stream 772, frame 38477 / TCP stream 929 +3 more",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 31153 / TCP stream 622, frame 31159 / TCP stream 622, frame 34259 / TCP stream 772, frame 34269 / TCP stream 772, frame 38440 / TCP stream 900 +3 more",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 31155 / TCP stream 627, frame 31168 / TCP stream 627, frame 34028 / TCP stream 749, frame 34034 / TCP stream 749, frame 38472 / TCP stream 928 +3 more",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 31190 / TCP stream 677, frame 31201 / TCP stream 677",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 31245 / TCP stream 622, frame 31252 / TCP stream 622",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 31263 / TCP stream 627, frame 31275 / TCP stream 627",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 31671 / TCP stream 695, frame 31678 / TCP stream 695",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 31692 / TCP stream 697, frame 31702 / TCP stream 697",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 32521 / TCP stream 719, frame 32572 / TCP stream 719",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 32527 / TCP stream 720, frame 32543 / TCP stream 720, frame 32775 / TCP stream 720, frame 32842 / TCP stream 720",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 32859 / TCP stream 720, frame 32969 / TCP stream 720",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 33584 / TCP stream 637, frame 33606 / TCP stream 637",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 33627 / TCP stream 752, frame 33659 / TCP stream 752",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 34296 / TCP stream 773, frame 34307 / TCP stream 773",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 34334 / TCP stream 749, frame 34355 / TCP stream 749",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 34348 / TCP stream 772, frame 34367 / TCP stream 772",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 35262 / TCP stream 819, frame 35323 / TCP stream 819",
            "severity": "medium"
          },
          {
            "reason": "Repeated requests have a stable cadence consistent with automated callback or beacon behavior. Rule periodic-http-callbacks@pcap-rules-v5; confidence 88%.",
            "category": "Periodic HTTP callback pattern",
            "evidence": "frame 37094 / TCP stream 867, frame 37663 / TCP stream 886, frame 40878 / TCP stream 957, frame 42107 / TCP stream 988, frame 44705 / TCP stream 1020 +8 more",
            "severity": "high"
          },
          {
            "reason": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review. Rule repeated-http-posts@pcap-rules-v5; confidence 72%.",
            "category": "Repeated outbound HTTP POST activity",
            "evidence": "frame 37094 / TCP stream 867, frame 37663 / TCP stream 886, frame 40878 / TCP stream 957, frame 42107 / TCP stream 988, frame 44705 / TCP stream 1020 +8 more",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 37478 / TCP stream 878, frame 37486 / TCP stream 878",
            "severity": "medium"
          },
          {
            "reason": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review. Rule repeated-http-posts@pcap-rules-v5; confidence 72%.",
            "category": "Repeated outbound HTTP POST activity",
            "evidence": "frame 37977 / TCP stream 899, frame 45055 / TCP stream 1032, frame 45070 / TCP stream 1034, frame 48017 / TCP stream 1103, frame 48027 / TCP stream 1106 +4 more",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 37993 / TCP stream 901, frame 38004 / TCP stream 901",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 38040 / TCP stream 906, frame 38064 / TCP stream 906",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 38045 / TCP stream 907, frame 38086 / TCP stream 907",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 38046 / TCP stream 908, frame 38072 / TCP stream 908",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 38530 / TCP stream 900, frame 38541 / TCP stream 900",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 38570 / TCP stream 928, frame 38588 / TCP stream 928",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 38571 / TCP stream 929, frame 38591 / TCP stream 929",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 38852 / TCP stream 936, frame 38880 / TCP stream 936",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 40266 / TCP stream 943, frame 40326 / TCP stream 943",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 40377 / TCP stream 933, frame 40405 / TCP stream 933",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 40573 / TCP stream 949, frame 40593 / TCP stream 949",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 41532 / TCP stream 971, frame 41542 / TCP stream 971",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 44196 / TCP stream 1009, frame 44235 / TCP stream 1009",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 44215 / TCP stream 1010, frame 44392 / TCP stream 1010",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 44835 / TCP stream 1023, frame 44843 / TCP stream 1023",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 45119 / TCP stream 1035, frame 45232 / TCP stream 1035",
            "severity": "medium"
          },
          {
            "reason": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review. Rule repeated-http-posts@pcap-rules-v5; confidence 72%.",
            "category": "Repeated outbound HTTP POST activity",
            "evidence": "frame 45608 / TCP stream 1044, frame 45615 / TCP stream 1046, frame 45616 / TCP stream 1045, frame 47997 / TCP stream 1044, frame 48002 / TCP stream 1046 +7 more",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 45709 / TCP stream 1048, frame 45718 / TCP stream 1048",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 46463 / TCP stream 1070, frame 46593 / TCP stream 1070",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 46601 / TCP stream 1071, frame 46605 / TCP stream 1071",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 47704 / TCP stream 1093, frame 47709 / TCP stream 1093",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 48035 / TCP stream 1105, frame 48102 / TCP stream 1105",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 49058 / TCP stream 1134, frame 49068 / TCP stream 1134",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 49186 / TCP stream 1136, frame 49196 / TCP stream 1136",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 49613 / TCP stream 1134, frame 49619 / TCP stream 1134",
            "severity": "medium"
          },
          {
            "reason": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review. Rule repeated-http-posts@pcap-rules-v5; confidence 72%.",
            "category": "Repeated outbound HTTP POST activity",
            "evidence": "frame 49766 / TCP stream 1165, frame 49767 / TCP stream 1166, frame 49791 / TCP stream 1168, frame 52495 / TCP stream 1166, frame 52540 / TCP stream 1166 +4 more",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 50162 / TCP stream 1173, frame 50179 / TCP stream 1173",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 50169 / TCP stream 1174, frame 50186 / TCP stream 1174",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 50176 / TCP stream 1175, frame 50193 / TCP stream 1175",
            "severity": "medium"
          },
          {
            "reason": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review. Rule repeated-http-posts@pcap-rules-v5; confidence 72%.",
            "category": "Repeated outbound HTTP POST activity",
            "evidence": "frame 50289 / TCP stream 1044, frame 50294 / TCP stream 1046, frame 50295 / TCP stream 1045, frame 53029 / TCP stream 1044, frame 53103 / TCP stream 1044 +4 more",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 52132 / TCP stream 1245, frame 52185 / TCP stream 1245",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 52172 / TCP stream 1248, frame 52256 / TCP stream 1248",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 52208 / TCP stream 1251, frame 52323 / TCP stream 1251",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 52313 / TCP stream 1258, frame 52364 / TCP stream 1258",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 52841 / TCP stream 1252, frame 52890 / TCP stream 1252",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 52932 / TCP stream 1252, frame 52938 / TCP stream 1252",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 52950 / TCP stream 1284, frame 52962 / TCP stream 1284",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 52989 / TCP stream 1252, frame 52999 / TCP stream 1252",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 53037 / TCP stream 1252, frame 53052 / TCP stream 1252",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 53044 / TCP stream 1284, frame 53059 / TCP stream 1284",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 53390 / TCP stream 1290, frame 53728 / TCP stream 1290",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 53400 / TCP stream 1293, frame 53443 / TCP stream 1293",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 53403 / TCP stream 1294, frame 53439 / TCP stream 1294",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 53973 / TCP stream 1301, frame 54074 / TCP stream 1301",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 54177 / TCP stream 1304, frame 54201 / TCP stream 1304",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 54845 / TCP stream 1322, frame 55077 / TCP stream 1322",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 54869 / TCP stream 1319, frame 54935 / TCP stream 1319",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 54870 / TCP stream 1326, frame 54899 / TCP stream 1326",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 54871 / TCP stream 1325, frame 54900 / TCP stream 1325",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 54880 / TCP stream 1324, frame 54895 / TCP stream 1324",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 54885 / TCP stream 1330, frame 54995 / TCP stream 1330",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 54901 / TCP stream 1324, frame 54998 / TCP stream 1324",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 54909 / TCP stream 1326, frame 55040 / TCP stream 1326",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 54912 / TCP stream 1325, frame 55024 / TCP stream 1325",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 54945 / TCP stream 1319, frame 55041 / TCP stream 1319",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 55050 / TCP stream 1319, frame 55118 / TCP stream 1319",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 55145 / TCP stream 1319, frame 55246 / TCP stream 1319",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 55229 / TCP stream 1324, frame 55254 / TCP stream 1324",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 55248 / TCP stream 1319, frame 55258 / TCP stream 1319",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 55255 / TCP stream 1324, frame 55265 / TCP stream 1324",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 55989 / TCP stream 1342, frame 56083 / TCP stream 1342",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 56047 / TCP stream 1335, frame 56168 / TCP stream 1335",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 56783 / TCP stream 1335, frame 56883 / TCP stream 1335",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 56903 / TCP stream 1335, frame 56912 / TCP stream 1335",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 57227 / TCP stream 1357, frame 57235 / TCP stream 1357",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 58208 / TCP stream 1258, frame 58237 / TCP stream 1258",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 58266 / TCP stream 1384, frame 58305 / TCP stream 1384",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 58906 / TCP stream 1407, frame 58928 / TCP stream 1407",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 59017 / TCP stream 1410, frame 59115 / TCP stream 1410",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 59028 / TCP stream 1379, frame 59143 / TCP stream 1379",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 59280 / TCP stream 1416, frame 59296 / TCP stream 1416",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 59314 / TCP stream 1416, frame 59354 / TCP stream 1416",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 59461 / TCP stream 1421, frame 59470 / TCP stream 1421",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 59701 / TCP stream 1379, frame 59779 / TCP stream 1379",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 59800 / TCP stream 1379, frame 59964 / TCP stream 1379",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 61693 / TCP stream 1410, frame 61714 / TCP stream 1410",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 61913 / TCP stream 1475, frame 61919 / TCP stream 1475",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 62567 / TCP stream 1493, frame 62578 / TCP stream 1493, frame 62710 / TCP stream 1493, frame 62733 / TCP stream 1493",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 62583 / TCP stream 1494, frame 62587 / TCP stream 1494",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 63839 / TCP stream 1521, frame 63887 / TCP stream 1521",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 63842 / TCP stream 1522, frame 64009 / TCP stream 1522",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 63849 / TCP stream 1523, frame 64797 / TCP stream 1523",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 63888 / TCP stream 1518, frame 63984 / TCP stream 1518",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 63898 / TCP stream 1521, frame 64072 / TCP stream 1521",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 64003 / TCP stream 1518, frame 64073 / TCP stream 1518",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 64016 / TCP stream 1522, frame 64097 / TCP stream 1522",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 64129 / TCP stream 1535, frame 64195 / TCP stream 1535",
            "severity": "medium"
          },
          {
            "reason": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review. Rule repeated-http-posts@pcap-rules-v5; confidence 72%.",
            "category": "Repeated outbound HTTP POST activity",
            "evidence": "frame 64142 / TCP stream 1537, frame 64144 / TCP stream 1536, frame 68815 / TCP stream 1537, frame 71461 / TCP stream 1536, frame 71462 / TCP stream 1537 +4 more",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 66639 / TCP stream 1538, frame 67718 / TCP stream 1538",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 73071 / TCP stream 1538, frame 73303 / TCP stream 1538",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 76017 / TCP stream 1607, frame 76032 / TCP stream 1607",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 76047 / TCP stream 1609, frame 76075 / TCP stream 1609",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 76864 / TCP stream 1626, frame 77149 / TCP stream 1626",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 77356 / TCP stream 1625, frame 77658 / TCP stream 1625",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 77368 / TCP stream 1622, frame 77832 / TCP stream 1622",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 77450 / TCP stream 1624, frame 77589 / TCP stream 1624",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 77451 / TCP stream 1623, frame 77562 / TCP stream 1623",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 77588 / TCP stream 1623, frame 78271 / TCP stream 1623",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 77596 / TCP stream 1624, frame 77890 / TCP stream 1624",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 77666 / TCP stream 1625, frame 77817 / TCP stream 1625",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 77824 / TCP stream 1625, frame 77952 / TCP stream 1625",
            "severity": "medium"
          },
          {
            "reason": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats. Rule script-or-executable-transfer@pcap-rules-v5; confidence 86%.",
            "category": "Script, archive, or executable transfer candidate",
            "evidence": "frame 77840 / TCP stream 1622, frame 77950 / TCP stream 1622",
            "severity": "medium"
          },
          {
            "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v5; confidence 95%.",
            "category": "Directory-service protocol activity",
            "evidence": "frame 34820 / TCP stream 794, frame 34823 / TCP stream 794, frame 34827 / TCP stream 794, frame 34829 / TCP stream 794, frame 51251 / TCP stream 1213 +3 more",
            "severity": "low"
          },
          {
            "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v5; confidence 95%.",
            "category": "Directory-service protocol activity",
            "evidence": "frame 34662 / TCP stream 787, frame 34717 / TCP stream 787, frame 34726 / TCP stream 787, frame 35011 / TCP stream 806, frame 35018 / TCP stream 806 +36 more",
            "severity": "low"
          },
          {
            "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v5; confidence 95%.",
            "category": "Directory-service protocol activity",
            "evidence": "frame 3476 / TCP stream 104, frame 3478 / TCP stream 104, frame 3481 / TCP stream 104, frame 3483 / TCP stream 104, frame 37748 / TCP stream 891 +3 more",
            "severity": "low"
          },
          {
            "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v5; confidence 95%.",
            "category": "Directory-service protocol activity",
            "evidence": "frame 3373 / TCP stream 99, frame 3406 / TCP stream 99, frame 3411 / TCP stream 99, frame 4456 / TCP stream 128, frame 4469 / TCP stream 128 +36 more",
            "severity": "low"
          },
          {
            "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v5; confidence 95%.",
            "category": "Directory-service protocol activity",
            "evidence": "frame 2836 / TCP stream 58, frame 2838 / TCP stream 58, frame 2841 / TCP stream 58, frame 2843 / TCP stream 58, frame 3193 / TCP stream 58 +3 more",
            "severity": "low"
          },
          {
            "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v5; confidence 95%.",
            "category": "Directory-service protocol activity",
            "evidence": "frame 2742 / TCP stream 53, frame 2774 / TCP stream 53, frame 2779 / TCP stream 53, frame 2880 / TCP stream 63, frame 2885 / TCP stream 63 +36 more",
            "severity": "low"
          },
          {
            "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v5; confidence 95%.",
            "category": "Directory-service protocol activity",
            "evidence": "frame 34821 / TCP stream 794, frame 34824 / TCP stream 794, frame 34828 / TCP stream 794, frame 34830 / TCP stream 794, frame 51252 / TCP stream 1213 +3 more",
            "severity": "low"
          },
          {
            "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v5; confidence 95%.",
            "category": "Directory-service protocol activity",
            "evidence": "frame 34665 / TCP stream 787, frame 34722 / TCP stream 787, frame 35013 / TCP stream 806, frame 35021 / TCP stream 806, frame 35043 / TCP stream 806 +28 more",
            "severity": "low"
          },
          {
            "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v5; confidence 95%.",
            "category": "Directory-service protocol activity",
            "evidence": "frame 3477 / TCP stream 104, frame 3479 / TCP stream 104, frame 3482 / TCP stream 104, frame 3484 / TCP stream 104, frame 37749 / TCP stream 891 +3 more",
            "severity": "low"
          },
          {
            "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v5; confidence 95%.",
            "category": "Directory-service protocol activity",
            "evidence": "frame 3375 / TCP stream 99, frame 3410 / TCP stream 99, frame 4461 / TCP stream 128, frame 4471 / TCP stream 128, frame 4538 / TCP stream 128 +28 more",
            "severity": "low"
          },
          {
            "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v5; confidence 95%.",
            "category": "Directory-service protocol activity",
            "evidence": "frame 2837 / TCP stream 58, frame 2839 / TCP stream 58, frame 2842 / TCP stream 58, frame 2844 / TCP stream 58, frame 3194 / TCP stream 58 +3 more",
            "severity": "low"
          },
          {
            "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v5; confidence 95%.",
            "category": "Directory-service protocol activity",
            "evidence": "frame 2744 / TCP stream 53, frame 2778 / TCP stream 53, frame 2882 / TCP stream 63, frame 2887 / TCP stream 63, frame 2902 / TCP stream 63 +28 more",
            "severity": "low"
          },
          {
            "reason": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict. Rule unclassified-external-tcp@pcap-rules-v5; confidence 70%.",
            "category": "Sustained external TCP conversation outside decoded application coverage",
            "evidence": "frame 57135 / TCP stream 1355",
            "severity": "medium"
          }
        ],
        "observables_truncated": true,
        "actor_similarity_leads": [
          {
            "status": "ttp-overlap-not-attribution",
            "group_name": "Orangeworm",
            "similarity": 0.3333,
            "shared_count": 1,
            "group_attack_id": "G0071",
            "shared_techniques": [
              "T1071.001"
            ]
          },
          {
            "status": "ttp-overlap-not-attribution",
            "group_name": "Metador",
            "similarity": 0.2222,
            "shared_count": 2,
            "group_attack_id": "G1013",
            "shared_techniques": [
              "T1071.001",
              "T1105"
            ]
          },
          {
            "status": "ttp-overlap-not-attribution",
            "group_name": "Rancor",
            "similarity": 0.2222,
            "shared_count": 2,
            "group_attack_id": "G0075",
            "shared_techniques": [
              "T1071.001",
              "T1105"
            ]
          },
          {
            "status": "ttp-overlap-not-attribution",
            "group_name": "SilverTerrier",
            "similarity": 0.2,
            "shared_count": 1,
            "group_attack_id": "G0083",
            "shared_techniques": [
              "T1071.001"
            ]
          },
          {
            "status": "ttp-overlap-not-attribution",
            "group_name": "RedEcho",
            "similarity": 0.1667,
            "shared_count": 1,
            "group_attack_id": "G1042",
            "shared_techniques": [
              "T1071.001"
            ]
          },
          {
            "status": "ttp-overlap-not-attribution",
            "group_name": "APT18",
            "similarity": 0.1667,
            "shared_count": 2,
            "group_attack_id": "G0026",
            "shared_techniques": [
              "T1071.001",
              "T1105"
            ]
          },
          {
            "status": "ttp-overlap-not-attribution",
            "group_name": "Volatile Cedar",
            "similarity": 0.1667,
            "shared_count": 1,
            "group_attack_id": "G0123",
            "shared_techniques": [
              "T1105"
            ]
          },
          {
            "status": "ttp-overlap-not-attribution",
            "group_name": "TA551",
            "similarity": 0.1429,
            "shared_count": 2,
            "group_attack_id": "G0127",
            "shared_techniques": [
              "T1071.001",
              "T1105"
            ]
          },
          {
            "status": "ttp-overlap-not-attribution",
            "group_name": "Winnti Group",
            "similarity": 0.1429,
            "shared_count": 1,
            "group_attack_id": "G0044",
            "shared_techniques": [
              "T1105"
            ]
          },
          {
            "status": "ttp-overlap-not-attribution",
            "group_name": "Ajax Security Team",
            "similarity": 0.1429,
            "shared_count": 1,
            "group_attack_id": "G0130",
            "shared_techniques": [
              "T1105"
            ]
          }
        ],
        "reputation_snapshot_sha256": "119ad00c50967a54d2fc21d1755b0ccb91c762b379fadbff02a181941f843122",
        "expected_suspicious_behaviors": []
      },
      {
        "id": "ttp-evidence:0c443755-98f4-45dd-a9c4-e04e0415fe14:T1071.001",
        "type": "ttp-evidence",
        "label": "T1071.001 Application Layer Protocol: Web Protocols",
        "source": "log-pcap-analysis",
        "status": "suggested",
        "tactic": "command-and-control",
        "evidence": "T1071.001 Application Layer Protocol: Web Protocols",
        "attack_id": "T1071.001",
        "confidence": 0.85,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ]
      },
      {
        "id": "ttp-evidence:0c443755-98f4-45dd-a9c4-e04e0415fe14:T1105",
        "type": "ttp-evidence",
        "label": "T1105 Ingress Tool Transfer",
        "source": "log-pcap-analysis",
        "status": "suggested",
        "tactic": "command-and-control",
        "evidence": "T1105 Ingress Tool Transfer",
        "attack_id": "T1105",
        "confidence": 0.8,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ]
      },
      {
        "id": "ioc:analytics.carambo.la",
        "type": "pcap-observable",
        "value": "analytics.carambo.la",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "domain",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "udp_stream": 191,
            "frame_number": 15644,
            "display_filter": "frame.number == 15644",
            "timestamp_epoch": "1545161649.953712000"
          },
          {
            "udp_stream": 191,
            "frame_number": 15719,
            "display_filter": "frame.number == 15719",
            "timestamp_epoch": "1545161650.040441000"
          },
          {
            "udp_stream": 784,
            "frame_number": 60045,
            "display_filter": "frame.number == 60045",
            "timestamp_epoch": "1545161942.700118000"
          },
          {
            "udp_stream": 784,
            "frame_number": 60064,
            "display_filter": "frame.number == 60064",
            "timestamp_epoch": "1545161942.774741000"
          },
          {
            "udp_stream": 814,
            "frame_number": 63294,
            "display_filter": "frame.number == 63294",
            "timestamp_epoch": "1545161980.717042000"
          },
          {
            "udp_stream": 814,
            "frame_number": 63330,
            "display_filter": "frame.number == 63330",
            "timestamp_epoch": "1545161980.788957000"
          },
          {
            "tcp_stream": 257,
            "frame_number": 15852,
            "display_filter": "frame.number == 15852",
            "timestamp_epoch": "1545161650.115634000"
          },
          {
            "tcp_stream": 258,
            "frame_number": 15856,
            "display_filter": "frame.number == 15856",
            "timestamp_epoch": "1545161650.116045000"
          },
          {
            "tcp_stream": 258,
            "frame_number": 17246,
            "display_filter": "frame.number == 17246",
            "timestamp_epoch": "1545161650.896554000"
          },
          {
            "tcp_stream": 284,
            "frame_number": 17375,
            "display_filter": "frame.number == 17375",
            "timestamp_epoch": "1545161650.977006000"
          },
          {
            "tcp_stream": 285,
            "frame_number": 17419,
            "display_filter": "frame.number == 17419",
            "timestamp_epoch": "1545161650.987553000"
          },
          {
            "tcp_stream": 529,
            "frame_number": 27002,
            "display_filter": "frame.number == 27002",
            "timestamp_epoch": "1545161661.277695000"
          },
          {
            "tcp_stream": 284,
            "frame_number": 27102,
            "display_filter": "frame.number == 27102",
            "timestamp_epoch": "1545161661.432419000"
          },
          {
            "tcp_stream": 258,
            "frame_number": 27104,
            "display_filter": "frame.number == 27104",
            "timestamp_epoch": "1545161661.432423000"
          },
          {
            "tcp_stream": 285,
            "frame_number": 27107,
            "display_filter": "frame.number == 27107",
            "timestamp_epoch": "1545161661.432426000"
          },
          {
            "tcp_stream": 258,
            "frame_number": 27968,
            "display_filter": "frame.number == 27968",
            "timestamp_epoch": "1545161667.722251000"
          },
          {
            "tcp_stream": 258,
            "frame_number": 29924,
            "display_filter": "frame.number == 29924",
            "timestamp_epoch": "1545161680.903158000"
          },
          {
            "tcp_stream": 284,
            "frame_number": 29930,
            "display_filter": "frame.number == 29930",
            "timestamp_epoch": "1545161680.930120000"
          },
          {
            "tcp_stream": 285,
            "frame_number": 29949,
            "display_filter": "frame.number == 29949",
            "timestamp_epoch": "1545161680.952094000"
          },
          {
            "tcp_stream": 258,
            "frame_number": 31268,
            "display_filter": "frame.number == 31268",
            "timestamp_epoch": "1545161685.464819000"
          }
        ],
        "provider_signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:29.090570+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:29.088448+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:ap.lijit.com",
        "type": "pcap-observable",
        "value": "ap.lijit.com",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "domain",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "udp_stream": 217,
            "frame_number": 17195,
            "display_filter": "frame.number == 17195",
            "timestamp_epoch": "1545161650.840245000"
          },
          {
            "udp_stream": 217,
            "frame_number": 17295,
            "display_filter": "frame.number == 17295",
            "timestamp_epoch": "1545161650.913191000"
          },
          {
            "tcp_stream": 288,
            "frame_number": 17523,
            "display_filter": "frame.number == 17523",
            "timestamp_epoch": "1545161651.030053000"
          },
          {
            "tcp_stream": 513,
            "frame_number": 25870,
            "display_filter": "frame.number == 25870",
            "timestamp_epoch": "1545161658.589079000"
          },
          {
            "tcp_stream": 513,
            "frame_number": 25914,
            "display_filter": "frame.number == 25914",
            "timestamp_epoch": "1545161658.713114000"
          },
          {
            "tcp_stream": 515,
            "frame_number": 25968,
            "display_filter": "frame.number == 25968",
            "timestamp_epoch": "1545161658.794020000"
          },
          {
            "tcp_stream": 513,
            "frame_number": 25989,
            "display_filter": "frame.number == 25989",
            "timestamp_epoch": "1545161658.910817000"
          },
          {
            "tcp_stream": 515,
            "frame_number": 25990,
            "display_filter": "frame.number == 25990",
            "timestamp_epoch": "1545161658.914671000"
          },
          {
            "tcp_stream": 513,
            "frame_number": 25998,
            "display_filter": "frame.number == 25998",
            "timestamp_epoch": "1545161658.990146000"
          },
          {
            "tcp_stream": 515,
            "frame_number": 26018,
            "display_filter": "frame.number == 26018",
            "timestamp_epoch": "1545161659.048038000"
          },
          {
            "tcp_stream": 516,
            "frame_number": 26043,
            "display_filter": "frame.number == 26043",
            "timestamp_epoch": "1545161659.129450000"
          },
          {
            "tcp_stream": 513,
            "frame_number": 26069,
            "display_filter": "frame.number == 26069",
            "timestamp_epoch": "1545161659.224140000"
          },
          {
            "tcp_stream": 513,
            "frame_number": 26093,
            "display_filter": "frame.number == 26093",
            "timestamp_epoch": "1545161659.326470000"
          },
          {
            "tcp_stream": 513,
            "frame_number": 26336,
            "display_filter": "frame.number == 26336",
            "timestamp_epoch": "1545161659.803303000"
          },
          {
            "tcp_stream": 515,
            "frame_number": 26337,
            "display_filter": "frame.number == 26337",
            "timestamp_epoch": "1545161659.803729000"
          },
          {
            "tcp_stream": 516,
            "frame_number": 26344,
            "display_filter": "frame.number == 26344",
            "timestamp_epoch": "1545161659.809481000"
          },
          {
            "tcp_stream": 513,
            "frame_number": 26370,
            "display_filter": "frame.number == 26370",
            "timestamp_epoch": "1545161659.995415000"
          },
          {
            "tcp_stream": 515,
            "frame_number": 26373,
            "display_filter": "frame.number == 26373",
            "timestamp_epoch": "1545161659.995419000"
          },
          {
            "tcp_stream": 516,
            "frame_number": 26376,
            "display_filter": "frame.number == 26376",
            "timestamp_epoch": "1545161660.079478000"
          },
          {
            "tcp_stream": 513,
            "frame_number": 26384,
            "display_filter": "frame.number == 26384",
            "timestamp_epoch": "1545161660.190290000"
          }
        ],
        "provider_signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": true,
            "queried_at": "2026-09-22T17:44:51.145095+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:29.258517+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:as.casalemedia.com",
        "type": "pcap-observable",
        "value": "as.casalemedia.com",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "domain",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "udp_stream": 262,
            "frame_number": 18883,
            "display_filter": "frame.number == 18883",
            "timestamp_epoch": "1545161652.321733000"
          },
          {
            "udp_stream": 262,
            "frame_number": 18945,
            "display_filter": "frame.number == 18945",
            "timestamp_epoch": "1545161652.420520000"
          },
          {
            "tcp_stream": 349,
            "frame_number": 19044,
            "display_filter": "frame.number == 19044",
            "timestamp_epoch": "1545161652.546732000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 19789,
            "display_filter": "frame.number == 19789",
            "timestamp_epoch": "1545161653.009538000"
          },
          {
            "tcp_stream": 602,
            "frame_number": 28901,
            "display_filter": "frame.number == 28901",
            "timestamp_epoch": "1545161669.471194000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 28994,
            "display_filter": "frame.number == 28994",
            "timestamp_epoch": "1545161669.758866000"
          },
          {
            "tcp_stream": 684,
            "frame_number": 31383,
            "display_filter": "frame.number == 31383",
            "timestamp_epoch": "1545161685.882089000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 31431,
            "display_filter": "frame.number == 31431",
            "timestamp_epoch": "1545161686.140376000"
          },
          {
            "tcp_stream": 684,
            "frame_number": 32302,
            "display_filter": "frame.number == 32302",
            "timestamp_epoch": "1545161701.108317000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 32371,
            "display_filter": "frame.number == 32371",
            "timestamp_epoch": "1545161701.426056000"
          },
          {
            "tcp_stream": 786,
            "frame_number": 34638,
            "display_filter": "frame.number == 34638",
            "timestamp_epoch": "1545161717.284624000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 34737,
            "display_filter": "frame.number == 34737",
            "timestamp_epoch": "1545161717.557672000"
          },
          {
            "tcp_stream": 786,
            "frame_number": 36770,
            "display_filter": "frame.number == 36770",
            "timestamp_epoch": "1545161732.613449000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 36835,
            "display_filter": "frame.number == 36835",
            "timestamp_epoch": "1545161732.962452000"
          },
          {
            "tcp_stream": 786,
            "frame_number": 37303,
            "display_filter": "frame.number == 37303",
            "timestamp_epoch": "1545161748.011558000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 37378,
            "display_filter": "frame.number == 37378",
            "timestamp_epoch": "1545161748.273629000"
          },
          {
            "tcp_stream": 786,
            "frame_number": 40350,
            "display_filter": "frame.number == 40350",
            "timestamp_epoch": "1545161763.489243000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 40449,
            "display_filter": "frame.number == 40449",
            "timestamp_epoch": "1545161763.902698000"
          },
          {
            "tcp_stream": 786,
            "frame_number": 41783,
            "display_filter": "frame.number == 41783",
            "timestamp_epoch": "1545161779.201225000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 41880,
            "display_filter": "frame.number == 41880",
            "timestamp_epoch": "1545161779.644182000"
          }
        ],
        "provider_signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:29.270547+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:29.266653+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:hbopenbid.pubmatic.com",
        "type": "pcap-observable",
        "value": "hbopenbid.pubmatic.com",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "domain",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "udp_stream": 219,
            "frame_number": 17208,
            "display_filter": "frame.number == 17208",
            "timestamp_epoch": "1545161650.848585000"
          },
          {
            "udp_stream": 219,
            "frame_number": 17353,
            "display_filter": "frame.number == 17353",
            "timestamp_epoch": "1545161650.928452000"
          },
          {
            "udp_stream": 773,
            "frame_number": 61639,
            "display_filter": "frame.number == 61639",
            "timestamp_epoch": "1545161951.609373000"
          },
          {
            "udp_stream": 773,
            "frame_number": 61654,
            "display_filter": "frame.number == 61654",
            "timestamp_epoch": "1545161951.684661000"
          },
          {
            "tcp_stream": 290,
            "frame_number": 17543,
            "display_filter": "frame.number == 17543",
            "timestamp_epoch": "1545161651.048817000"
          },
          {
            "tcp_stream": 290,
            "frame_number": 18895,
            "display_filter": "frame.number == 18895",
            "timestamp_epoch": "1545161652.344729000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 28899,
            "display_filter": "frame.number == 28899",
            "timestamp_epoch": "1545161669.471162000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 29919,
            "display_filter": "frame.number == 29919",
            "timestamp_epoch": "1545161680.882917000"
          },
          {
            "tcp_stream": 624,
            "frame_number": 29961,
            "display_filter": "frame.number == 29961",
            "timestamp_epoch": "1545161680.985841000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 31301,
            "display_filter": "frame.number == 31301",
            "timestamp_epoch": "1545161685.645307000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 32296,
            "display_filter": "frame.number == 32296",
            "timestamp_epoch": "1545161701.099653000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 33475,
            "display_filter": "frame.number == 33475",
            "timestamp_epoch": "1545161710.894519000"
          },
          {
            "tcp_stream": 624,
            "frame_number": 33489,
            "display_filter": "frame.number == 33489",
            "timestamp_epoch": "1545161710.979992000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 34541,
            "display_filter": "frame.number == 34541",
            "timestamp_epoch": "1545161717.120680000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 36771,
            "display_filter": "frame.number == 36771",
            "timestamp_epoch": "1545161732.613838000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 37305,
            "display_filter": "frame.number == 37305",
            "timestamp_epoch": "1545161748.013353000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 40346,
            "display_filter": "frame.number == 40346",
            "timestamp_epoch": "1545161763.479813000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 41785,
            "display_filter": "frame.number == 41785",
            "timestamp_epoch": "1545161779.203071000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 44535,
            "display_filter": "frame.number == 44535",
            "timestamp_epoch": "1545161794.772796000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 45515,
            "display_filter": "frame.number == 45515",
            "timestamp_epoch": "1545161810.397622000"
          }
        ],
        "provider_signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:29.440980+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:29.436917+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:ib.adnxs.com",
        "type": "pcap-observable",
        "value": "ib.adnxs.com",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "domain",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "udp_stream": 218,
            "frame_number": 17205,
            "display_filter": "frame.number == 17205",
            "timestamp_epoch": "1545161650.845626000"
          },
          {
            "udp_stream": 218,
            "frame_number": 17314,
            "display_filter": "frame.number == 17314",
            "timestamp_epoch": "1545161650.919407000"
          },
          {
            "tcp_stream": 289,
            "frame_number": 17531,
            "display_filter": "frame.number == 17531",
            "timestamp_epoch": "1545161651.039867000"
          },
          {
            "tcp_stream": 401,
            "frame_number": 21883,
            "display_filter": "frame.number == 21883",
            "timestamp_epoch": "1545161654.505981000"
          },
          {
            "tcp_stream": 401,
            "frame_number": 22038,
            "display_filter": "frame.number == 22038",
            "timestamp_epoch": "1545161654.635573000"
          },
          {
            "tcp_stream": 401,
            "frame_number": 23559,
            "display_filter": "frame.number == 23559",
            "timestamp_epoch": "1545161655.978380000"
          },
          {
            "tcp_stream": 462,
            "frame_number": 23626,
            "display_filter": "frame.number == 23626",
            "timestamp_epoch": "1545161656.052254000"
          },
          {
            "tcp_stream": 463,
            "frame_number": 23637,
            "display_filter": "frame.number == 23637",
            "timestamp_epoch": "1545161656.056650000"
          },
          {
            "tcp_stream": 466,
            "frame_number": 23667,
            "display_filter": "frame.number == 23667",
            "timestamp_epoch": "1545161656.106380000"
          },
          {
            "tcp_stream": 467,
            "frame_number": 23669,
            "display_filter": "frame.number == 23669",
            "timestamp_epoch": "1545161656.107425000"
          },
          {
            "tcp_stream": 468,
            "frame_number": 23674,
            "display_filter": "frame.number == 23674",
            "timestamp_epoch": "1545161656.115536000"
          },
          {
            "tcp_stream": 401,
            "frame_number": 24338,
            "display_filter": "frame.number == 24338",
            "timestamp_epoch": "1545161657.012176000"
          },
          {
            "tcp_stream": 462,
            "frame_number": 24355,
            "display_filter": "frame.number == 24355",
            "timestamp_epoch": "1545161657.015564000"
          },
          {
            "tcp_stream": 463,
            "frame_number": 24363,
            "display_filter": "frame.number == 24363",
            "timestamp_epoch": "1545161657.019437000"
          },
          {
            "tcp_stream": 623,
            "frame_number": 29960,
            "display_filter": "frame.number == 29960",
            "timestamp_epoch": "1545161680.985823000"
          },
          {
            "tcp_stream": 628,
            "frame_number": 29977,
            "display_filter": "frame.number == 29977",
            "timestamp_epoch": "1545161681.008349000"
          },
          {
            "tcp_stream": 623,
            "frame_number": 30790,
            "display_filter": "frame.number == 30790",
            "timestamp_epoch": "1545161683.463651000"
          },
          {
            "tcp_stream": 628,
            "frame_number": 30791,
            "display_filter": "frame.number == 30791",
            "timestamp_epoch": "1545161683.465907000"
          },
          {
            "tcp_stream": 660,
            "frame_number": 30811,
            "display_filter": "frame.number == 30811",
            "timestamp_epoch": "1545161683.546648000"
          },
          {
            "tcp_stream": 623,
            "frame_number": 30890,
            "display_filter": "frame.number == 30890",
            "timestamp_epoch": "1545161683.822629000"
          }
        ],
        "provider_signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": true,
            "queried_at": "2026-09-22T17:46:00.414704+00:00",
            "cache_scope": "shared-redis",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:29.617236+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:ocsp.pki.goog",
        "type": "pcap-observable",
        "value": "ocsp.pki.goog",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "domain",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "udp_stream": 838,
            "frame_number": 64004,
            "display_filter": "frame.number == 64004",
            "timestamp_epoch": "1545162075.132979000"
          },
          {
            "udp_stream": 838,
            "frame_number": 64063,
            "display_filter": "frame.number == 64063",
            "timestamp_epoch": "1545162075.229979000"
          },
          {
            "tcp_stream": 1537,
            "frame_number": 64142,
            "display_filter": "frame.number == 64142",
            "timestamp_epoch": "1545162075.306911000"
          },
          {
            "tcp_stream": 1536,
            "frame_number": 64144,
            "display_filter": "frame.number == 64144",
            "timestamp_epoch": "1545162075.310027000"
          },
          {
            "tcp_stream": 1537,
            "frame_number": 68815,
            "display_filter": "frame.number == 68815",
            "timestamp_epoch": "1545162078.181170000"
          },
          {
            "tcp_stream": 1536,
            "frame_number": 71461,
            "display_filter": "frame.number == 71461",
            "timestamp_epoch": "1545162078.463939000"
          },
          {
            "tcp_stream": 1537,
            "frame_number": 71462,
            "display_filter": "frame.number == 71462",
            "timestamp_epoch": "1545162078.464201000"
          },
          {
            "tcp_stream": 1546,
            "frame_number": 71471,
            "display_filter": "frame.number == 71471",
            "timestamp_epoch": "1545162078.547446000"
          },
          {
            "tcp_stream": 1536,
            "frame_number": 72395,
            "display_filter": "frame.number == 72395",
            "timestamp_epoch": "1545162078.868563000"
          },
          {
            "tcp_stream": 1537,
            "frame_number": 72396,
            "display_filter": "frame.number == 72396",
            "timestamp_epoch": "1545162078.868770000"
          },
          {
            "tcp_stream": 1546,
            "frame_number": 73129,
            "display_filter": "frame.number == 73129",
            "timestamp_epoch": "1545162079.114866000"
          }
        ],
        "provider_signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:29.633395+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:29.627744+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:odb.outbrain.com",
        "type": "pcap-observable",
        "value": "odb.outbrain.com",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "domain",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "udp_stream": 210,
            "frame_number": 16857,
            "display_filter": "frame.number == 16857",
            "timestamp_epoch": "1545161650.579198000"
          },
          {
            "udp_stream": 210,
            "frame_number": 17044,
            "display_filter": "frame.number == 17044",
            "timestamp_epoch": "1545161650.671661000"
          },
          {
            "udp_stream": 416,
            "frame_number": 29032,
            "display_filter": "frame.number == 29032",
            "timestamp_epoch": "1545161670.028669000"
          },
          {
            "udp_stream": 416,
            "frame_number": 29034,
            "display_filter": "frame.number == 29034",
            "timestamp_epoch": "1545161670.127073000"
          },
          {
            "tcp_stream": 277,
            "frame_number": 17159,
            "display_filter": "frame.number == 17159",
            "timestamp_epoch": "1545161650.781721000"
          },
          {
            "tcp_stream": 277,
            "frame_number": 18093,
            "display_filter": "frame.number == 18093",
            "timestamp_epoch": "1545161651.796966000"
          },
          {
            "tcp_stream": 277,
            "frame_number": 19001,
            "display_filter": "frame.number == 19001",
            "timestamp_epoch": "1545161652.503780000"
          }
        ],
        "provider_signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:29.897840+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:29.892538+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:revee.outbrain.com",
        "type": "pcap-observable",
        "value": "revee.outbrain.com",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "domain",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "udp_stream": 266,
            "frame_number": 19008,
            "display_filter": "frame.number == 19008",
            "timestamp_epoch": "1545161652.518512000"
          },
          {
            "udp_stream": 266,
            "frame_number": 19118,
            "display_filter": "frame.number == 19118",
            "timestamp_epoch": "1545161652.594839000"
          },
          {
            "udp_stream": 537,
            "frame_number": 37026,
            "display_filter": "frame.number == 37026",
            "timestamp_epoch": "1545161734.986141000"
          },
          {
            "udp_stream": 537,
            "frame_number": 37042,
            "display_filter": "frame.number == 37042",
            "timestamp_epoch": "1545161735.055286000"
          },
          {
            "udp_stream": 768,
            "frame_number": 58594,
            "display_filter": "frame.number == 58594",
            "timestamp_epoch": "1545161939.873024000"
          },
          {
            "udp_stream": 768,
            "frame_number": 58607,
            "display_filter": "frame.number == 58607",
            "timestamp_epoch": "1545161939.953469000"
          },
          {
            "tcp_stream": 355,
            "frame_number": 19383,
            "display_filter": "frame.number == 19383",
            "timestamp_epoch": "1545161652.735449000"
          },
          {
            "tcp_stream": 356,
            "frame_number": 19749,
            "display_filter": "frame.number == 19749",
            "timestamp_epoch": "1545161652.995069000"
          },
          {
            "tcp_stream": 439,
            "frame_number": 22820,
            "display_filter": "frame.number == 22820",
            "timestamp_epoch": "1545161655.250838000"
          },
          {
            "tcp_stream": 445,
            "frame_number": 23067,
            "display_filter": "frame.number == 23067",
            "timestamp_epoch": "1545161655.503734000"
          },
          {
            "tcp_stream": 459,
            "frame_number": 23558,
            "display_filter": "frame.number == 23558",
            "timestamp_epoch": "1545161655.977812000"
          },
          {
            "tcp_stream": 469,
            "frame_number": 23802,
            "display_filter": "frame.number == 23802",
            "timestamp_epoch": "1545161656.227311000"
          },
          {
            "tcp_stream": 607,
            "frame_number": 29185,
            "display_filter": "frame.number == 29185",
            "timestamp_epoch": "1545161672.227766000"
          },
          {
            "tcp_stream": 698,
            "frame_number": 31738,
            "display_filter": "frame.number == 31738",
            "timestamp_epoch": "1545161688.256224000"
          },
          {
            "tcp_stream": 737,
            "frame_number": 32955,
            "display_filter": "frame.number == 32955",
            "timestamp_epoch": "1545161703.843312000"
          },
          {
            "tcp_stream": 833,
            "frame_number": 35421,
            "display_filter": "frame.number == 35421",
            "timestamp_epoch": "1545161719.692171000"
          },
          {
            "tcp_stream": 836,
            "frame_number": 35543,
            "display_filter": "frame.number == 35543",
            "timestamp_epoch": "1545161719.943317000"
          },
          {
            "tcp_stream": 867,
            "frame_number": 37094,
            "display_filter": "frame.number == 37094",
            "timestamp_epoch": "1545161735.268650000"
          },
          {
            "tcp_stream": 886,
            "frame_number": 37663,
            "display_filter": "frame.number == 37663",
            "timestamp_epoch": "1545161750.608488000"
          },
          {
            "tcp_stream": 937,
            "frame_number": 38969,
            "display_filter": "frame.number == 38969",
            "timestamp_epoch": "1545161761.019380000"
          }
        ],
        "provider_signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:30.075326+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:30.071027+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:ssc.33across.com",
        "type": "pcap-observable",
        "value": "ssc.33across.com",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "domain",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "udp_stream": 342,
            "frame_number": 23565,
            "display_filter": "frame.number == 23565",
            "timestamp_epoch": "1545161655.989737000"
          },
          {
            "udp_stream": 342,
            "frame_number": 23650,
            "display_filter": "frame.number == 23650",
            "timestamp_epoch": "1545161656.066429000"
          },
          {
            "udp_stream": 656,
            "frame_number": 49675,
            "display_filter": "frame.number == 49675",
            "timestamp_epoch": "1545161867.411174000"
          },
          {
            "udp_stream": 656,
            "frame_number": 49689,
            "display_filter": "frame.number == 49689",
            "timestamp_epoch": "1545161867.487947000"
          },
          {
            "tcp_stream": 477,
            "frame_number": 23779,
            "display_filter": "frame.number == 23779",
            "timestamp_epoch": "1545161656.197353000"
          },
          {
            "tcp_stream": 481,
            "frame_number": 23783,
            "display_filter": "frame.number == 23783",
            "timestamp_epoch": "1545161656.200530000"
          },
          {
            "tcp_stream": 477,
            "frame_number": 24374,
            "display_filter": "frame.number == 24374",
            "timestamp_epoch": "1545161657.022093000"
          },
          {
            "tcp_stream": 477,
            "frame_number": 30794,
            "display_filter": "frame.number == 30794",
            "timestamp_epoch": "1545161683.478016000"
          },
          {
            "tcp_stream": 477,
            "frame_number": 30897,
            "display_filter": "frame.number == 30897",
            "timestamp_epoch": "1545161683.827756000"
          },
          {
            "tcp_stream": 477,
            "frame_number": 30935,
            "display_filter": "frame.number == 30935",
            "timestamp_epoch": "1545161683.937459000"
          },
          {
            "tcp_stream": 477,
            "frame_number": 33694,
            "display_filter": "frame.number == 33694",
            "timestamp_epoch": "1545161711.641588000"
          },
          {
            "tcp_stream": 477,
            "frame_number": 33732,
            "display_filter": "frame.number == 33732",
            "timestamp_epoch": "1545161711.745015000"
          },
          {
            "tcp_stream": 767,
            "frame_number": 33861,
            "display_filter": "frame.number == 33861",
            "timestamp_epoch": "1545161711.970411000"
          },
          {
            "tcp_stream": 477,
            "frame_number": 38160,
            "display_filter": "frame.number == 38160",
            "timestamp_epoch": "1545161757.034758000"
          },
          {
            "tcp_stream": 767,
            "frame_number": 38191,
            "display_filter": "frame.number == 38191",
            "timestamp_epoch": "1545161757.115676000"
          },
          {
            "tcp_stream": 477,
            "frame_number": 38236,
            "display_filter": "frame.number == 38236",
            "timestamp_epoch": "1545161757.187380000"
          },
          {
            "tcp_stream": 1165,
            "frame_number": 49766,
            "display_filter": "frame.number == 49766",
            "timestamp_epoch": "1545161867.617073000"
          },
          {
            "tcp_stream": 1166,
            "frame_number": 49767,
            "display_filter": "frame.number == 49767",
            "timestamp_epoch": "1545161867.617090000"
          },
          {
            "tcp_stream": 1168,
            "frame_number": 49791,
            "display_filter": "frame.number == 49791",
            "timestamp_epoch": "1545161867.640063000"
          },
          {
            "tcp_stream": 1166,
            "frame_number": 52495,
            "display_filter": "frame.number == 52495",
            "timestamp_epoch": "1545161891.786254000"
          }
        ],
        "provider_signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:30.235500+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:30.233766+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:us-u.openx.net",
        "type": "pcap-observable",
        "value": "us-u.openx.net",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "domain",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "udp_stream": 272,
            "frame_number": 19725,
            "display_filter": "frame.number == 19725",
            "timestamp_epoch": "1545161652.938840000"
          },
          {
            "udp_stream": 272,
            "frame_number": 19819,
            "display_filter": "frame.number == 19819",
            "timestamp_epoch": "1545161653.033316000"
          },
          {
            "udp_stream": 801,
            "frame_number": 61744,
            "display_filter": "frame.number == 61744",
            "timestamp_epoch": "1545161952.112319000"
          },
          {
            "udp_stream": 801,
            "frame_number": 61756,
            "display_filter": "frame.number == 61756",
            "timestamp_epoch": "1545161952.213264000"
          },
          {
            "tcp_stream": 360,
            "frame_number": 19869,
            "display_filter": "frame.number == 19869",
            "timestamp_epoch": "1545161653.119204000"
          },
          {
            "tcp_stream": 360,
            "frame_number": 19954,
            "display_filter": "frame.number == 19954",
            "timestamp_epoch": "1545161653.247268000"
          },
          {
            "tcp_stream": 360,
            "frame_number": 22026,
            "display_filter": "frame.number == 22026",
            "timestamp_epoch": "1545161654.625308000"
          },
          {
            "tcp_stream": 360,
            "frame_number": 22207,
            "display_filter": "frame.number == 22207",
            "timestamp_epoch": "1545161654.786798000"
          },
          {
            "tcp_stream": 606,
            "frame_number": 28988,
            "display_filter": "frame.number == 28988",
            "timestamp_epoch": "1545161669.724029000"
          },
          {
            "tcp_stream": 606,
            "frame_number": 29010,
            "display_filter": "frame.number == 29010",
            "timestamp_epoch": "1545161669.818452000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 30737,
            "display_filter": "frame.number == 30737",
            "timestamp_epoch": "1545161683.103576000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 30760,
            "display_filter": "frame.number == 30760",
            "timestamp_epoch": "1545161683.250819000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 31384,
            "display_filter": "frame.number == 31384",
            "timestamp_epoch": "1545161685.882090000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 31416,
            "display_filter": "frame.number == 31416",
            "timestamp_epoch": "1545161685.979507000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 32346,
            "display_filter": "frame.number == 32346",
            "timestamp_epoch": "1545161701.271269000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 32363,
            "display_filter": "frame.number == 32363",
            "timestamp_epoch": "1545161701.392028000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 33628,
            "display_filter": "frame.number == 33628",
            "timestamp_epoch": "1545161711.313776000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 33668,
            "display_filter": "frame.number == 33668",
            "timestamp_epoch": "1545161711.496406000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 33695,
            "display_filter": "frame.number == 33695",
            "timestamp_epoch": "1545161711.656519000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 33782,
            "display_filter": "frame.number == 33782",
            "timestamp_epoch": "1545161711.834597000"
          }
        ],
        "provider_signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:30.409796+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:30.407827+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:104.36.115.111",
        "type": "pcap-observable",
        "value": "104.36.115.111",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "ipv4",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "udp_stream": 219,
            "frame_number": 17353,
            "display_filter": "frame.number == 17353",
            "timestamp_epoch": "1545161650.928452000"
          }
        ],
        "provider_signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:31.762705+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:31.760724+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:151.101.2.2",
        "type": "pcap-observable",
        "value": "151.101.2.2",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "ipv4",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "udp_stream": 210,
            "frame_number": 17044,
            "display_filter": "frame.number == 17044",
            "timestamp_epoch": "1545161650.671661000"
          },
          {
            "udp_stream": 210,
            "frame_number": 17121,
            "display_filter": "frame.number == 17121",
            "timestamp_epoch": "1545161650.745678000"
          },
          {
            "udp_stream": 409,
            "frame_number": 28524,
            "display_filter": "frame.number == 28524",
            "timestamp_epoch": "1545161668.887194000"
          },
          {
            "udp_stream": 409,
            "frame_number": 28571,
            "display_filter": "frame.number == 28571",
            "timestamp_epoch": "1545161668.963323000"
          },
          {
            "udp_stream": 416,
            "frame_number": 29034,
            "display_filter": "frame.number == 29034",
            "timestamp_epoch": "1545161670.127073000"
          }
        ],
        "provider_signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:31.955587+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:31.952458+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:172.217.0.238",
        "type": "pcap-observable",
        "value": "172.217.0.238",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "ipv4",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "udp_stream": 77,
            "frame_number": 5504,
            "display_filter": "frame.number == 5504",
            "timestamp_epoch": "1545161628.618105000"
          },
          {
            "udp_stream": 584,
            "frame_number": 44112,
            "display_filter": "frame.number == 44112",
            "timestamp_epoch": "1545161789.364012000"
          },
          {
            "udp_stream": 838,
            "frame_number": 64063,
            "display_filter": "frame.number == 64063",
            "timestamp_epoch": "1545162075.229979000"
          },
          {
            "udp_stream": 860,
            "frame_number": 73478,
            "display_filter": "frame.number == 73478",
            "timestamp_epoch": "1545162080.386756000"
          },
          {
            "udp_stream": 920,
            "frame_number": 77888,
            "display_filter": "frame.number == 77888",
            "timestamp_epoch": "1545162746.741782000"
          }
        ],
        "provider_signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:32.138025+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:32.134275+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:173.241.244.143",
        "type": "pcap-observable",
        "value": "173.241.244.143",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "ipv4",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "udp_stream": 272,
            "frame_number": 19819,
            "display_filter": "frame.number == 19819",
            "timestamp_epoch": "1545161653.033316000"
          }
        ],
        "provider_signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:32.350076+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:32.345573+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:23.74.28.9",
        "type": "pcap-observable",
        "value": "23.74.28.9",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "ipv4",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "udp_stream": 262,
            "frame_number": 18945,
            "display_filter": "frame.number == 18945",
            "timestamp_epoch": "1545161652.420520000"
          },
          {
            "udp_stream": 262,
            "frame_number": 18993,
            "display_filter": "frame.number == 18993",
            "timestamp_epoch": "1545161652.496943000"
          },
          {
            "udp_stream": 444,
            "frame_number": 31359,
            "display_filter": "frame.number == 31359",
            "timestamp_epoch": "1545161685.813259000"
          },
          {
            "udp_stream": 492,
            "frame_number": 34593,
            "display_filter": "frame.number == 34593",
            "timestamp_epoch": "1545161717.214712000"
          },
          {
            "udp_stream": 670,
            "frame_number": 50828,
            "display_filter": "frame.number == 50828",
            "timestamp_epoch": "1545161873.051313000"
          },
          {
            "udp_stream": 800,
            "frame_number": 61668,
            "display_filter": "frame.number == 61668",
            "timestamp_epoch": "1545161951.719378000"
          }
        ],
        "provider_signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:32.561807+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:32.556157+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:50.31.185.52",
        "type": "pcap-observable",
        "value": "50.31.185.52",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "ipv4",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "udp_stream": 537,
            "frame_number": 37042,
            "display_filter": "frame.number == 37042",
            "timestamp_epoch": "1545161735.055286000"
          }
        ],
        "provider_signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:32.771432+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:32.769128+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:52.2.229.61",
        "type": "pcap-observable",
        "value": "52.2.229.61",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "ipv4",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "udp_stream": 133,
            "frame_number": 13172,
            "display_filter": "frame.number == 13172",
            "timestamp_epoch": "1545161648.520323000"
          },
          {
            "udp_stream": 191,
            "frame_number": 15719,
            "display_filter": "frame.number == 15719",
            "timestamp_epoch": "1545161650.040441000"
          },
          {
            "udp_stream": 606,
            "frame_number": 45592,
            "display_filter": "frame.number == 45592",
            "timestamp_epoch": "1545161811.033061000"
          },
          {
            "udp_stream": 661,
            "frame_number": 50445,
            "display_filter": "frame.number == 50445",
            "timestamp_epoch": "1545161869.741940000"
          },
          {
            "udp_stream": 784,
            "frame_number": 60064,
            "display_filter": "frame.number == 60064",
            "timestamp_epoch": "1545161942.774741000"
          },
          {
            "udp_stream": 814,
            "frame_number": 63330,
            "display_filter": "frame.number == 63330",
            "timestamp_epoch": "1545161980.788957000"
          }
        ],
        "provider_signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:32.986919+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:32.982495+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:52.203.49.123",
        "type": "pcap-observable",
        "value": "52.203.49.123",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "ipv4",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "udp_stream": 342,
            "frame_number": 23650,
            "display_filter": "frame.number == 23650",
            "timestamp_epoch": "1545161656.066429000"
          },
          {
            "udp_stream": 484,
            "frame_number": 33813,
            "display_filter": "frame.number == 33813",
            "timestamp_epoch": "1545161711.893102000"
          },
          {
            "udp_stream": 656,
            "frame_number": 49689,
            "display_filter": "frame.number == 49689",
            "timestamp_epoch": "1545161867.487947000"
          }
        ],
        "provider_signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:33.185664+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:33.181535+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:54.236.163.4",
        "type": "pcap-observable",
        "value": "54.236.163.4",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "ipv4",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "udp_stream": 342,
            "frame_number": 23650,
            "display_filter": "frame.number == 23650",
            "timestamp_epoch": "1545161656.066429000"
          },
          {
            "udp_stream": 484,
            "frame_number": 33813,
            "display_filter": "frame.number == 33813",
            "timestamp_epoch": "1545161711.893102000"
          },
          {
            "udp_stream": 656,
            "frame_number": 49689,
            "display_filter": "frame.number == 49689",
            "timestamp_epoch": "1545161867.487947000"
          }
        ],
        "provider_signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:33.388021+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:33.381553+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:54.87.174.85",
        "type": "pcap-observable",
        "value": "54.87.174.85",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "ipv4",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "udp_stream": 133,
            "frame_number": 13172,
            "display_filter": "frame.number == 13172",
            "timestamp_epoch": "1545161648.520323000"
          },
          {
            "udp_stream": 191,
            "frame_number": 15719,
            "display_filter": "frame.number == 15719",
            "timestamp_epoch": "1545161650.040441000"
          },
          {
            "udp_stream": 606,
            "frame_number": 45592,
            "display_filter": "frame.number == 45592",
            "timestamp_epoch": "1545161811.033061000"
          },
          {
            "udp_stream": 661,
            "frame_number": 50445,
            "display_filter": "frame.number == 50445",
            "timestamp_epoch": "1545161869.741940000"
          },
          {
            "udp_stream": 784,
            "frame_number": 60064,
            "display_filter": "frame.number == 60064",
            "timestamp_epoch": "1545161942.774741000"
          },
          {
            "udp_stream": 814,
            "frame_number": 63330,
            "display_filter": "frame.number == 63330",
            "timestamp_epoch": "1545161980.788957000"
          }
        ],
        "provider_signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:33.583098+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:33.576370+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:63.251.114.137",
        "type": "pcap-observable",
        "value": "63.251.114.137",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "ipv4",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "udp_stream": 393,
            "frame_number": 27633,
            "display_filter": "frame.number == 27633",
            "timestamp_epoch": "1545161662.863119000"
          },
          {
            "udp_stream": 662,
            "frame_number": 50447,
            "display_filter": "frame.number == 50447",
            "timestamp_epoch": "1545161869.743235000"
          },
          {
            "udp_stream": 692,
            "frame_number": 52161,
            "display_filter": "frame.number == 52161",
            "timestamp_epoch": "1545161891.060529000"
          },
          {
            "udp_stream": 762,
            "frame_number": 58135,
            "display_filter": "frame.number == 58135",
            "timestamp_epoch": "1545161936.102609000"
          }
        ],
        "provider_signals": [
          {
            "basis": "No verdict: not-applicable",
            "actors": [],
            "source": "malwarebazaar",
            "status": "not-applicable",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:35.155911+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:34.981203+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:34.979415+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:64.74.236.18",
        "type": "pcap-observable",
        "value": "64.74.236.18",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "ipv4",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "udp_stream": 266,
            "frame_number": 19118,
            "display_filter": "frame.number == 19118",
            "timestamp_epoch": "1545161652.594839000"
          }
        ],
        "provider_signals": [
          {
            "basis": "No verdict: not-applicable",
            "actors": [],
            "source": "malwarebazaar",
            "status": "not-applicable",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:35.358637+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:35.164572+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:35.160825+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:68.67.179.197",
        "type": "pcap-observable",
        "value": "68.67.179.197",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "ipv4",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "udp_stream": 218,
            "frame_number": 17314,
            "display_filter": "frame.number == 17314",
            "timestamp_epoch": "1545161650.919407000"
          },
          {
            "udp_stream": 263,
            "frame_number": 18929,
            "display_filter": "frame.number == 18929",
            "timestamp_epoch": "1545161652.404100000"
          },
          {
            "udp_stream": 461,
            "frame_number": 32320,
            "display_filter": "frame.number == 32320",
            "timestamp_epoch": "1545161701.182950000"
          }
        ],
        "provider_signals": [
          {
            "basis": "No verdict: not-applicable",
            "actors": [],
            "source": "malwarebazaar",
            "status": "not-applicable",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:35.627807+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:35.367204+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:47:35.363169+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:http://analytics.carambo.la/SetAdsRequest",
        "type": "pcap-observable",
        "value": "http://analytics.carambo.la/SetAdsRequest",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "url",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "tcp_stream": 258,
            "frame_number": 17246,
            "display_filter": "frame.number == 17246",
            "timestamp_epoch": "1545161650.896554000"
          },
          {
            "tcp_stream": 284,
            "frame_number": 17375,
            "display_filter": "frame.number == 17375",
            "timestamp_epoch": "1545161650.977006000"
          },
          {
            "tcp_stream": 285,
            "frame_number": 17419,
            "display_filter": "frame.number == 17419",
            "timestamp_epoch": "1545161650.987553000"
          },
          {
            "tcp_stream": 258,
            "frame_number": 29924,
            "display_filter": "frame.number == 29924",
            "timestamp_epoch": "1545161680.903158000"
          },
          {
            "tcp_stream": 284,
            "frame_number": 29930,
            "display_filter": "frame.number == 29930",
            "timestamp_epoch": "1545161680.930120000"
          },
          {
            "tcp_stream": 285,
            "frame_number": 29949,
            "display_filter": "frame.number == 29949",
            "timestamp_epoch": "1545161680.952094000"
          },
          {
            "tcp_stream": 258,
            "frame_number": 33477,
            "display_filter": "frame.number == 33477",
            "timestamp_epoch": "1545161710.908930000"
          },
          {
            "tcp_stream": 284,
            "frame_number": 33481,
            "display_filter": "frame.number == 33481",
            "timestamp_epoch": "1545161710.953282000"
          },
          {
            "tcp_stream": 258,
            "frame_number": 33500,
            "display_filter": "frame.number == 33500",
            "timestamp_epoch": "1545161711.000972000"
          },
          {
            "tcp_stream": 258,
            "frame_number": 37961,
            "display_filter": "frame.number == 37961",
            "timestamp_epoch": "1545161755.915292000"
          },
          {
            "tcp_stream": 284,
            "frame_number": 37963,
            "display_filter": "frame.number == 37963",
            "timestamp_epoch": "1545161755.943694000"
          },
          {
            "tcp_stream": 258,
            "frame_number": 37969,
            "display_filter": "frame.number == 37969",
            "timestamp_epoch": "1545161755.992399000"
          },
          {
            "tcp_stream": 1044,
            "frame_number": 45608,
            "display_filter": "frame.number == 45608",
            "timestamp_epoch": "1545161811.157714000"
          },
          {
            "tcp_stream": 1046,
            "frame_number": 45615,
            "display_filter": "frame.number == 45615",
            "timestamp_epoch": "1545161811.171747000"
          },
          {
            "tcp_stream": 1045,
            "frame_number": 45616,
            "display_filter": "frame.number == 45616",
            "timestamp_epoch": "1545161811.171781000"
          },
          {
            "tcp_stream": 1044,
            "frame_number": 47997,
            "display_filter": "frame.number == 47997",
            "timestamp_epoch": "1545161845.952248000"
          },
          {
            "tcp_stream": 1046,
            "frame_number": 48002,
            "display_filter": "frame.number == 48002",
            "timestamp_epoch": "1545161845.971091000"
          },
          {
            "tcp_stream": 1045,
            "frame_number": 48038,
            "display_filter": "frame.number == 48038",
            "timestamp_epoch": "1545161846.034155000"
          },
          {
            "tcp_stream": 1044,
            "frame_number": 52141,
            "display_filter": "frame.number == 52141",
            "timestamp_epoch": "1545161890.963658000"
          },
          {
            "tcp_stream": 1046,
            "frame_number": 52147,
            "display_filter": "frame.number == 52147",
            "timestamp_epoch": "1545161891.015702000"
          }
        ],
        "provider_signals": [],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:http://analytics.carambo.la/SetHbBidRequestProto",
        "type": "pcap-observable",
        "value": "http://analytics.carambo.la/SetHbBidRequestProto",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "url",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "tcp_stream": 284,
            "frame_number": 27102,
            "display_filter": "frame.number == 27102",
            "timestamp_epoch": "1545161661.432419000"
          },
          {
            "tcp_stream": 258,
            "frame_number": 27104,
            "display_filter": "frame.number == 27104",
            "timestamp_epoch": "1545161661.432423000"
          },
          {
            "tcp_stream": 285,
            "frame_number": 27107,
            "display_filter": "frame.number == 27107",
            "timestamp_epoch": "1545161661.432426000"
          },
          {
            "tcp_stream": 258,
            "frame_number": 31268,
            "display_filter": "frame.number == 31268",
            "timestamp_epoch": "1545161685.464819000"
          },
          {
            "tcp_stream": 258,
            "frame_number": 31304,
            "display_filter": "frame.number == 31304",
            "timestamp_epoch": "1545161685.651646000"
          },
          {
            "tcp_stream": 285,
            "frame_number": 31310,
            "display_filter": "frame.number == 31310",
            "timestamp_epoch": "1545161685.681255000"
          },
          {
            "tcp_stream": 258,
            "frame_number": 34346,
            "display_filter": "frame.number == 34346",
            "timestamp_epoch": "1545161713.520675000"
          },
          {
            "tcp_stream": 258,
            "frame_number": 34388,
            "display_filter": "frame.number == 34388",
            "timestamp_epoch": "1545161713.762202000"
          },
          {
            "tcp_stream": 285,
            "frame_number": 34393,
            "display_filter": "frame.number == 34393",
            "timestamp_epoch": "1545161713.801461000"
          },
          {
            "tcp_stream": 258,
            "frame_number": 38630,
            "display_filter": "frame.number == 38630",
            "timestamp_epoch": "1545161758.871550000"
          },
          {
            "tcp_stream": 258,
            "frame_number": 38681,
            "display_filter": "frame.number == 38681",
            "timestamp_epoch": "1545161758.980662000"
          },
          {
            "tcp_stream": 285,
            "frame_number": 38689,
            "display_filter": "frame.number == 38689",
            "timestamp_epoch": "1545161759.046878000"
          },
          {
            "tcp_stream": 1044,
            "frame_number": 50289,
            "display_filter": "frame.number == 50289",
            "timestamp_epoch": "1545161869.653082000"
          },
          {
            "tcp_stream": 1046,
            "frame_number": 50294,
            "display_filter": "frame.number == 50294",
            "timestamp_epoch": "1545161869.659192000"
          },
          {
            "tcp_stream": 1045,
            "frame_number": 50295,
            "display_filter": "frame.number == 50295",
            "timestamp_epoch": "1545161869.659205000"
          },
          {
            "tcp_stream": 1044,
            "frame_number": 53029,
            "display_filter": "frame.number == 53029",
            "timestamp_epoch": "1545161893.595505000"
          },
          {
            "tcp_stream": 1044,
            "frame_number": 53103,
            "display_filter": "frame.number == 53103",
            "timestamp_epoch": "1545161893.853874000"
          },
          {
            "tcp_stream": 1044,
            "frame_number": 53120,
            "display_filter": "frame.number == 53120",
            "timestamp_epoch": "1545161893.942400000"
          },
          {
            "tcp_stream": 1044,
            "frame_number": 59798,
            "display_filter": "frame.number == 59798",
            "timestamp_epoch": "1545161942.416503000"
          },
          {
            "tcp_stream": 1044,
            "frame_number": 60038,
            "display_filter": "frame.number == 60038",
            "timestamp_epoch": "1545161942.654560000"
          }
        ],
        "provider_signals": [],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:http://ap.lijit.com/rtb/bid?src=prebid_prebid_1.26.0",
        "type": "pcap-observable",
        "value": "http://ap.lijit.com/rtb/bid?src=prebid_prebid_1.26.0",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "url",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "tcp_stream": 288,
            "frame_number": 17523,
            "display_filter": "frame.number == 17523",
            "timestamp_epoch": "1545161651.030053000"
          },
          {
            "tcp_stream": 622,
            "frame_number": 29947,
            "display_filter": "frame.number == 29947",
            "timestamp_epoch": "1545161680.950031000"
          },
          {
            "tcp_stream": 627,
            "frame_number": 29975,
            "display_filter": "frame.number == 29975",
            "timestamp_epoch": "1545161681.008311000"
          },
          {
            "tcp_stream": 749,
            "frame_number": 33521,
            "display_filter": "frame.number == 33521",
            "timestamp_epoch": "1545161711.052165000"
          },
          {
            "tcp_stream": 900,
            "frame_number": 37986,
            "display_filter": "frame.number == 37986",
            "timestamp_epoch": "1545161756.096704000"
          },
          {
            "tcp_stream": 1033,
            "frame_number": 45054,
            "display_filter": "frame.number == 45054",
            "timestamp_epoch": "1545161800.978463000"
          },
          {
            "tcp_stream": 1107,
            "frame_number": 48045,
            "display_filter": "frame.number == 48045",
            "timestamp_epoch": "1545161846.044444000"
          },
          {
            "tcp_stream": 1112,
            "frame_number": 48056,
            "display_filter": "frame.number == 48056",
            "timestamp_epoch": "1545161846.083681000"
          },
          {
            "tcp_stream": 1252,
            "frame_number": 52201,
            "display_filter": "frame.number == 52201",
            "timestamp_epoch": "1545161891.132105000"
          },
          {
            "tcp_stream": 1379,
            "frame_number": 58173,
            "display_filter": "frame.number == 58173",
            "timestamp_epoch": "1545161936.172669000"
          }
        ],
        "provider_signals": [],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:http://as.casalemedia.com/headerstats?s=282603&u=http%3A%2F%2Ftime.com%2F5455078%2Fapple-ipad-pro-2018-review%2F&v=3",
        "type": "pcap-observable",
        "value": "http://as.casalemedia.com/headerstats?s=282603&u=http%3A%2F%2Ftime.com%2F5455078%2Fapple-ipad-pro-2018-review%2F&v=3",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "url",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "tcp_stream": 358,
            "frame_number": 19789,
            "display_filter": "frame.number == 19789",
            "timestamp_epoch": "1545161653.009538000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 28994,
            "display_filter": "frame.number == 28994",
            "timestamp_epoch": "1545161669.758866000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 31431,
            "display_filter": "frame.number == 31431",
            "timestamp_epoch": "1545161686.140376000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 32371,
            "display_filter": "frame.number == 32371",
            "timestamp_epoch": "1545161701.426056000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 34737,
            "display_filter": "frame.number == 34737",
            "timestamp_epoch": "1545161717.557672000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 36835,
            "display_filter": "frame.number == 36835",
            "timestamp_epoch": "1545161732.962452000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 37378,
            "display_filter": "frame.number == 37378",
            "timestamp_epoch": "1545161748.273629000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 40449,
            "display_filter": "frame.number == 40449",
            "timestamp_epoch": "1545161763.902698000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 41880,
            "display_filter": "frame.number == 41880",
            "timestamp_epoch": "1545161779.644182000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 44607,
            "display_filter": "frame.number == 44607",
            "timestamp_epoch": "1545161795.079561000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 45585,
            "display_filter": "frame.number == 45585",
            "timestamp_epoch": "1545161810.902804000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 46371,
            "display_filter": "frame.number == 46371",
            "timestamp_epoch": "1545161826.410511000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 47615,
            "display_filter": "frame.number == 47615",
            "timestamp_epoch": "1545161842.057259000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 49096,
            "display_filter": "frame.number == 49096",
            "timestamp_epoch": "1545161858.078353000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 50946,
            "display_filter": "frame.number == 50946",
            "timestamp_epoch": "1545161873.447802000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 51910,
            "display_filter": "frame.number == 51910",
            "timestamp_epoch": "1545161889.138540000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 53951,
            "display_filter": "frame.number == 53951",
            "timestamp_epoch": "1545161904.517232000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 57102,
            "display_filter": "frame.number == 57102",
            "timestamp_epoch": "1545161920.362169000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 58118,
            "display_filter": "frame.number == 58118",
            "timestamp_epoch": "1545161936.057353000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 61746,
            "display_filter": "frame.number == 61746",
            "timestamp_epoch": "1545161952.130200000"
          }
        ],
        "provider_signals": [],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:http://hbopenbid.pubmatic.com/translator?source=index-client",
        "type": "pcap-observable",
        "value": "http://hbopenbid.pubmatic.com/translator?source=index-client",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "url",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "tcp_stream": 290,
            "frame_number": 18895,
            "display_filter": "frame.number == 18895",
            "timestamp_epoch": "1545161652.344729000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 28899,
            "display_filter": "frame.number == 28899",
            "timestamp_epoch": "1545161669.471162000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 31301,
            "display_filter": "frame.number == 31301",
            "timestamp_epoch": "1545161685.645307000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 32296,
            "display_filter": "frame.number == 32296",
            "timestamp_epoch": "1545161701.099653000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 34541,
            "display_filter": "frame.number == 34541",
            "timestamp_epoch": "1545161717.120680000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 36771,
            "display_filter": "frame.number == 36771",
            "timestamp_epoch": "1545161732.613838000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 37305,
            "display_filter": "frame.number == 37305",
            "timestamp_epoch": "1545161748.013353000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 40346,
            "display_filter": "frame.number == 40346",
            "timestamp_epoch": "1545161763.479813000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 41785,
            "display_filter": "frame.number == 41785",
            "timestamp_epoch": "1545161779.203071000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 44535,
            "display_filter": "frame.number == 44535",
            "timestamp_epoch": "1545161794.772796000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 45515,
            "display_filter": "frame.number == 45515",
            "timestamp_epoch": "1545161810.397622000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 46301,
            "display_filter": "frame.number == 46301",
            "timestamp_epoch": "1545161825.911304000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 47548,
            "display_filter": "frame.number == 47548",
            "timestamp_epoch": "1545161841.552862000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 48947,
            "display_filter": "frame.number == 48947",
            "timestamp_epoch": "1545161857.372818000"
          },
          {
            "tcp_stream": 1198,
            "frame_number": 50833,
            "display_filter": "frame.number == 50833",
            "timestamp_epoch": "1545161873.066677000"
          },
          {
            "tcp_stream": 1198,
            "frame_number": 51792,
            "display_filter": "frame.number == 51792",
            "timestamp_epoch": "1545161888.764305000"
          },
          {
            "tcp_stream": 1198,
            "frame_number": 53859,
            "display_filter": "frame.number == 53859",
            "timestamp_epoch": "1545161904.193976000"
          },
          {
            "tcp_stream": 1198,
            "frame_number": 56991,
            "display_filter": "frame.number == 56991",
            "timestamp_epoch": "1545161920.060645000"
          },
          {
            "tcp_stream": 1198,
            "frame_number": 57977,
            "display_filter": "frame.number == 57977",
            "timestamp_epoch": "1545161935.704008000"
          },
          {
            "tcp_stream": 1470,
            "frame_number": 61697,
            "display_filter": "frame.number == 61697",
            "timestamp_epoch": "1545161951.816737000"
          }
        ],
        "provider_signals": [],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:http://hbopenbid.pubmatic.com/translator?source=prebid-client",
        "type": "pcap-observable",
        "value": "http://hbopenbid.pubmatic.com/translator?source=prebid-client",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "url",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "tcp_stream": 290,
            "frame_number": 17543,
            "display_filter": "frame.number == 17543",
            "timestamp_epoch": "1545161651.048817000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 29919,
            "display_filter": "frame.number == 29919",
            "timestamp_epoch": "1545161680.882917000"
          },
          {
            "tcp_stream": 624,
            "frame_number": 29961,
            "display_filter": "frame.number == 29961",
            "timestamp_epoch": "1545161680.985841000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 33475,
            "display_filter": "frame.number == 33475",
            "timestamp_epoch": "1545161710.894519000"
          },
          {
            "tcp_stream": 624,
            "frame_number": 33489,
            "display_filter": "frame.number == 33489",
            "timestamp_epoch": "1545161710.979992000"
          }
        ],
        "provider_signals": [],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:http://ib.adnxs.com/ut/v3/prebid",
        "type": "pcap-observable",
        "value": "http://ib.adnxs.com/ut/v3/prebid",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "url",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "tcp_stream": 289,
            "frame_number": 17531,
            "display_filter": "frame.number == 17531",
            "timestamp_epoch": "1545161651.039867000"
          },
          {
            "tcp_stream": 623,
            "frame_number": 29960,
            "display_filter": "frame.number == 29960",
            "timestamp_epoch": "1545161680.985823000"
          },
          {
            "tcp_stream": 628,
            "frame_number": 29977,
            "display_filter": "frame.number == 29977",
            "timestamp_epoch": "1545161681.008349000"
          },
          {
            "tcp_stream": 747,
            "frame_number": 33497,
            "display_filter": "frame.number == 33497",
            "timestamp_epoch": "1545161710.995071000"
          },
          {
            "tcp_stream": 748,
            "frame_number": 33518,
            "display_filter": "frame.number == 33518",
            "timestamp_epoch": "1545161711.050533000"
          },
          {
            "tcp_stream": 899,
            "frame_number": 37977,
            "display_filter": "frame.number == 37977",
            "timestamp_epoch": "1545161756.049951000"
          },
          {
            "tcp_stream": 1032,
            "frame_number": 45055,
            "display_filter": "frame.number == 45055",
            "timestamp_epoch": "1545161800.978469000"
          },
          {
            "tcp_stream": 1034,
            "frame_number": 45070,
            "display_filter": "frame.number == 45070",
            "timestamp_epoch": "1545161801.059637000"
          },
          {
            "tcp_stream": 1103,
            "frame_number": 48017,
            "display_filter": "frame.number == 48017",
            "timestamp_epoch": "1545161845.997272000"
          },
          {
            "tcp_stream": 1106,
            "frame_number": 48027,
            "display_filter": "frame.number == 48027",
            "timestamp_epoch": "1545161846.024087000"
          },
          {
            "tcp_stream": 1110,
            "frame_number": 48051,
            "display_filter": "frame.number == 48051",
            "timestamp_epoch": "1545161846.075004000"
          },
          {
            "tcp_stream": 1249,
            "frame_number": 52180,
            "display_filter": "frame.number == 52180",
            "timestamp_epoch": "1545161891.114627000"
          },
          {
            "tcp_stream": 1376,
            "frame_number": 58133,
            "display_filter": "frame.number == 58133",
            "timestamp_epoch": "1545161936.094008000"
          },
          {
            "tcp_stream": 1377,
            "frame_number": 58147,
            "display_filter": "frame.number == 58147",
            "timestamp_epoch": "1545161936.129197000"
          }
        ],
        "provider_signals": [],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:http://ocsp.pki.goog/GTSGIAG3",
        "type": "pcap-observable",
        "value": "http://ocsp.pki.goog/GTSGIAG3",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "url",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "tcp_stream": 1537,
            "frame_number": 64142,
            "display_filter": "frame.number == 64142",
            "timestamp_epoch": "1545162075.306911000"
          },
          {
            "tcp_stream": 1536,
            "frame_number": 64144,
            "display_filter": "frame.number == 64144",
            "timestamp_epoch": "1545162075.310027000"
          },
          {
            "tcp_stream": 1537,
            "frame_number": 68815,
            "display_filter": "frame.number == 68815",
            "timestamp_epoch": "1545162078.181170000"
          },
          {
            "tcp_stream": 1536,
            "frame_number": 71461,
            "display_filter": "frame.number == 71461",
            "timestamp_epoch": "1545162078.463939000"
          },
          {
            "tcp_stream": 1537,
            "frame_number": 71462,
            "display_filter": "frame.number == 71462",
            "timestamp_epoch": "1545162078.464201000"
          },
          {
            "tcp_stream": 1546,
            "frame_number": 71471,
            "display_filter": "frame.number == 71471",
            "timestamp_epoch": "1545162078.547446000"
          },
          {
            "tcp_stream": 1536,
            "frame_number": 72395,
            "display_filter": "frame.number == 72395",
            "timestamp_epoch": "1545162078.868563000"
          },
          {
            "tcp_stream": 1537,
            "frame_number": 72396,
            "display_filter": "frame.number == 72396",
            "timestamp_epoch": "1545162078.868770000"
          },
          {
            "tcp_stream": 1546,
            "frame_number": 73129,
            "display_filter": "frame.number == 73129",
            "timestamp_epoch": "1545162079.114866000"
          }
        ],
        "provider_signals": [],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:http://odb.outbrain.com/utils/get?url=http%3A%2F%2Ftime.com%2F5455078%2Fapple-ipad-pro-2018-review%2F&settings=true&recs=true&widgetJSId=AR_24&key=NANOWDGT01&idx=0&version=01010807&apv=false&sig=47oTMHvb&format=html&rand=23549&winW=1240&winH=671&scrW=1280&scrH=800&adblck=false&ref=",
        "type": "pcap-observable",
        "value": "http://odb.outbrain.com/utils/get?url=http%3A%2F%2Ftime.com%2F5455078%2Fapple-ipad-pro-2018-review%2F&settings=true&recs=true&widgetJSId=AR_24&key=NANOWDGT01&idx=0&version=01010807&apv=false&sig=47oTMHvb&format=html&rand=23549&winW=1240&winH=671&scrW=1280&scrH=800&adblck=false&ref=",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "url",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "tcp_stream": 277,
            "frame_number": 17159,
            "display_filter": "frame.number == 17159",
            "timestamp_epoch": "1545161650.781721000"
          }
        ],
        "provider_signals": [],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:http://odb.outbrain.com/utils/get?url=http%3A%2F%2Ftime.com%2F5455078%2Fapple-ipad-pro-2018-review%2F&settings=true&recs=true&widgetJSId=SB_24&key=NANOWDGT01&idx=1&version=01010807&apv=true&sig=47oTMHvb&format=html&rand=26262&lsd=971a9d56-3b13-4c25-a6fd-1208d64ee011&lsdt=1545161651772&t=MV83ZWE2MDA4MWY2ZjFmMmI4NjdiOTgyYzE4NDBhN2FmZl8w&winW=1240&winH=671&scrW=1280&scrH=800&adblck=false&ref=",
        "type": "pcap-observable",
        "value": "http://odb.outbrain.com/utils/get?url=http%3A%2F%2Ftime.com%2F5455078%2Fapple-ipad-pro-2018-review%2F&settings=true&recs=true&widgetJSId=SB_24&key=NANOWDGT01&idx=1&version=01010807&apv=true&sig=47oTMHvb&format=html&rand=26262&lsd=971a9d56-3b13-4c25-a6fd-1208d64ee011&lsdt=1545161651772&t=MV83ZWE2MDA4MWY2ZjFmMmI4NjdiOTgyYzE4NDBhN2FmZl8w&winW=1240&winH=671&scrW=1280&scrH=800&adblck=false&ref=",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "url",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "tcp_stream": 277,
            "frame_number": 18093,
            "display_filter": "frame.number == 18093",
            "timestamp_epoch": "1545161651.796966000"
          }
        ],
        "provider_signals": [],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:http://odb.outbrain.com/utils/get?url=http%3A%2F%2Ftime.com%2F5455078%2Fapple-ipad-pro-2018-review%2F&settings=true&recs=true&widgetJSId=SB_30&key=NANOWDGT01&idx=2&version=01010807&apv=true&sig=47oTMHvb&format=html&rand=45545&lsd=971a9d56-3b13-4c25-a6fd-1208d64ee011&lsdt=1545161651772&t=MV83ZWE2MDA4MWY2ZjFmMmI4NjdiOTgyYzE4NDBhN2FmZl8w&winW=1240&winH=671&scrW=1280&scrH=800&adblck=false&ref=",
        "type": "pcap-observable",
        "value": "http://odb.outbrain.com/utils/get?url=http%3A%2F%2Ftime.com%2F5455078%2Fapple-ipad-pro-2018-review%2F&settings=true&recs=true&widgetJSId=SB_30&key=NANOWDGT01&idx=2&version=01010807&apv=true&sig=47oTMHvb&format=html&rand=45545&lsd=971a9d56-3b13-4c25-a6fd-1208d64ee011&lsdt=1545161651772&t=MV83ZWE2MDA4MWY2ZjFmMmI4NjdiOTgyYzE4NDBhN2FmZl8w&winW=1240&winH=671&scrW=1280&scrH=800&adblck=false&ref=",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "url",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "tcp_stream": 277,
            "frame_number": 19001,
            "display_filter": "frame.number == 19001",
            "timestamp_epoch": "1545161652.503780000"
          }
        ],
        "provider_signals": [],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:http://revee.outbrain.com/page/update",
        "type": "pcap-observable",
        "value": "http://revee.outbrain.com/page/update",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "url",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "tcp_stream": 439,
            "frame_number": 22820,
            "display_filter": "frame.number == 22820",
            "timestamp_epoch": "1545161655.250838000"
          },
          {
            "tcp_stream": 445,
            "frame_number": 23067,
            "display_filter": "frame.number == 23067",
            "timestamp_epoch": "1545161655.503734000"
          },
          {
            "tcp_stream": 607,
            "frame_number": 29185,
            "display_filter": "frame.number == 29185",
            "timestamp_epoch": "1545161672.227766000"
          },
          {
            "tcp_stream": 698,
            "frame_number": 31738,
            "display_filter": "frame.number == 31738",
            "timestamp_epoch": "1545161688.256224000"
          },
          {
            "tcp_stream": 737,
            "frame_number": 32955,
            "display_filter": "frame.number == 32955",
            "timestamp_epoch": "1545161703.843312000"
          },
          {
            "tcp_stream": 833,
            "frame_number": 35421,
            "display_filter": "frame.number == 35421",
            "timestamp_epoch": "1545161719.692171000"
          },
          {
            "tcp_stream": 836,
            "frame_number": 35543,
            "display_filter": "frame.number == 35543",
            "timestamp_epoch": "1545161719.943317000"
          },
          {
            "tcp_stream": 867,
            "frame_number": 37094,
            "display_filter": "frame.number == 37094",
            "timestamp_epoch": "1545161735.268650000"
          },
          {
            "tcp_stream": 886,
            "frame_number": 37663,
            "display_filter": "frame.number == 37663",
            "timestamp_epoch": "1545161750.608488000"
          },
          {
            "tcp_stream": 957,
            "frame_number": 40878,
            "display_filter": "frame.number == 40878",
            "timestamp_epoch": "1545161766.154100000"
          },
          {
            "tcp_stream": 986,
            "frame_number": 42031,
            "display_filter": "frame.number == 42031",
            "timestamp_epoch": "1545161781.832749000"
          },
          {
            "tcp_stream": 988,
            "frame_number": 42107,
            "display_filter": "frame.number == 42107",
            "timestamp_epoch": "1545161782.083183000"
          },
          {
            "tcp_stream": 1020,
            "frame_number": 44705,
            "display_filter": "frame.number == 44705",
            "timestamp_epoch": "1545161797.540375000"
          },
          {
            "tcp_stream": 1056,
            "frame_number": 45887,
            "display_filter": "frame.number == 45887",
            "timestamp_epoch": "1545161813.133077000"
          },
          {
            "tcp_stream": 1077,
            "frame_number": 46642,
            "display_filter": "frame.number == 46642",
            "timestamp_epoch": "1545161828.759113000"
          },
          {
            "tcp_stream": 1100,
            "frame_number": 47790,
            "display_filter": "frame.number == 47790",
            "timestamp_epoch": "1545161844.459666000"
          },
          {
            "tcp_stream": 1101,
            "frame_number": 47919,
            "display_filter": "frame.number == 47919",
            "timestamp_epoch": "1545161844.710880000"
          },
          {
            "tcp_stream": 1144,
            "frame_number": 49419,
            "display_filter": "frame.number == 49419",
            "timestamp_epoch": "1545161860.107079000"
          },
          {
            "tcp_stream": 1208,
            "frame_number": 51166,
            "display_filter": "frame.number == 51166",
            "timestamp_epoch": "1545161875.909281000"
          },
          {
            "tcp_stream": 1256,
            "frame_number": 52310,
            "display_filter": "frame.number == 52310",
            "timestamp_epoch": "1545161891.323275000"
          }
        ],
        "provider_signals": [],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:http://ssc.33across.com/api/exchange",
        "type": "pcap-observable",
        "value": "http://ssc.33across.com/api/exchange",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "url",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "tcp_stream": 477,
            "frame_number": 23779,
            "display_filter": "frame.number == 23779",
            "timestamp_epoch": "1545161656.197353000"
          },
          {
            "tcp_stream": 481,
            "frame_number": 23783,
            "display_filter": "frame.number == 23783",
            "timestamp_epoch": "1545161656.200530000"
          },
          {
            "tcp_stream": 477,
            "frame_number": 24374,
            "display_filter": "frame.number == 24374",
            "timestamp_epoch": "1545161657.022093000"
          },
          {
            "tcp_stream": 477,
            "frame_number": 30794,
            "display_filter": "frame.number == 30794",
            "timestamp_epoch": "1545161683.478016000"
          },
          {
            "tcp_stream": 477,
            "frame_number": 30897,
            "display_filter": "frame.number == 30897",
            "timestamp_epoch": "1545161683.827756000"
          },
          {
            "tcp_stream": 477,
            "frame_number": 30935,
            "display_filter": "frame.number == 30935",
            "timestamp_epoch": "1545161683.937459000"
          },
          {
            "tcp_stream": 477,
            "frame_number": 33694,
            "display_filter": "frame.number == 33694",
            "timestamp_epoch": "1545161711.641588000"
          },
          {
            "tcp_stream": 477,
            "frame_number": 33732,
            "display_filter": "frame.number == 33732",
            "timestamp_epoch": "1545161711.745015000"
          },
          {
            "tcp_stream": 767,
            "frame_number": 33861,
            "display_filter": "frame.number == 33861",
            "timestamp_epoch": "1545161711.970411000"
          },
          {
            "tcp_stream": 477,
            "frame_number": 38160,
            "display_filter": "frame.number == 38160",
            "timestamp_epoch": "1545161757.034758000"
          },
          {
            "tcp_stream": 767,
            "frame_number": 38191,
            "display_filter": "frame.number == 38191",
            "timestamp_epoch": "1545161757.115676000"
          },
          {
            "tcp_stream": 477,
            "frame_number": 38236,
            "display_filter": "frame.number == 38236",
            "timestamp_epoch": "1545161757.187380000"
          },
          {
            "tcp_stream": 1165,
            "frame_number": 49766,
            "display_filter": "frame.number == 49766",
            "timestamp_epoch": "1545161867.617073000"
          },
          {
            "tcp_stream": 1166,
            "frame_number": 49767,
            "display_filter": "frame.number == 49767",
            "timestamp_epoch": "1545161867.617090000"
          },
          {
            "tcp_stream": 1168,
            "frame_number": 49791,
            "display_filter": "frame.number == 49791",
            "timestamp_epoch": "1545161867.640063000"
          },
          {
            "tcp_stream": 1166,
            "frame_number": 52495,
            "display_filter": "frame.number == 52495",
            "timestamp_epoch": "1545161891.786254000"
          },
          {
            "tcp_stream": 1166,
            "frame_number": 52540,
            "display_filter": "frame.number == 52540",
            "timestamp_epoch": "1545161891.879543000"
          },
          {
            "tcp_stream": 1165,
            "frame_number": 52566,
            "display_filter": "frame.number == 52566",
            "timestamp_epoch": "1545161891.933017000"
          },
          {
            "tcp_stream": 1166,
            "frame_number": 58602,
            "display_filter": "frame.number == 58602",
            "timestamp_epoch": "1545161939.912995000"
          },
          {
            "tcp_stream": 1165,
            "frame_number": 58625,
            "display_filter": "frame.number == 58625",
            "timestamp_epoch": "1545161939.980214000"
          }
        ],
        "provider_signals": [],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:http://us-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=eab9ff18-1f65-4a26-8531-cb990181cabb&gdpr=0",
        "type": "pcap-observable",
        "value": "http://us-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=eab9ff18-1f65-4a26-8531-cb990181cabb&gdpr=0",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "url",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "tcp_stream": 360,
            "frame_number": 19954,
            "display_filter": "frame.number == 19954",
            "timestamp_epoch": "1545161653.247268000"
          },
          {
            "tcp_stream": 606,
            "frame_number": 29010,
            "display_filter": "frame.number == 29010",
            "timestamp_epoch": "1545161669.818452000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 31416,
            "display_filter": "frame.number == 31416",
            "timestamp_epoch": "1545161685.979507000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 32363,
            "display_filter": "frame.number == 32363",
            "timestamp_epoch": "1545161701.392028000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 34679,
            "display_filter": "frame.number == 34679",
            "timestamp_epoch": "1545161717.464654000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 36827,
            "display_filter": "frame.number == 36827",
            "timestamp_epoch": "1545161732.871067000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 37360,
            "display_filter": "frame.number == 37360",
            "timestamp_epoch": "1545161748.256206000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 40441,
            "display_filter": "frame.number == 40441",
            "timestamp_epoch": "1545161763.822678000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 41841,
            "display_filter": "frame.number == 41841",
            "timestamp_epoch": "1545161779.460146000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 44594,
            "display_filter": "frame.number == 44594",
            "timestamp_epoch": "1545161795.025351000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 45581,
            "display_filter": "frame.number == 45581",
            "timestamp_epoch": "1545161810.665765000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 46354,
            "display_filter": "frame.number == 46354",
            "timestamp_epoch": "1545161826.163649000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 47600,
            "display_filter": "frame.number == 47600",
            "timestamp_epoch": "1545161841.802536000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 49059,
            "display_filter": "frame.number == 49059",
            "timestamp_epoch": "1545161857.633435000"
          },
          {
            "tcp_stream": 1203,
            "frame_number": 50922,
            "display_filter": "frame.number == 50922",
            "timestamp_epoch": "1545161873.364748000"
          },
          {
            "tcp_stream": 1203,
            "frame_number": 51861,
            "display_filter": "frame.number == 51861",
            "timestamp_epoch": "1545161889.034578000"
          },
          {
            "tcp_stream": 1203,
            "frame_number": 53940,
            "display_filter": "frame.number == 53940",
            "timestamp_epoch": "1545161904.460023000"
          },
          {
            "tcp_stream": 1203,
            "frame_number": 57098,
            "display_filter": "frame.number == 57098",
            "timestamp_epoch": "1545161920.313850000"
          },
          {
            "tcp_stream": 1203,
            "frame_number": 58106,
            "display_filter": "frame.number == 58106",
            "timestamp_epoch": "1545161936.000812000"
          },
          {
            "tcp_stream": 1471,
            "frame_number": 61766,
            "display_filter": "frame.number == 61766",
            "timestamp_epoch": "1545161952.383636000"
          }
        ],
        "provider_signals": [],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "ioc:http://us-u.openx.net/w/1.0/pd?plm=6&ph=eab9ff18-1f65-4a26-8531-cb990181cabb&gdpr=0",
        "type": "pcap-observable",
        "value": "http://us-u.openx.net/w/1.0/pd?plm=6&ph=eab9ff18-1f65-4a26-8531-cb990181cabb&gdpr=0",
        "source": "log-pcap-analysis",
        "status": "candidate-requires-review",
        "ioc_type": "url",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "description": "suspicious; analyst review required",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "log-pcap-analysis"
        ],
        "ioc_candidate": true,
        "frame_evidence": [
          {
            "tcp_stream": 360,
            "frame_number": 19869,
            "display_filter": "frame.number == 19869",
            "timestamp_epoch": "1545161653.119204000"
          },
          {
            "tcp_stream": 606,
            "frame_number": 28988,
            "display_filter": "frame.number == 28988",
            "timestamp_epoch": "1545161669.724029000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 31384,
            "display_filter": "frame.number == 31384",
            "timestamp_epoch": "1545161685.882090000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 32346,
            "display_filter": "frame.number == 32346",
            "timestamp_epoch": "1545161701.271269000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 34650,
            "display_filter": "frame.number == 34650",
            "timestamp_epoch": "1545161717.378641000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 36804,
            "display_filter": "frame.number == 36804",
            "timestamp_epoch": "1545161732.779338000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 37342,
            "display_filter": "frame.number == 37342",
            "timestamp_epoch": "1545161748.165838000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 40424,
            "display_filter": "frame.number == 40424",
            "timestamp_epoch": "1545161763.740802000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 41818,
            "display_filter": "frame.number == 41818",
            "timestamp_epoch": "1545161779.359753000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 44570,
            "display_filter": "frame.number == 44570",
            "timestamp_epoch": "1545161794.938449000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 45553,
            "display_filter": "frame.number == 45553",
            "timestamp_epoch": "1545161810.575225000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 46328,
            "display_filter": "frame.number == 46328",
            "timestamp_epoch": "1545161826.070563000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 47577,
            "display_filter": "frame.number == 47577",
            "timestamp_epoch": "1545161841.710764000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 49020,
            "display_filter": "frame.number == 49020",
            "timestamp_epoch": "1545161857.539056000"
          },
          {
            "tcp_stream": 1203,
            "frame_number": 50895,
            "display_filter": "frame.number == 50895",
            "timestamp_epoch": "1545161873.273661000"
          },
          {
            "tcp_stream": 1203,
            "frame_number": 51854,
            "display_filter": "frame.number == 51854",
            "timestamp_epoch": "1545161888.946487000"
          },
          {
            "tcp_stream": 1203,
            "frame_number": 53904,
            "display_filter": "frame.number == 53904",
            "timestamp_epoch": "1545161904.366325000"
          },
          {
            "tcp_stream": 1203,
            "frame_number": 57074,
            "display_filter": "frame.number == 57074",
            "timestamp_epoch": "1545161920.224230000"
          },
          {
            "tcp_stream": 1203,
            "frame_number": 58063,
            "display_filter": "frame.number == 58063",
            "timestamp_epoch": "1545161935.893050000"
          },
          {
            "tcp_stream": 1471,
            "frame_number": 61762,
            "display_filter": "frame.number == 61762",
            "timestamp_epoch": "1545161952.290028000"
          }
        ],
        "provider_signals": [],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "id": "finding-7847750ebbbb66c6b2d5be72",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/ik/_jsk4VW0yezd2-o3XTZQQHmFzfE9GaxLIfQek6emXnSfe7jffFHN4UJLFRbh52jhWD9hZeIuFDjuwRJX5248jh9ajcbUwcJ35g7ZMPG0ShmydKuljhFCdaFnZWqlZ1q3SPoDSWmyScmDSeBRZPoRdhXCdeNRjAUGdaFXOYF8jAtldAFRdeND-hmoOAZowYI0SaBujW48Sagyjh90jhNlOYFcdeuuSh8ROcFzdPUaiaS0ShmydKuljhFCdaFnZWqlZ1q3SPoDSWmyScmDSeBRZPoRdhXCiaiaO1FcdeuuSh8ROcFzdPJYjhBCdYm0jPJsZe80OAFzdcs8d1F8ZfuaZAJ7fbKbwgMMeMw6MKG4fwXVIMMjgfMfH6qJD3vbMg6YJMJ7fbR52UMMeMt6MKG4fFMVIMMjIPMfH6qJrubbMs6IJMHbM-RuDNXB.js",
          "source": "104.76.109.16",
          "destination": "172.16.3.111",
          "content_type": "text/javascript;charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 7525
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 6,
            "frame_number": 139,
            "display_filter": "frame.number == 139",
            "timestamp_epoch": "1545161514.482277000"
          },
          {
            "tcp_stream": 6,
            "frame_number": 182,
            "display_filter": "frame.number == 182",
            "timestamp_epoch": "1545161514.569263000"
          }
        ]
      },
      {
        "id": "finding-9557299bc5fc5d564e4b292d",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/universal/scripts-compressed/common-1e0479f03b5e7878ccce-min.en-US.js",
          "source": "151.101.0.238",
          "destination": "172.16.3.111",
          "content_type": "text/javascript",
          "response_count": 1,
          "declared_body_bytes": 418714
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 10,
            "frame_number": 172,
            "display_filter": "frame.number == 172",
            "timestamp_epoch": "1545161514.567765000"
          },
          {
            "tcp_stream": 10,
            "frame_number": 1441,
            "display_filter": "frame.number == 1441",
            "timestamp_epoch": "1545161515.158484000"
          }
        ]
      },
      {
        "id": "finding-11974c145fadd86af9e0f5c6",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/universal/scripts-compressed/commerce-b7bbc14ab020dc9dda48-min.en-US.js",
          "source": "151.101.0.238",
          "destination": "172.16.3.111",
          "content_type": "text/javascript",
          "response_count": 1,
          "declared_body_bytes": 339985
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 11,
            "frame_number": 203,
            "display_filter": "frame.number == 203",
            "timestamp_epoch": "1545161514.571560000"
          },
          {
            "tcp_stream": 11,
            "frame_number": 1271,
            "display_filter": "frame.number == 1271",
            "timestamp_epoch": "1545161514.970668000"
          }
        ]
      },
      {
        "id": "finding-0131278d2ccad3790efef02a",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/universal/scripts-compressed/performance-43f02bfb97a117c79e66-min.en-US.js",
          "source": "151.101.0.238",
          "destination": "172.16.3.111",
          "content_type": "text/javascript",
          "response_count": 1,
          "declared_body_bytes": 10627
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 13,
            "frame_number": 220,
            "display_filter": "frame.number == 220",
            "timestamp_epoch": "1545161514.577497000"
          },
          {
            "tcp_stream": 13,
            "frame_number": 368,
            "display_filter": "frame.number == 368",
            "timestamp_epoch": "1545161514.645659000"
          }
        ]
      },
      {
        "id": "finding-bed2c089ef73c16503a8b402",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/piwik.js",
          "source": "35.153.36.84",
          "destination": "172.16.3.111",
          "content_type": "application/x-javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 21,
            "frame_number": 1565,
            "display_filter": "frame.number == 1565",
            "timestamp_epoch": "1545161518.454954000"
          },
          {
            "tcp_stream": 21,
            "frame_number": 1706,
            "display_filter": "frame.number == 1706",
            "timestamp_epoch": "1545161518.606362000"
          }
        ]
      },
      {
        "id": "finding-c475fa679df65c7869ea8bcb",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/universal/scripts-compressed/popup-overlay-9eee10f7431522ac8108-min.en-US.js",
          "source": "151.101.0.238",
          "destination": "172.16.3.111",
          "content_type": "text/javascript",
          "response_count": 1,
          "declared_body_bytes": 404442
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 25,
            "frame_number": 1844,
            "display_filter": "frame.number == 1844",
            "timestamp_epoch": "1545161519.511645000"
          },
          {
            "tcp_stream": 25,
            "frame_number": 2421,
            "display_filter": "frame.number == 2421",
            "timestamp_epoch": "1545161519.919059000"
          }
        ]
      },
      {
        "id": "finding-ee2012bda20dee4f976baa38",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/button/st_insights.js?publisher=eba0f3ba-f9ab-408c-bc68-c28af5afe749&product=feather",
          "source": "38.69.238.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 6340
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 126,
            "frame_number": 3625,
            "display_filter": "frame.number == 3625",
            "timestamp_epoch": "1545161627.536583000"
          },
          {
            "tcp_stream": 126,
            "frame_number": 3757,
            "display_filter": "frame.number == 3757",
            "timestamp_epoch": "1545161627.605554000"
          }
        ]
      },
      {
        "id": "finding-1c92a92244d68a6018ca3f94",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-includes/js/wp-emoji-release.min.js?ver=4.7.12",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 4230
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 109,
            "frame_number": 3721,
            "display_filter": "frame.number == 3721",
            "timestamp_epoch": "1545161627.591990000"
          },
          {
            "tcp_stream": 109,
            "frame_number": 3855,
            "display_filter": "frame.number == 3855",
            "timestamp_epoch": "1545161627.677711000"
          }
        ]
      },
      {
        "id": "finding-3d6d0a878ade118f15ed10f3",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-includes/js/jquery/jquery.js?ver=1.12.4",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 33766
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 109,
            "frame_number": 3877,
            "display_filter": "frame.number == 3877",
            "timestamp_epoch": "1545161627.680829000"
          },
          {
            "tcp_stream": 109,
            "frame_number": 4182,
            "display_filter": "frame.number == 4182",
            "timestamp_epoch": "1545161627.881867000"
          }
        ]
      },
      {
        "id": "finding-1157f436ca750568b1670f17",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 4014
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 111,
            "frame_number": 3912,
            "display_filter": "frame.number == 3912",
            "timestamp_epoch": "1545161627.691394000"
          },
          {
            "tcp_stream": 111,
            "frame_number": 3959,
            "display_filter": "frame.number == 3959",
            "timestamp_epoch": "1545161627.773166000"
          }
        ]
      },
      {
        "id": "finding-cf4995db15d23699fc9ace28",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-includes/js/jquery/ui/core.min.js?ver=1.11.4",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 1821
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 108,
            "frame_number": 3917,
            "display_filter": "frame.number == 3917",
            "timestamp_epoch": "1545161627.692692000"
          },
          {
            "tcp_stream": 108,
            "frame_number": 3954,
            "display_filter": "frame.number == 3954",
            "timestamp_epoch": "1545161627.772136000"
          }
        ]
      },
      {
        "id": "finding-410f7f800ddb9c137ac31575",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-includes/js/jquery/ui/widget.min.js?ver=1.11.4",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 2599
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 98,
            "frame_number": 3920,
            "display_filter": "frame.number == 3920",
            "timestamp_epoch": "1545161627.692911000"
          },
          {
            "tcp_stream": 98,
            "frame_number": 3966,
            "display_filter": "frame.number == 3966",
            "timestamp_epoch": "1545161627.774126000"
          }
        ]
      },
      {
        "id": "finding-96a24c69107819d6fc759e20",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-includes/js/jquery/ui/position.min.js?ver=1.11.4",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 2562
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 110,
            "frame_number": 3925,
            "display_filter": "frame.number == 3925",
            "timestamp_epoch": "1545161627.695046000"
          },
          {
            "tcp_stream": 110,
            "frame_number": 3972,
            "display_filter": "frame.number == 3972",
            "timestamp_epoch": "1545161627.776012000"
          }
        ]
      },
      {
        "id": "finding-23a1b829f53bee79dccedfcf",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-includes/js/jquery/ui/mouse.min.js?ver=1.11.4",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 1021
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 108,
            "frame_number": 3963,
            "display_filter": "frame.number == 3963",
            "timestamp_epoch": "1545161627.774002000"
          },
          {
            "tcp_stream": 108,
            "frame_number": 4135,
            "display_filter": "frame.number == 4135",
            "timestamp_epoch": "1545161627.855916000"
          }
        ]
      },
      {
        "id": "finding-385b7605d6295b835ff95e60",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-includes/js/jquery/ui/sortable.min.js?ver=1.11.4",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 6550
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 111,
            "frame_number": 3969,
            "display_filter": "frame.number == 3969",
            "timestamp_epoch": "1545161627.774629000"
          },
          {
            "tcp_stream": 111,
            "frame_number": 4145,
            "display_filter": "frame.number == 4145",
            "timestamp_epoch": "1545161627.858590000"
          }
        ]
      },
      {
        "id": "finding-dadac480b3f601bdce586f6c",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-includes/js/jquery/ui/datepicker.min.js?ver=1.11.4",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 11002
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 98,
            "frame_number": 3984,
            "display_filter": "frame.number == 3984",
            "timestamp_epoch": "1545161627.780975000"
          },
          {
            "tcp_stream": 98,
            "frame_number": 4165,
            "display_filter": "frame.number == 4165",
            "timestamp_epoch": "1545161627.879939000"
          }
        ]
      },
      {
        "id": "finding-b31b8438945718dcbbbed9f7",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-includes/js/jquery/ui/menu.min.js?ver=1.11.4",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 2844
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 110,
            "frame_number": 3994,
            "display_filter": "frame.number == 3994",
            "timestamp_epoch": "1545161627.781786000"
          },
          {
            "tcp_stream": 110,
            "frame_number": 4154,
            "display_filter": "frame.number == 4154",
            "timestamp_epoch": "1545161627.876162000"
          }
        ]
      },
      {
        "id": "finding-86cc5de894edf1799ed4146c",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-includes/js/wp-a11y.min.js?ver=4.7.12",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 355
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 108,
            "frame_number": 4138,
            "display_filter": "frame.number == 4138",
            "timestamp_epoch": "1545161627.857162000"
          },
          {
            "tcp_stream": 108,
            "frame_number": 4336,
            "display_filter": "frame.number == 4336",
            "timestamp_epoch": "1545161627.936529000"
          }
        ]
      },
      {
        "id": "finding-6c8ec36ae810261ebf37d8e5",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-includes/js/jquery/ui/autocomplete.min.js?ver=1.11.4",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 2868
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 111,
            "frame_number": 4151,
            "display_filter": "frame.number == 4151",
            "timestamp_epoch": "1545161627.860037000"
          },
          {
            "tcp_stream": 111,
            "frame_number": 4341,
            "display_filter": "frame.number == 4341",
            "timestamp_epoch": "1545161627.946252000"
          }
        ]
      },
      {
        "id": "finding-70423c97528060c37e35623c",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-includes/js/jquery/ui/resizable.min.js?ver=1.11.4",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 5267
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 110,
            "frame_number": 4185,
            "display_filter": "frame.number == 4185",
            "timestamp_epoch": "1545161627.882280000"
          },
          {
            "tcp_stream": 110,
            "frame_number": 4352,
            "display_filter": "frame.number == 4352",
            "timestamp_epoch": "1545161627.968275000"
          }
        ]
      },
      {
        "id": "finding-ca6a036fef767b8b77449827",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-includes/js/jquery/ui/draggable.min.js?ver=1.11.4",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 5010
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 98,
            "frame_number": 4199,
            "display_filter": "frame.number == 4199",
            "timestamp_epoch": "1545161627.885168000"
          },
          {
            "tcp_stream": 98,
            "frame_number": 4366,
            "display_filter": "frame.number == 4366",
            "timestamp_epoch": "1545161627.973293000"
          }
        ]
      },
      {
        "id": "finding-586f4c6d2522ed8e723d72c1",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-includes/js/jquery/ui/button.min.js?ver=1.11.4",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 2082
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 109,
            "frame_number": 4214,
            "display_filter": "frame.number == 4214",
            "timestamp_epoch": "1545161627.886554000"
          },
          {
            "tcp_stream": 109,
            "frame_number": 4369,
            "display_filter": "frame.number == 4369",
            "timestamp_epoch": "1545161627.973698000"
          }
        ]
      },
      {
        "id": "finding-ba9dd33710156e0e71ea6cdf",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-includes/js/jquery/ui/dialog.min.js?ver=1.11.4",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 3694
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 108,
            "frame_number": 4338,
            "display_filter": "frame.number == 4338",
            "timestamp_epoch": "1545161627.937300000"
          },
          {
            "tcp_stream": 108,
            "frame_number": 4459,
            "display_filter": "frame.number == 4459",
            "timestamp_epoch": "1545161628.018876000"
          }
        ]
      },
      {
        "id": "finding-e4d8ab6ba20a7bbbc4a5edce",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-content/plugins/events-manager/includes/js/events-manager.js?ver=5.7",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 12439
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 111,
            "frame_number": 4345,
            "display_filter": "frame.number == 4345",
            "timestamp_epoch": "1545161627.947479000"
          },
          {
            "tcp_stream": 111,
            "frame_number": 4485,
            "display_filter": "frame.number == 4485",
            "timestamp_epoch": "1545161628.036523000"
          }
        ]
      },
      {
        "id": "finding-f18dccfa6ba5faaff94a0503",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-content/plugins/library-bookshelves/slick/slick.min.js?ver=2.5",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 10442
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 110,
            "frame_number": 4356,
            "display_filter": "frame.number == 4356",
            "timestamp_epoch": "1545161627.970495000"
          },
          {
            "tcp_stream": 110,
            "frame_number": 4517,
            "display_filter": "frame.number == 4517",
            "timestamp_epoch": "1545161628.067025000"
          }
        ]
      },
      {
        "id": "finding-7ac39ed4520a3ddf432bfa9b",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-content/plugins/wordpress-notification-bar/inc/js/seed_wnb.js?ver=4.7.12",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 307
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 98,
            "frame_number": 4375,
            "display_filter": "frame.number == 4375",
            "timestamp_epoch": "1545161627.975543000"
          },
          {
            "tcp_stream": 98,
            "frame_number": 4502,
            "display_filter": "frame.number == 4502",
            "timestamp_epoch": "1545161628.062198000"
          }
        ]
      },
      {
        "id": "finding-5de8bc5cf11b1f079a54f623",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-includes/js/wpdialog.min.js?ver=4.7.12",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 183
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 109,
            "frame_number": 4377,
            "display_filter": "frame.number == 4377",
            "timestamp_epoch": "1545161627.975768000"
          },
          {
            "tcp_stream": 109,
            "frame_number": 4505,
            "display_filter": "frame.number == 4505",
            "timestamp_epoch": "1545161628.063409000"
          }
        ]
      },
      {
        "id": "finding-3702b39f8585ea41695846c6",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-content/plugins/connect-daily-web-calendar/cdaily-plugin.js?ver=1.3.6",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 6701
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 108,
            "frame_number": 4466,
            "display_filter": "frame.number == 4466",
            "timestamp_epoch": "1545161628.020215000"
          },
          {
            "tcp_stream": 108,
            "frame_number": 4587,
            "display_filter": "frame.number == 4587",
            "timestamp_epoch": "1545161628.108557000"
          }
        ]
      },
      {
        "id": "finding-8bdc464394859607d1251436",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-content/themes/spacious/js/spacious-custom.js?ver=4.7.12",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 221
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 111,
            "frame_number": 4494,
            "display_filter": "frame.number == 4494",
            "timestamp_epoch": "1545161628.039579000"
          },
          {
            "tcp_stream": 111,
            "frame_number": 4605,
            "display_filter": "frame.number == 4605",
            "timestamp_epoch": "1545161628.125627000"
          }
        ]
      },
      {
        "id": "finding-75d100c4698e8e38cb2646aa",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=4.9",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 3889
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 98,
            "frame_number": 4504,
            "display_filter": "frame.number == 4504",
            "timestamp_epoch": "1545161628.063172000"
          },
          {
            "tcp_stream": 98,
            "frame_number": 4624,
            "display_filter": "frame.number == 4624",
            "timestamp_epoch": "1545161628.152867000"
          }
        ]
      },
      {
        "id": "finding-b64454fb727294fd5ee4cd0a",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-content/themes/spacious/js/jquery.cycle.all.min.js?ver=2.9999.5",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 7758
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 109,
            "frame_number": 4507,
            "display_filter": "frame.number == 4507",
            "timestamp_epoch": "1545161628.064173000"
          },
          {
            "tcp_stream": 109,
            "frame_number": 4638,
            "display_filter": "frame.number == 4638",
            "timestamp_epoch": "1545161628.155944000"
          }
        ]
      },
      {
        "id": "finding-b0c2da62089a3857ef5306ab",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-content/themes/spacious/js/spacious-slider-setting.js?ver=4.7.12",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 337
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 110,
            "frame_number": 4537,
            "display_filter": "frame.number == 4537",
            "timestamp_epoch": "1545161628.068840000"
          },
          {
            "tcp_stream": 110,
            "frame_number": 4626,
            "display_filter": "frame.number == 4626",
            "timestamp_epoch": "1545161628.153021000"
          }
        ]
      },
      {
        "id": "finding-2221d1fb227c2d015912578b",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-content/themes/spacious/js/navigation.js?ver=4.7.12",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 408
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 108,
            "frame_number": 4592,
            "display_filter": "frame.number == 4592",
            "timestamp_epoch": "1545161628.110503000"
          },
          {
            "tcp_stream": 108,
            "frame_number": 4659,
            "display_filter": "frame.number == 4659",
            "timestamp_epoch": "1545161628.195612000"
          }
        ]
      },
      {
        "id": "finding-8e7b68406c88956c7af548aa",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/wp-includes/js/wp-embed.min.js?ver=4.7.12",
          "source": "64.57.241.17",
          "destination": "172.16.3.189",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 751
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 111,
            "frame_number": 4607,
            "display_filter": "frame.number == 4607",
            "timestamp_epoch": "1545161628.127160000"
          },
          {
            "tcp_stream": 111,
            "frame_number": 4666,
            "display_filter": "frame.number == 4666",
            "timestamp_epoch": "1545161628.201606000"
          }
        ]
      },
      {
        "id": "finding-4e9e1966f27098d7d0191d1a",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/dist/main.js",
          "source": "99.84.216.18",
          "destination": "172.16.3.122",
          "content_type": "application/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 200,
            "frame_number": 13089,
            "display_filter": "frame.number == 13089",
            "timestamp_epoch": "1545161648.464661000"
          },
          {
            "tcp_stream": 200,
            "frame_number": 13529,
            "display_filter": "frame.number == 13529",
            "timestamp_epoch": "1545161648.688747000"
          }
        ]
      },
      {
        "id": "finding-e0811635e0aa3fece676f2bb",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/assets/sfp.js",
          "source": "52.85.89.190",
          "destination": "172.16.3.122",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 202,
            "frame_number": 13190,
            "display_filter": "frame.number == 13190",
            "timestamp_epoch": "1545161648.534368000"
          },
          {
            "tcp_stream": 202,
            "frame_number": 13711,
            "display_filter": "frame.number == 13711",
            "timestamp_epoch": "1545161648.751216000"
          }
        ]
      },
      {
        "id": "finding-38cc96604edd8619bceae1e3",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/ajax/libs/webfont/1.6.26/webfont.js",
          "source": "172.217.0.234",
          "destination": "172.16.3.122",
          "content_type": "text/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 5437
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 203,
            "frame_number": 13289,
            "display_filter": "frame.number == 13289",
            "timestamp_epoch": "1545161648.569866000"
          },
          {
            "tcp_stream": 203,
            "frame_number": 13489,
            "display_filter": "frame.number == 13489",
            "timestamp_epoch": "1545161648.664434000"
          }
        ]
      },
      {
        "id": "finding-79ff8dab239421e51c823fdf",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/analytics.js/v1/Tjrt25JUOrbvQQX1cGykGGzC3GncV6F9/analytics.min.js",
          "source": "54.192.19.180",
          "destination": "172.16.3.122",
          "content_type": "text/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 63221
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 207,
            "frame_number": 13416,
            "display_filter": "frame.number == 13416",
            "timestamp_epoch": "1545161648.643806000"
          },
          {
            "tcp_stream": 207,
            "frame_number": 13805,
            "display_filter": "frame.number == 13805",
            "timestamp_epoch": "1545161648.808224000"
          }
        ]
      },
      {
        "id": "finding-c7a1a8610f14a4b939362b17",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/dist/28.34809e510b16b0fa3381.js",
          "source": "99.84.216.18",
          "destination": "172.16.3.122",
          "content_type": "application/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 199,
            "frame_number": 14067,
            "display_filter": "frame.number == 14067",
            "timestamp_epoch": "1545161649.073961000"
          },
          {
            "tcp_stream": 199,
            "frame_number": 14104,
            "display_filter": "frame.number == 14104",
            "timestamp_epoch": "1545161649.142181000"
          }
        ]
      },
      {
        "id": "finding-4a25d477ba2a8d73ae6eed16",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/dist/5.91b6b140220dd6c79bd9.js",
          "source": "99.84.216.18",
          "destination": "172.16.3.122",
          "content_type": "application/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 200,
            "frame_number": 14068,
            "display_filter": "frame.number == 14068",
            "timestamp_epoch": "1545161649.074670000"
          },
          {
            "tcp_stream": 200,
            "frame_number": 14097,
            "display_filter": "frame.number == 14097",
            "timestamp_epoch": "1545161649.139580000"
          }
        ]
      },
      {
        "id": "finding-c4569be4b15e90b66ac04b77",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/dist/9.04d8e557a5e53cde5398.js",
          "source": "99.84.216.18",
          "destination": "172.16.3.122",
          "content_type": "application/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 201,
            "frame_number": 14069,
            "display_filter": "frame.number == 14069",
            "timestamp_epoch": "1545161649.075494000"
          },
          {
            "tcp_stream": 201,
            "frame_number": 14116,
            "display_filter": "frame.number == 14116",
            "timestamp_epoch": "1545161649.146041000"
          }
        ]
      },
      {
        "id": "finding-d4cf2ac33f1d5c4b8eccb2f3",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/dist/17.400ac20a4415c3b13bbd.js",
          "source": "99.84.216.18",
          "destination": "172.16.3.122",
          "content_type": "application/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 200,
            "frame_number": 14107,
            "display_filter": "frame.number == 14107",
            "timestamp_epoch": "1545161649.142897000"
          },
          {
            "tcp_stream": 200,
            "frame_number": 14250,
            "display_filter": "frame.number == 14250",
            "timestamp_epoch": "1545161649.230048000"
          }
        ]
      },
      {
        "id": "finding-0d281588182c588e4739e98d",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/dist/14.e3387e4d38ae58482a1a.js",
          "source": "99.84.216.18",
          "destination": "172.16.3.122",
          "content_type": "application/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 199,
            "frame_number": 14112,
            "display_filter": "frame.number == 14112",
            "timestamp_epoch": "1545161649.144731000"
          },
          {
            "tcp_stream": 199,
            "frame_number": 14293,
            "display_filter": "frame.number == 14293",
            "timestamp_epoch": "1545161649.237012000"
          }
        ]
      },
      {
        "id": "finding-c6ade164bae4aba1558087b3",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/dist/6.10be24025be0ba6dc4fb.js",
          "source": "99.84.216.18",
          "destination": "172.16.3.122",
          "content_type": "application/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 201,
            "frame_number": 14121,
            "display_filter": "frame.number == 14121",
            "timestamp_epoch": "1545161649.148561000"
          },
          {
            "tcp_stream": 201,
            "frame_number": 14197,
            "display_filter": "frame.number == 14197",
            "timestamp_epoch": "1545161649.216898000"
          }
        ]
      },
      {
        "id": "finding-aa649dc44cdf42eec6366fd7",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/dist/2.458c87568dc15a0d897e.js",
          "source": "99.84.216.18",
          "destination": "172.16.3.122",
          "content_type": "application/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 215,
            "frame_number": 14131,
            "display_filter": "frame.number == 14131",
            "timestamp_epoch": "1545161649.156679000"
          },
          {
            "tcp_stream": 215,
            "frame_number": 14245,
            "display_filter": "frame.number == 14245",
            "timestamp_epoch": "1545161649.229494000"
          }
        ]
      },
      {
        "id": "finding-dd855fc5eff290992609ca89",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/dist/18.e92a96c5e90778a35391.js",
          "source": "99.84.216.18",
          "destination": "172.16.3.122",
          "content_type": "application/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 217,
            "frame_number": 14132,
            "display_filter": "frame.number == 14132",
            "timestamp_epoch": "1545161649.157042000"
          },
          {
            "tcp_stream": 217,
            "frame_number": 14450,
            "display_filter": "frame.number == 14450",
            "timestamp_epoch": "1545161649.310498000"
          }
        ]
      },
      {
        "id": "finding-a58dbc644098d4299a656650",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/dist/0.cab7d25eb54a453c8dd7.js",
          "source": "99.84.216.18",
          "destination": "172.16.3.122",
          "content_type": "application/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 216,
            "frame_number": 14133,
            "display_filter": "frame.number == 14133",
            "timestamp_epoch": "1545161649.157048000"
          },
          {
            "tcp_stream": 216,
            "frame_number": 14249,
            "display_filter": "frame.number == 14249",
            "timestamp_epoch": "1545161649.229945000"
          }
        ]
      },
      {
        "id": "finding-4e2a8c7c04eb9af797d51cfb",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/Layer/InImage/Prod/cbola_platform/version_2.22.3.4/js/Carambola_layer_136.min.js",
          "source": "192.229.173.42",
          "destination": "172.16.3.122",
          "content_type": "text/javascript",
          "response_count": 1,
          "declared_body_bytes": 113876
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 220,
            "frame_number": 14181,
            "display_filter": "frame.number == 14181",
            "timestamp_epoch": "1545161649.210505000"
          },
          {
            "tcp_stream": 220,
            "frame_number": 14567,
            "display_filter": "frame.number == 14567",
            "timestamp_epoch": "1545161649.341793000"
          }
        ]
      },
      {
        "id": "finding-1a5fc92c02b3b0ca47cf4038",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/dist/8.72157e3b612f2af9b6a1.js",
          "source": "99.84.216.18",
          "destination": "172.16.3.122",
          "content_type": "application/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 201,
            "frame_number": 14215,
            "display_filter": "frame.number == 14215",
            "timestamp_epoch": "1545161649.220166000"
          },
          {
            "tcp_stream": 201,
            "frame_number": 14390,
            "display_filter": "frame.number == 14390",
            "timestamp_epoch": "1545161649.291216000"
          }
        ]
      },
      {
        "id": "finding-45e03c5ac4d3d3fb7eb4308e",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/dist/10.ac54590d17f11463bc1b.js",
          "source": "99.84.216.18",
          "destination": "172.16.3.122",
          "content_type": "application/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 215,
            "frame_number": 14270,
            "display_filter": "frame.number == 14270",
            "timestamp_epoch": "1545161649.232580000"
          },
          {
            "tcp_stream": 215,
            "frame_number": 14944,
            "display_filter": "frame.number == 14944",
            "timestamp_epoch": "1545161649.517119000"
          }
        ]
      },
      {
        "id": "finding-2fa78a7855a66ab58899e75c",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/dist/1.afc5e04a1c75ac0896b1.js",
          "source": "99.84.216.18",
          "destination": "172.16.3.122",
          "content_type": "application/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 216,
            "frame_number": 14286,
            "display_filter": "frame.number == 14286",
            "timestamp_epoch": "1545161649.234836000"
          },
          {
            "tcp_stream": 216,
            "frame_number": 14432,
            "display_filter": "frame.number == 14432",
            "timestamp_epoch": "1545161649.306770000"
          }
        ]
      },
      {
        "id": "finding-af8b0cb64e9546bfb4c88dcb",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/gtm.js?id=GTM-K8GZZJG&l=dataLayer",
          "source": "172.217.1.8",
          "destination": "172.16.3.122",
          "content_type": "application/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 103844
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 222,
            "frame_number": 14397,
            "display_filter": "frame.number == 14397",
            "timestamp_epoch": "1545161649.295332000"
          },
          {
            "tcp_stream": 222,
            "frame_number": 15395,
            "display_filter": "frame.number == 15395",
            "timestamp_epoch": "1545161649.669917000"
          }
        ]
      },
      {
        "id": "finding-234f942b226e5651269c920f",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/p.js",
          "source": "52.85.146.12",
          "destination": "172.16.3.122",
          "content_type": "application/x-javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 223,
            "frame_number": 14398,
            "display_filter": "frame.number == 14398",
            "timestamp_epoch": "1545161649.295332000"
          },
          {
            "tcp_stream": 223,
            "frame_number": 14612,
            "display_filter": "frame.number == 14612",
            "timestamp_epoch": "1545161649.374919000"
          }
        ]
      },
      {
        "id": "finding-6ab6b7348dbc2cd61f94384f",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/outbrain.js",
          "source": "23.194.182.69",
          "destination": "172.16.3.122",
          "content_type": "application/x-javascript",
          "response_count": 1,
          "declared_body_bytes": 39138
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 239,
            "frame_number": 15180,
            "display_filter": "frame.number == 15180",
            "timestamp_epoch": "1545161649.602968000"
          },
          {
            "tcp_stream": 239,
            "frame_number": 15514,
            "display_filter": "frame.number == 15514",
            "timestamp_epoch": "1545161649.734472000"
          }
        ]
      },
      {
        "id": "finding-80ea0293a0e22cdb97c2a4fc",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/1709/i.js",
          "source": "35.190.92.63",
          "destination": "172.16.3.122",
          "content_type": "text/plain; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 15484
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 249,
            "frame_number": 15725,
            "display_filter": "frame.number == 15725",
            "timestamp_epoch": "1545161650.045596000"
          },
          {
            "tcp_stream": 249,
            "frame_number": 16147,
            "display_filter": "frame.number == 16147",
            "timestamp_epoch": "1545161650.224040000"
          }
        ]
      },
      {
        "id": "finding-7aceee2346835940ca2899bd",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/gwiq/gwiq.js",
          "source": "35.201.93.216",
          "destination": "172.16.3.122",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 14165
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 252,
            "frame_number": 15752,
            "display_filter": "frame.number == 15752",
            "timestamp_epoch": "1545161650.072802000"
          },
          {
            "tcp_stream": 252,
            "frame_number": 16157,
            "display_filter": "frame.number == 16157",
            "timestamp_epoch": "1545161650.228421000"
          }
        ]
      },
      {
        "id": "finding-a8c7fa231b972aa6ebbe0b87",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/js/reach.js",
          "source": "52.85.146.160",
          "destination": "172.16.3.122",
          "content_type": "application/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 16999
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 253,
            "frame_number": 15753,
            "display_filter": "frame.number == 15753",
            "timestamp_epoch": "1545161650.072867000"
          },
          {
            "tcp_stream": 253,
            "frame_number": 15939,
            "display_filter": "frame.number == 15939",
            "timestamp_epoch": "1545161650.155535000"
          }
        ]
      },
      {
        "id": "finding-4da23735fd610caa74c65de3",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/geo/c.js",
          "source": "104.88.46.106",
          "destination": "172.16.3.122",
          "content_type": "application/x-javascript",
          "response_count": 1,
          "declared_body_bytes": 47
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 254,
            "frame_number": 15754,
            "display_filter": "frame.number == 15754",
            "timestamp_epoch": "1545161650.072959000"
          },
          {
            "tcp_stream": 254,
            "frame_number": 15883,
            "display_filter": "frame.number == 15883",
            "timestamp_epoch": "1545161650.139502000"
          }
        ]
      },
      {
        "id": "finding-3452e3dc2df6a55fa79ea97c",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/js/58287X1517246.skimlinks.js",
          "source": "151.139.128.10",
          "destination": "172.16.3.122",
          "content_type": "application/octet-stream",
          "response_count": 1,
          "declared_body_bytes": 13671
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 256,
            "frame_number": 15788,
            "display_filter": "frame.number == 15788",
            "timestamp_epoch": "1545161650.086006000"
          },
          {
            "tcp_stream": 256,
            "frame_number": 15958,
            "display_filter": "frame.number == 15958",
            "timestamp_epoch": "1545161650.158580000"
          }
        ]
      },
      {
        "id": "finding-d6cc22275786cac40137b0a8",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/novms/js/2/nlsDcrLite510.min.js",
          "source": "54.230.19.127",
          "destination": "172.16.3.122",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 255,
            "frame_number": 15795,
            "display_filter": "frame.number == 15795",
            "timestamp_epoch": "1545161650.088831000"
          },
          {
            "tcp_stream": 255,
            "frame_number": 15998,
            "display_filter": "frame.number == 15998",
            "timestamp_epoch": "1545161650.165857000"
          }
        ]
      },
      {
        "id": "finding-93a03196e75b831713ae165e",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/ro/c/js/sm_sp.js",
          "source": "54.230.19.252",
          "destination": "172.16.3.122",
          "content_type": "application/x-javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 262,
            "frame_number": 16010,
            "display_filter": "frame.number == 16010",
            "timestamp_epoch": "1545161650.171414000"
          },
          {
            "tcp_stream": 262,
            "frame_number": 16277,
            "display_filter": "frame.number == 16277",
            "timestamp_epoch": "1545161650.267508000"
          }
        ]
      },
      {
        "id": "finding-02de4f99beabbea930ad7e7d",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/293884104/SJa0Thl7_default/index.min.js",
          "source": "23.194.182.6",
          "destination": "172.16.3.122",
          "content_type": "application/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 250229
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 267,
            "frame_number": 16354,
            "display_filter": "frame.number == 16354",
            "timestamp_epoch": "1545161650.314259000"
          },
          {
            "tcp_stream": 267,
            "frame_number": 17007,
            "display_filter": "frame.number == 17007",
            "timestamp_epoch": "1545161650.615701000"
          }
        ]
      },
      {
        "id": "finding-a9bc8355ae8aba7fc1f2f375",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/code/ptrack-v1.1.1-engagedtime-slots-video.js",
          "source": "52.85.146.12",
          "destination": "172.16.3.122",
          "content_type": "application/x-javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 269,
            "frame_number": 16605,
            "display_filter": "frame.number == 16605",
            "timestamp_epoch": "1545161650.447678000"
          },
          {
            "tcp_stream": 269,
            "frame_number": 16749,
            "display_filter": "frame.number == 16749",
            "timestamp_epoch": "1545161650.527303000"
          }
        ]
      },
      {
        "id": "finding-737d9b07965bf8331668849a",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/Layer/InImage/Prod/cbola_platform/version_2.22.3.4/external/prebid.min.js",
          "source": "192.229.173.42",
          "destination": "172.16.3.122",
          "content_type": "text/javascript",
          "response_count": 1,
          "declared_body_bytes": 48099
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 275,
            "frame_number": 17029,
            "display_filter": "frame.number == 17029",
            "timestamp_epoch": "1545161650.648229000"
          },
          {
            "tcp_stream": 275,
            "frame_number": 17147,
            "display_filter": "frame.number == 17147",
            "timestamp_epoch": "1545161650.778833000"
          }
        ]
      },
      {
        "id": "finding-2b916b91fca529682f1041f7",
        "type": "pcap-finding",
        "label": "Authentication-like token in cleartext HTTP URI",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "host": "odb.outbrain.com",
          "path": "/utils/get",
          "source": "172.16.3.122",
          "destination": "151.101.2.2",
          "request_count": 3
        },
        "rule_id": "cleartext-tokenized-api",
        "severity": "medium",
        "confidence": 0.8,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "An HTTP request exposed a token-, key-, auth-, or session-like value in the URI. This is a review lead and a credential-exposure concern even when the application is legitimate.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 277,
            "frame_number": 17159,
            "display_filter": "frame.number == 17159",
            "timestamp_epoch": "1545161650.781721000"
          },
          {
            "tcp_stream": 277,
            "frame_number": 18093,
            "display_filter": "frame.number == 18093",
            "timestamp_epoch": "1545161651.796966000"
          },
          {
            "tcp_stream": 277,
            "frame_number": 19001,
            "display_filter": "frame.number == 19001",
            "timestamp_epoch": "1545161652.503780000"
          }
        ]
      },
      {
        "id": "finding-dab3363c240d7f790c1ec05d",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/assets/tags/versioned/ijs_all_modules_cjs_min_71b11a6e8d96220821830e1265b16209.js",
          "source": "54.192.18.51",
          "destination": "172.16.3.122",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 103847
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 279,
            "frame_number": 17183,
            "display_filter": "frame.number == 17183",
            "timestamp_epoch": "1545161650.833325000"
          },
          {
            "tcp_stream": 279,
            "frame_number": 17568,
            "display_filter": "frame.number == 17568",
            "timestamp_epoch": "1545161651.058552000"
          }
        ]
      },
      {
        "id": "finding-62adb51afc249d77fc7f1bf3",
        "type": "pcap-finding",
        "label": "Repeated outbound HTTP POST activity",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/SetAdsRequest",
          "host": "analytics.carambo.la",
          "port": 80,
          "source": "172.16.3.122",
          "destination": "54.87.174.85",
          "request_count": 12,
          "declared_body_bytes": 4404
        },
        "rule_id": "repeated-http-posts",
        "severity": "medium",
        "confidence": 0.72,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 258,
            "frame_number": 17246,
            "display_filter": "frame.number == 17246",
            "timestamp_epoch": "1545161650.896554000"
          },
          {
            "tcp_stream": 284,
            "frame_number": 17375,
            "display_filter": "frame.number == 17375",
            "timestamp_epoch": "1545161650.977006000"
          },
          {
            "tcp_stream": 285,
            "frame_number": 17419,
            "display_filter": "frame.number == 17419",
            "timestamp_epoch": "1545161650.987553000"
          },
          {
            "tcp_stream": 258,
            "frame_number": 29924,
            "display_filter": "frame.number == 29924",
            "timestamp_epoch": "1545161680.903158000"
          },
          {
            "tcp_stream": 284,
            "frame_number": 29930,
            "display_filter": "frame.number == 29930",
            "timestamp_epoch": "1545161680.930120000"
          },
          {
            "tcp_stream": 285,
            "frame_number": 29949,
            "display_filter": "frame.number == 29949",
            "timestamp_epoch": "1545161680.952094000"
          },
          {
            "tcp_stream": 258,
            "frame_number": 33477,
            "display_filter": "frame.number == 33477",
            "timestamp_epoch": "1545161710.908930000"
          },
          {
            "tcp_stream": 284,
            "frame_number": 33481,
            "display_filter": "frame.number == 33481",
            "timestamp_epoch": "1545161710.953282000"
          },
          {
            "tcp_stream": 258,
            "frame_number": 33500,
            "display_filter": "frame.number == 33500",
            "timestamp_epoch": "1545161711.000972000"
          },
          {
            "tcp_stream": 258,
            "frame_number": 37961,
            "display_filter": "frame.number == 37961",
            "timestamp_epoch": "1545161755.915292000"
          },
          {
            "tcp_stream": 284,
            "frame_number": 37963,
            "display_filter": "frame.number == 37963",
            "timestamp_epoch": "1545161755.943694000"
          },
          {
            "tcp_stream": 258,
            "frame_number": 37969,
            "display_filter": "frame.number == 37969",
            "timestamp_epoch": "1545161755.992399000"
          }
        ]
      },
      {
        "id": "finding-b4bf5076e12331977c003cfe",
        "type": "pcap-finding",
        "label": "Repeated outbound HTTP POST activity",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/translator?source=prebid-client",
          "host": "hbopenbid.pubmatic.com",
          "port": 80,
          "source": "172.16.3.122",
          "destination": "104.36.115.111",
          "request_count": 5,
          "declared_body_bytes": 3241
        },
        "rule_id": "repeated-http-posts",
        "severity": "medium",
        "confidence": 0.72,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 290,
            "frame_number": 17543,
            "display_filter": "frame.number == 17543",
            "timestamp_epoch": "1545161651.048817000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 29919,
            "display_filter": "frame.number == 29919",
            "timestamp_epoch": "1545161680.882917000"
          },
          {
            "tcp_stream": 624,
            "frame_number": 29961,
            "display_filter": "frame.number == 29961",
            "timestamp_epoch": "1545161680.985841000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 33475,
            "display_filter": "frame.number == 33475",
            "timestamp_epoch": "1545161710.894519000"
          },
          {
            "tcp_stream": 624,
            "frame_number": 33489,
            "display_filter": "frame.number == 33489",
            "timestamp_epoch": "1545161710.979992000"
          }
        ]
      },
      {
        "id": "finding-003655d9390178a7fbd1f5f5",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/js/sdkloader/ima3.js",
          "source": "172.217.1.10",
          "destination": "172.16.3.122",
          "content_type": "text/javascript",
          "response_count": 1,
          "declared_body_bytes": 81947
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 297,
            "frame_number": 17781,
            "display_filter": "frame.number == 17781",
            "timestamp_epoch": "1545161651.506325000"
          },
          {
            "tcp_stream": 297,
            "frame_number": 18145,
            "display_filter": "frame.number == 18145",
            "timestamp_epoch": "1545161651.825248000"
          }
        ]
      },
      {
        "id": "finding-1e5ec1dacc318302b8253c28",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/siab.js",
          "source": "104.16.87.26",
          "destination": "172.16.3.122",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 308,
            "frame_number": 18284,
            "display_filter": "frame.number == 18284",
            "timestamp_epoch": "1545161651.910950000"
          },
          {
            "tcp_stream": 308,
            "frame_number": 19831,
            "display_filter": "frame.number == 19831",
            "timestamp_epoch": "1545161653.062288000"
          }
        ]
      },
      {
        "id": "finding-ad6d38bc1706af786108ae20",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/analytics-v1.js",
          "source": "23.194.182.69",
          "destination": "172.16.3.122",
          "content_type": "application/x-javascript",
          "response_count": 1,
          "declared_body_bytes": 16690
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 309,
            "frame_number": 18309,
            "display_filter": "frame.number == 18309",
            "timestamp_epoch": "1545161651.927971000"
          },
          {
            "tcp_stream": 309,
            "frame_number": 18421,
            "display_filter": "frame.number == 18421",
            "timestamp_epoch": "1545161651.996583000"
          }
        ]
      },
      {
        "id": "finding-daeb53c3daddc228f4a26986",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/bao-csm/aps-comm/aps_csm.js",
          "source": "54.240.160.41",
          "destination": "172.16.3.122",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 321,
            "frame_number": 18599,
            "display_filter": "frame.number == 18599",
            "timestamp_epoch": "1545161652.025022000"
          },
          {
            "tcp_stream": 321,
            "frame_number": 18725,
            "display_filter": "frame.number == 18725",
            "timestamp_epoch": "1545161652.097026000"
          }
        ]
      },
      {
        "id": "finding-2fa75380735c27e7a3fc0807",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/nanoWidget/externals/obPixelFrame/obPixelFrame.js",
          "source": "23.194.182.69",
          "destination": "172.16.3.122",
          "content_type": "application/x-javascript",
          "response_count": 1,
          "declared_body_bytes": 717
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 306,
            "frame_number": 18807,
            "display_filter": "frame.number == 18807",
            "timestamp_epoch": "1545161652.237036000"
          },
          {
            "tcp_stream": 306,
            "frame_number": 18877,
            "display_filter": "frame.number == 18877",
            "timestamp_epoch": "1545161652.308467000"
          }
        ]
      },
      {
        "id": "finding-38dcd893630fb8ed9fa262a4",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/beacon.js",
          "source": "23.74.28.41",
          "destination": "172.16.3.122",
          "content_type": "application/x-javascript",
          "response_count": 1,
          "declared_body_bytes": 901
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 264,
            "frame_number": 18808,
            "display_filter": "frame.number == 18808",
            "timestamp_epoch": "1545161652.241538000"
          },
          {
            "tcp_stream": 264,
            "frame_number": 18879,
            "display_filter": "frame.number == 18879",
            "timestamp_epoch": "1545161652.312358000"
          }
        ]
      },
      {
        "id": "finding-3e727d5096ac2cb3f5b2cb62",
        "type": "pcap-finding",
        "label": "Periodic HTTP callback pattern",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/translator?source=index-client",
          "host": "hbopenbid.pubmatic.com",
          "port": 80,
          "method": "POST",
          "source": "172.16.3.122",
          "destination": "104.36.115.111",
          "request_count": 21,
          "median_interval_seconds": 15.642,
          "median_absolute_deviation": 0.177
        },
        "rule_id": "periodic-http-callbacks",
        "severity": "high",
        "confidence": 0.88,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "Repeated requests have a stable cadence consistent with automated callback or beacon behavior.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 290,
            "frame_number": 18895,
            "display_filter": "frame.number == 18895",
            "timestamp_epoch": "1545161652.344729000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 28899,
            "display_filter": "frame.number == 28899",
            "timestamp_epoch": "1545161669.471162000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 31301,
            "display_filter": "frame.number == 31301",
            "timestamp_epoch": "1545161685.645307000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 32296,
            "display_filter": "frame.number == 32296",
            "timestamp_epoch": "1545161701.099653000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 34541,
            "display_filter": "frame.number == 34541",
            "timestamp_epoch": "1545161717.120680000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 36771,
            "display_filter": "frame.number == 36771",
            "timestamp_epoch": "1545161732.613838000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 37305,
            "display_filter": "frame.number == 37305",
            "timestamp_epoch": "1545161748.013353000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 40346,
            "display_filter": "frame.number == 40346",
            "timestamp_epoch": "1545161763.479813000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 41785,
            "display_filter": "frame.number == 41785",
            "timestamp_epoch": "1545161779.203071000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 44535,
            "display_filter": "frame.number == 44535",
            "timestamp_epoch": "1545161794.772796000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 45515,
            "display_filter": "frame.number == 45515",
            "timestamp_epoch": "1545161810.397622000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 46301,
            "display_filter": "frame.number == 46301",
            "timestamp_epoch": "1545161825.911304000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 47548,
            "display_filter": "frame.number == 47548",
            "timestamp_epoch": "1545161841.552862000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 48947,
            "display_filter": "frame.number == 48947",
            "timestamp_epoch": "1545161857.372818000"
          },
          {
            "tcp_stream": 1198,
            "frame_number": 50833,
            "display_filter": "frame.number == 50833",
            "timestamp_epoch": "1545161873.066677000"
          },
          {
            "tcp_stream": 1198,
            "frame_number": 51792,
            "display_filter": "frame.number == 51792",
            "timestamp_epoch": "1545161888.764305000"
          },
          {
            "tcp_stream": 1198,
            "frame_number": 53859,
            "display_filter": "frame.number == 53859",
            "timestamp_epoch": "1545161904.193976000"
          },
          {
            "tcp_stream": 1198,
            "frame_number": 56991,
            "display_filter": "frame.number == 56991",
            "timestamp_epoch": "1545161920.060645000"
          },
          {
            "tcp_stream": 1198,
            "frame_number": 57977,
            "display_filter": "frame.number == 57977",
            "timestamp_epoch": "1545161935.704008000"
          },
          {
            "tcp_stream": 1470,
            "frame_number": 61697,
            "display_filter": "frame.number == 61697",
            "timestamp_epoch": "1545161951.816737000"
          },
          {
            "tcp_stream": 1470,
            "frame_number": 62363,
            "display_filter": "frame.number == 62363",
            "timestamp_epoch": "1545161967.069085000"
          }
        ]
      },
      {
        "id": "finding-724dffe091a5edd27a3aec07",
        "type": "pcap-finding",
        "label": "Repeated outbound HTTP POST activity",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/translator?source=index-client",
          "host": "hbopenbid.pubmatic.com",
          "port": 80,
          "source": "172.16.3.122",
          "destination": "104.36.115.111",
          "request_count": 21,
          "declared_body_bytes": 13281
        },
        "rule_id": "repeated-http-posts",
        "severity": "medium",
        "confidence": 0.72,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 290,
            "frame_number": 18895,
            "display_filter": "frame.number == 18895",
            "timestamp_epoch": "1545161652.344729000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 28899,
            "display_filter": "frame.number == 28899",
            "timestamp_epoch": "1545161669.471162000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 31301,
            "display_filter": "frame.number == 31301",
            "timestamp_epoch": "1545161685.645307000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 32296,
            "display_filter": "frame.number == 32296",
            "timestamp_epoch": "1545161701.099653000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 34541,
            "display_filter": "frame.number == 34541",
            "timestamp_epoch": "1545161717.120680000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 36771,
            "display_filter": "frame.number == 36771",
            "timestamp_epoch": "1545161732.613838000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 37305,
            "display_filter": "frame.number == 37305",
            "timestamp_epoch": "1545161748.013353000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 40346,
            "display_filter": "frame.number == 40346",
            "timestamp_epoch": "1545161763.479813000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 41785,
            "display_filter": "frame.number == 41785",
            "timestamp_epoch": "1545161779.203071000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 44535,
            "display_filter": "frame.number == 44535",
            "timestamp_epoch": "1545161794.772796000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 45515,
            "display_filter": "frame.number == 45515",
            "timestamp_epoch": "1545161810.397622000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 46301,
            "display_filter": "frame.number == 46301",
            "timestamp_epoch": "1545161825.911304000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 47548,
            "display_filter": "frame.number == 47548",
            "timestamp_epoch": "1545161841.552862000"
          },
          {
            "tcp_stream": 601,
            "frame_number": 48947,
            "display_filter": "frame.number == 48947",
            "timestamp_epoch": "1545161857.372818000"
          },
          {
            "tcp_stream": 1198,
            "frame_number": 50833,
            "display_filter": "frame.number == 50833",
            "timestamp_epoch": "1545161873.066677000"
          },
          {
            "tcp_stream": 1198,
            "frame_number": 51792,
            "display_filter": "frame.number == 51792",
            "timestamp_epoch": "1545161888.764305000"
          },
          {
            "tcp_stream": 1198,
            "frame_number": 53859,
            "display_filter": "frame.number == 53859",
            "timestamp_epoch": "1545161904.193976000"
          },
          {
            "tcp_stream": 1198,
            "frame_number": 56991,
            "display_filter": "frame.number == 56991",
            "timestamp_epoch": "1545161920.060645000"
          },
          {
            "tcp_stream": 1198,
            "frame_number": 57977,
            "display_filter": "frame.number == 57977",
            "timestamp_epoch": "1545161935.704008000"
          },
          {
            "tcp_stream": 1470,
            "frame_number": 61697,
            "display_filter": "frame.number == 61697",
            "timestamp_epoch": "1545161951.816737000"
          },
          {
            "tcp_stream": 1470,
            "frame_number": 62363,
            "display_filter": "frame.number == 62363",
            "timestamp_epoch": "1545161967.069085000"
          }
        ]
      },
      {
        "id": "finding-92afc1bffe0472bd3190c0c0",
        "type": "pcap-finding",
        "label": "Periodic HTTP callback pattern",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/headerstats?s=282603&u=http%3A%2F%2Ftime.com%2F5455078%2Fapple-ipad-pro-2018-review%2F&v=3",
          "host": "as.casalemedia.com",
          "port": 80,
          "method": "POST",
          "source": "172.16.3.122",
          "destination": "23.74.28.9",
          "request_count": 21,
          "median_interval_seconds": 15.669,
          "median_absolute_deviation": 0.277
        },
        "rule_id": "periodic-http-callbacks",
        "severity": "high",
        "confidence": 0.88,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "Repeated requests have a stable cadence consistent with automated callback or beacon behavior.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 358,
            "frame_number": 19789,
            "display_filter": "frame.number == 19789",
            "timestamp_epoch": "1545161653.009538000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 28994,
            "display_filter": "frame.number == 28994",
            "timestamp_epoch": "1545161669.758866000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 31431,
            "display_filter": "frame.number == 31431",
            "timestamp_epoch": "1545161686.140376000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 32371,
            "display_filter": "frame.number == 32371",
            "timestamp_epoch": "1545161701.426056000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 34737,
            "display_filter": "frame.number == 34737",
            "timestamp_epoch": "1545161717.557672000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 36835,
            "display_filter": "frame.number == 36835",
            "timestamp_epoch": "1545161732.962452000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 37378,
            "display_filter": "frame.number == 37378",
            "timestamp_epoch": "1545161748.273629000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 40449,
            "display_filter": "frame.number == 40449",
            "timestamp_epoch": "1545161763.902698000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 41880,
            "display_filter": "frame.number == 41880",
            "timestamp_epoch": "1545161779.644182000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 44607,
            "display_filter": "frame.number == 44607",
            "timestamp_epoch": "1545161795.079561000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 45585,
            "display_filter": "frame.number == 45585",
            "timestamp_epoch": "1545161810.902804000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 46371,
            "display_filter": "frame.number == 46371",
            "timestamp_epoch": "1545161826.410511000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 47615,
            "display_filter": "frame.number == 47615",
            "timestamp_epoch": "1545161842.057259000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 49096,
            "display_filter": "frame.number == 49096",
            "timestamp_epoch": "1545161858.078353000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 50946,
            "display_filter": "frame.number == 50946",
            "timestamp_epoch": "1545161873.447802000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 51910,
            "display_filter": "frame.number == 51910",
            "timestamp_epoch": "1545161889.138540000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 53951,
            "display_filter": "frame.number == 53951",
            "timestamp_epoch": "1545161904.517232000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 57102,
            "display_filter": "frame.number == 57102",
            "timestamp_epoch": "1545161920.362169000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 58118,
            "display_filter": "frame.number == 58118",
            "timestamp_epoch": "1545161936.057353000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 61746,
            "display_filter": "frame.number == 61746",
            "timestamp_epoch": "1545161952.130200000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 62445,
            "display_filter": "frame.number == 62445",
            "timestamp_epoch": "1545161967.413779000"
          }
        ]
      },
      {
        "id": "finding-1806d220cc62e8d92d6b6b3d",
        "type": "pcap-finding",
        "label": "Repeated outbound HTTP POST activity",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/headerstats?s=282603&u=http%3A%2F%2Ftime.com%2F5455078%2Fapple-ipad-pro-2018-review%2F&v=3",
          "host": "as.casalemedia.com",
          "port": 80,
          "source": "172.16.3.122",
          "destination": "23.74.28.9",
          "request_count": 21,
          "declared_body_bytes": 12222
        },
        "rule_id": "repeated-http-posts",
        "severity": "medium",
        "confidence": 0.72,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 358,
            "frame_number": 19789,
            "display_filter": "frame.number == 19789",
            "timestamp_epoch": "1545161653.009538000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 28994,
            "display_filter": "frame.number == 28994",
            "timestamp_epoch": "1545161669.758866000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 31431,
            "display_filter": "frame.number == 31431",
            "timestamp_epoch": "1545161686.140376000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 32371,
            "display_filter": "frame.number == 32371",
            "timestamp_epoch": "1545161701.426056000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 34737,
            "display_filter": "frame.number == 34737",
            "timestamp_epoch": "1545161717.557672000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 36835,
            "display_filter": "frame.number == 36835",
            "timestamp_epoch": "1545161732.962452000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 37378,
            "display_filter": "frame.number == 37378",
            "timestamp_epoch": "1545161748.273629000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 40449,
            "display_filter": "frame.number == 40449",
            "timestamp_epoch": "1545161763.902698000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 41880,
            "display_filter": "frame.number == 41880",
            "timestamp_epoch": "1545161779.644182000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 44607,
            "display_filter": "frame.number == 44607",
            "timestamp_epoch": "1545161795.079561000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 45585,
            "display_filter": "frame.number == 45585",
            "timestamp_epoch": "1545161810.902804000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 46371,
            "display_filter": "frame.number == 46371",
            "timestamp_epoch": "1545161826.410511000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 47615,
            "display_filter": "frame.number == 47615",
            "timestamp_epoch": "1545161842.057259000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 49096,
            "display_filter": "frame.number == 49096",
            "timestamp_epoch": "1545161858.078353000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 50946,
            "display_filter": "frame.number == 50946",
            "timestamp_epoch": "1545161873.447802000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 51910,
            "display_filter": "frame.number == 51910",
            "timestamp_epoch": "1545161889.138540000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 53951,
            "display_filter": "frame.number == 53951",
            "timestamp_epoch": "1545161904.517232000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 57102,
            "display_filter": "frame.number == 57102",
            "timestamp_epoch": "1545161920.362169000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 58118,
            "display_filter": "frame.number == 58118",
            "timestamp_epoch": "1545161936.057353000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 61746,
            "display_filter": "frame.number == 61746",
            "timestamp_epoch": "1545161952.130200000"
          },
          {
            "tcp_stream": 358,
            "frame_number": 62445,
            "display_filter": "frame.number == 62445",
            "timestamp_epoch": "1545161967.413779000"
          }
        ]
      },
      {
        "id": "finding-f1b86a8a8f8dcd933e073155",
        "type": "pcap-finding",
        "label": "Periodic HTTP callback pattern",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/w/1.0/pd?plm=6&ph=eab9ff18-1f65-4a26-8531-cb990181cabb&gdpr=0",
          "host": "us-u.openx.net",
          "port": 80,
          "method": "GET",
          "source": "172.16.3.122",
          "destination": "173.241.244.143",
          "request_count": 19,
          "median_interval_seconds": 15.638,
          "median_absolute_deviation": 0.166
        },
        "rule_id": "periodic-http-callbacks",
        "severity": "high",
        "confidence": 0.88,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "Repeated requests have a stable cadence consistent with automated callback or beacon behavior.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 360,
            "frame_number": 19869,
            "display_filter": "frame.number == 19869",
            "timestamp_epoch": "1545161653.119204000"
          },
          {
            "tcp_stream": 606,
            "frame_number": 28988,
            "display_filter": "frame.number == 28988",
            "timestamp_epoch": "1545161669.724029000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 31384,
            "display_filter": "frame.number == 31384",
            "timestamp_epoch": "1545161685.882090000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 32346,
            "display_filter": "frame.number == 32346",
            "timestamp_epoch": "1545161701.271269000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 34650,
            "display_filter": "frame.number == 34650",
            "timestamp_epoch": "1545161717.378641000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 36804,
            "display_filter": "frame.number == 36804",
            "timestamp_epoch": "1545161732.779338000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 37342,
            "display_filter": "frame.number == 37342",
            "timestamp_epoch": "1545161748.165838000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 40424,
            "display_filter": "frame.number == 40424",
            "timestamp_epoch": "1545161763.740802000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 41818,
            "display_filter": "frame.number == 41818",
            "timestamp_epoch": "1545161779.359753000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 44570,
            "display_filter": "frame.number == 44570",
            "timestamp_epoch": "1545161794.938449000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 45553,
            "display_filter": "frame.number == 45553",
            "timestamp_epoch": "1545161810.575225000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 46328,
            "display_filter": "frame.number == 46328",
            "timestamp_epoch": "1545161826.070563000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 47577,
            "display_filter": "frame.number == 47577",
            "timestamp_epoch": "1545161841.710764000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 49020,
            "display_filter": "frame.number == 49020",
            "timestamp_epoch": "1545161857.539056000"
          },
          {
            "tcp_stream": 1203,
            "frame_number": 50895,
            "display_filter": "frame.number == 50895",
            "timestamp_epoch": "1545161873.273661000"
          },
          {
            "tcp_stream": 1203,
            "frame_number": 51854,
            "display_filter": "frame.number == 51854",
            "timestamp_epoch": "1545161888.946487000"
          },
          {
            "tcp_stream": 1203,
            "frame_number": 53904,
            "display_filter": "frame.number == 53904",
            "timestamp_epoch": "1545161904.366325000"
          },
          {
            "tcp_stream": 1203,
            "frame_number": 57074,
            "display_filter": "frame.number == 57074",
            "timestamp_epoch": "1545161920.224230000"
          },
          {
            "tcp_stream": 1203,
            "frame_number": 58063,
            "display_filter": "frame.number == 58063",
            "timestamp_epoch": "1545161935.893050000"
          }
        ]
      },
      {
        "id": "finding-fbb8e3c8fac02a45040be4ab",
        "type": "pcap-finding",
        "label": "Periodic HTTP callback pattern",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/w/1.0/pd?cc=1&plm=6&ph=eab9ff18-1f65-4a26-8531-cb990181cabb&gdpr=0",
          "host": "us-u.openx.net",
          "port": 80,
          "method": "GET",
          "source": "172.16.3.122",
          "destination": "173.241.244.143",
          "request_count": 19,
          "median_interval_seconds": 15.64,
          "median_absolute_deviation": 0.167
        },
        "rule_id": "periodic-http-callbacks",
        "severity": "high",
        "confidence": 0.88,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "Repeated requests have a stable cadence consistent with automated callback or beacon behavior.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 360,
            "frame_number": 19954,
            "display_filter": "frame.number == 19954",
            "timestamp_epoch": "1545161653.247268000"
          },
          {
            "tcp_stream": 606,
            "frame_number": 29010,
            "display_filter": "frame.number == 29010",
            "timestamp_epoch": "1545161669.818452000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 31416,
            "display_filter": "frame.number == 31416",
            "timestamp_epoch": "1545161685.979507000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 32363,
            "display_filter": "frame.number == 32363",
            "timestamp_epoch": "1545161701.392028000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 34679,
            "display_filter": "frame.number == 34679",
            "timestamp_epoch": "1545161717.464654000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 36827,
            "display_filter": "frame.number == 36827",
            "timestamp_epoch": "1545161732.871067000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 37360,
            "display_filter": "frame.number == 37360",
            "timestamp_epoch": "1545161748.256206000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 40441,
            "display_filter": "frame.number == 40441",
            "timestamp_epoch": "1545161763.822678000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 41841,
            "display_filter": "frame.number == 41841",
            "timestamp_epoch": "1545161779.460146000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 44594,
            "display_filter": "frame.number == 44594",
            "timestamp_epoch": "1545161795.025351000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 45581,
            "display_filter": "frame.number == 45581",
            "timestamp_epoch": "1545161810.665765000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 46354,
            "display_filter": "frame.number == 46354",
            "timestamp_epoch": "1545161826.163649000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 47600,
            "display_filter": "frame.number == 47600",
            "timestamp_epoch": "1545161841.802536000"
          },
          {
            "tcp_stream": 657,
            "frame_number": 49059,
            "display_filter": "frame.number == 49059",
            "timestamp_epoch": "1545161857.633435000"
          },
          {
            "tcp_stream": 1203,
            "frame_number": 50922,
            "display_filter": "frame.number == 50922",
            "timestamp_epoch": "1545161873.364748000"
          },
          {
            "tcp_stream": 1203,
            "frame_number": 51861,
            "display_filter": "frame.number == 51861",
            "timestamp_epoch": "1545161889.034578000"
          },
          {
            "tcp_stream": 1203,
            "frame_number": 53940,
            "display_filter": "frame.number == 53940",
            "timestamp_epoch": "1545161904.460023000"
          },
          {
            "tcp_stream": 1203,
            "frame_number": 57098,
            "display_filter": "frame.number == 57098",
            "timestamp_epoch": "1545161920.313850000"
          },
          {
            "tcp_stream": 1203,
            "frame_number": 58106,
            "display_filter": "frame.number == 58106",
            "timestamp_epoch": "1545161936.000812000"
          }
        ]
      },
      {
        "id": "finding-85e4094e82e4a03fca9a8c30",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/pagead/osd.js",
          "source": "172.217.1.162",
          "destination": "172.16.3.122",
          "content_type": "text/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 26696
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 366,
            "frame_number": 20186,
            "display_filter": "frame.number == 20186",
            "timestamp_epoch": "1545161653.544866000"
          },
          {
            "tcp_stream": 366,
            "frame_number": 20378,
            "display_filter": "frame.number == 20378",
            "timestamp_epoch": "1545161653.724884000"
          }
        ]
      },
      {
        "id": "finding-25680176b1c38c862da27502",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/meredith678928442552/moatad.js",
          "source": "23.74.28.34",
          "destination": "172.16.3.122",
          "content_type": "application/x-javascript",
          "response_count": 1,
          "declared_body_bytes": 92321
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 378,
            "frame_number": 21092,
            "display_filter": "frame.number == 21092",
            "timestamp_epoch": "1545161654.129184000"
          },
          {
            "tcp_stream": 378,
            "frame_number": 21491,
            "display_filter": "frame.number == 21491",
            "timestamp_epoch": "1545161654.299164000"
          }
        ]
      },
      {
        "id": "finding-c9be899439d8d34a667f6a0a",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/1/javascripts/sic.js",
          "source": "104.16.38.14",
          "destination": "172.16.3.122",
          "content_type": "application/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 382,
            "frame_number": 21180,
            "display_filter": "frame.number == 21180",
            "timestamp_epoch": "1545161654.198941000"
          },
          {
            "tcp_stream": 382,
            "frame_number": 21750,
            "display_filter": "frame.number == 21750",
            "timestamp_epoch": "1545161654.392106000"
          }
        ]
      },
      {
        "id": "finding-b0e227b87018056938aed9a2",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/npfm.js?cid=8CUDF41E5",
          "source": "23.67.59.8",
          "destination": "172.16.3.122",
          "content_type": "text/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 27602
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 414,
            "frame_number": 22177,
            "display_filter": "frame.number == 22177",
            "timestamp_epoch": "1545161654.752898000"
          },
          {
            "tcp_stream": 414,
            "frame_number": 22463,
            "display_filter": "frame.number == 22463",
            "timestamp_epoch": "1545161654.937676000"
          }
        ]
      },
      {
        "id": "finding-c57017182518e45573bd42e7",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/a/12738/195820/957556-2.js?&cb=0.4893428290269989&tk_st=1&rf=http%3A//time.com/5455078/apple-ipad-pro-2018-review/&rp_s=l&p_screen_res=1280x800&ad_slot=195820_2",
          "source": "8.43.72.32",
          "destination": "172.16.3.122",
          "content_type": "text/javascript",
          "response_count": 1,
          "declared_body_bytes": 1027
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 431,
            "frame_number": 22433,
            "display_filter": "frame.number == 22433",
            "timestamp_epoch": "1545161654.926328000"
          },
          {
            "tcp_stream": 431,
            "frame_number": 22731,
            "display_filter": "frame.number == 22731",
            "timestamp_epoch": "1545161655.141803000"
          }
        ]
      },
      {
        "id": "finding-86f36b8ebd86d157d9ee4938",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/a/12738/195820/957562-2.js?&cb=0.6035347457587282&tk_st=1&rf=http%3A//time.com/5455078/apple-ipad-pro-2018-review/&rp_s=l&p_screen_res=1280x800&ad_slot=195820_2",
          "source": "8.43.72.32",
          "destination": "172.16.3.122",
          "content_type": "text/javascript",
          "response_count": 1,
          "declared_body_bytes": 1029
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 432,
            "frame_number": 22436,
            "display_filter": "frame.number == 22436",
            "timestamp_epoch": "1545161654.926628000"
          },
          {
            "tcp_stream": 432,
            "frame_number": 22740,
            "display_filter": "frame.number == 22740",
            "timestamp_epoch": "1545161655.146060000"
          }
        ]
      },
      {
        "id": "finding-5735df165c8fa9cef45c7d22",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/AdServer/js/showad.js",
          "source": "23.194.181.103",
          "destination": "172.16.3.122",
          "content_type": "text/html; charset=utf-8",
          "response_count": 8,
          "declared_body_bytes": 122168
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 428,
            "frame_number": 22711,
            "display_filter": "frame.number == 22711",
            "timestamp_epoch": "1545161655.086329000"
          },
          {
            "tcp_stream": 428,
            "frame_number": 22762,
            "display_filter": "frame.number == 22762",
            "timestamp_epoch": "1545161655.154633000"
          },
          {
            "tcp_stream": 631,
            "frame_number": 30020,
            "display_filter": "frame.number == 30020",
            "timestamp_epoch": "1545161681.099998000"
          },
          {
            "tcp_stream": 631,
            "frame_number": 30045,
            "display_filter": "frame.number == 30045",
            "timestamp_epoch": "1545161681.165584000"
          },
          {
            "tcp_stream": 631,
            "frame_number": 30159,
            "display_filter": "frame.number == 30159",
            "timestamp_epoch": "1545161681.627694000"
          },
          {
            "tcp_stream": 631,
            "frame_number": 30201,
            "display_filter": "frame.number == 30201",
            "timestamp_epoch": "1545161681.699680000"
          },
          {
            "tcp_stream": 638,
            "frame_number": 30202,
            "display_filter": "frame.number == 30202",
            "timestamp_epoch": "1545161681.699758000"
          },
          {
            "tcp_stream": 642,
            "frame_number": 30245,
            "display_filter": "frame.number == 30245",
            "timestamp_epoch": "1545161681.738704000"
          },
          {
            "tcp_stream": 643,
            "frame_number": 30246,
            "display_filter": "frame.number == 30246",
            "timestamp_epoch": "1545161681.739121000"
          },
          {
            "tcp_stream": 638,
            "frame_number": 30262,
            "display_filter": "frame.number == 30262",
            "timestamp_epoch": "1545161681.766971000"
          },
          {
            "tcp_stream": 643,
            "frame_number": 30314,
            "display_filter": "frame.number == 30314",
            "timestamp_epoch": "1545161681.802762000"
          },
          {
            "tcp_stream": 642,
            "frame_number": 30321,
            "display_filter": "frame.number == 30321",
            "timestamp_epoch": "1545161681.804015000"
          },
          {
            "tcp_stream": 631,
            "frame_number": 33502,
            "display_filter": "frame.number == 33502",
            "timestamp_epoch": "1545161711.011157000"
          },
          {
            "tcp_stream": 631,
            "frame_number": 33560,
            "display_filter": "frame.number == 33560",
            "timestamp_epoch": "1545161711.116238000"
          },
          {
            "tcp_stream": 631,
            "frame_number": 36933,
            "display_filter": "frame.number == 36933",
            "timestamp_epoch": "1545161734.540003000"
          },
          {
            "tcp_stream": 631,
            "frame_number": 36963,
            "display_filter": "frame.number == 36963",
            "timestamp_epoch": "1545161734.619161000"
          }
        ]
      },
      {
        "id": "finding-5d083c11a3e26d8eba5d67aa",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/pagead/show_ads.js",
          "source": "172.217.1.162",
          "destination": "172.16.3.122",
          "content_type": "text/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 22285
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 367,
            "frame_number": 22796,
            "display_filter": "frame.number == 22796",
            "timestamp_epoch": "1545161655.211204000"
          },
          {
            "tcp_stream": 367,
            "frame_number": 22985,
            "display_filter": "frame.number == 22985",
            "timestamp_epoch": "1545161655.415165000"
          }
        ]
      },
      {
        "id": "finding-23897dec6962f6f6686afa29",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/tag/js/gpt.js",
          "source": "172.217.1.162",
          "destination": "172.16.3.122",
          "content_type": "text/javascript",
          "response_count": 1,
          "declared_body_bytes": 9679
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 440,
            "frame_number": 22834,
            "display_filter": "frame.number == 22834",
            "timestamp_epoch": "1545161655.284735000"
          },
          {
            "tcp_stream": 440,
            "frame_number": 23021,
            "display_filter": "frame.number == 23021",
            "timestamp_epoch": "1545161655.422896000"
          }
        ]
      },
      {
        "id": "finding-25f6e5136c9fc95398a8bf1d",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/fcmdynet.js?&cid=8CUDF41E5&cpcd=TyWTjHO2ivmIdtb1fEbAQA%3D%3D&crid=515973768&size=728x90&cc=US&sc=MA&chnm=harmony&vif=2&requrl=http%3A%2F%2Ftime.com%2F5455078%2Fapple-ipad-pro-2018-review&nse=1&vi=1545161654809532215&lw=1&ugd=4&chnm2=8CU27OIC8&chnm3=567787259&ts=201812181930&bdrId=4&re=1",
          "source": "23.67.59.10",
          "destination": "172.16.3.122",
          "content_type": "text/javascript;charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 11767
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 444,
            "frame_number": 23017,
            "display_filter": "frame.number == 23017",
            "timestamp_epoch": "1545161655.421626000"
          },
          {
            "tcp_stream": 444,
            "frame_number": 23625,
            "display_filter": "frame.number == 23625",
            "timestamp_epoch": "1545161656.052181000"
          }
        ]
      },
      {
        "id": "finding-4e3985b8b325c9c44a0e7979",
        "type": "pcap-finding",
        "label": "Repeated outbound HTTP POST activity",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/page/update",
          "host": "revee.outbrain.com",
          "port": 80,
          "source": "172.16.3.122",
          "destination": "64.74.236.18",
          "request_count": 5,
          "declared_body_bytes": 56564
        },
        "rule_id": "repeated-http-posts",
        "severity": "medium",
        "confidence": 0.72,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 445,
            "frame_number": 23067,
            "display_filter": "frame.number == 23067",
            "timestamp_epoch": "1545161655.503734000"
          },
          {
            "tcp_stream": 607,
            "frame_number": 29185,
            "display_filter": "frame.number == 29185",
            "timestamp_epoch": "1545161672.227766000"
          },
          {
            "tcp_stream": 698,
            "frame_number": 31738,
            "display_filter": "frame.number == 31738",
            "timestamp_epoch": "1545161688.256224000"
          },
          {
            "tcp_stream": 737,
            "frame_number": 32955,
            "display_filter": "frame.number == 32955",
            "timestamp_epoch": "1545161703.843312000"
          },
          {
            "tcp_stream": 836,
            "frame_number": 35543,
            "display_filter": "frame.number == 35543",
            "timestamp_epoch": "1545161719.943317000"
          }
        ]
      },
      {
        "id": "finding-0c9c4af959a915278586a9b1",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/pagead/js/r20181205/r20180604/show_ads_impl.js",
          "source": "172.217.1.162",
          "destination": "172.16.3.122",
          "content_type": "text/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 75622
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 366,
            "frame_number": 23224,
            "display_filter": "frame.number == 23224",
            "timestamp_epoch": "1545161655.681257000"
          },
          {
            "tcp_stream": 366,
            "frame_number": 23547,
            "display_filter": "frame.number == 23547",
            "timestamp_epoch": "1545161655.926873000"
          }
        ]
      },
      {
        "id": "finding-7fa9a41f23c987887e1024f5",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/__media__/js/util/nrrV820.js",
          "source": "23.67.59.8",
          "destination": "172.16.3.122",
          "content_type": "text/javascript; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 20228
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 414,
            "frame_number": 23652,
            "display_filter": "frame.number == 23652",
            "timestamp_epoch": "1545161656.072602000"
          },
          {
            "tcp_stream": 414,
            "frame_number": 23847,
            "display_filter": "frame.number == 23847",
            "timestamp_epoch": "1545161656.256862000"
          }
        ]
      },
      {
        "id": "finding-5830192e7dc06b101e1b4633",
        "type": "pcap-finding",
        "label": "Repeated outbound HTTP POST activity",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/api/exchange",
          "host": "ssc.33across.com",
          "port": 80,
          "source": "172.16.3.122",
          "destination": "54.236.163.4",
          "request_count": 12,
          "declared_body_bytes": 8712
        },
        "rule_id": "repeated-http-posts",
        "severity": "medium",
        "confidence": 0.72,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 477,
            "frame_number": 23779,
            "display_filter": "frame.number == 23779",
            "timestamp_epoch": "1545161656.197353000"
          },
          {
            "tcp_stream": 481,
            "frame_number": 23783,
            "display_filter": "frame.number == 23783",
            "timestamp_epoch": "1545161656.200530000"
          },
          {
            "tcp_stream": 477,
            "frame_number": 24374,
            "display_filter": "frame.number == 24374",
            "timestamp_epoch": "1545161657.022093000"
          },
          {
            "tcp_stream": 477,
            "frame_number": 30794,
            "display_filter": "frame.number == 30794",
            "timestamp_epoch": "1545161683.478016000"
          },
          {
            "tcp_stream": 477,
            "frame_number": 30897,
            "display_filter": "frame.number == 30897",
            "timestamp_epoch": "1545161683.827756000"
          },
          {
            "tcp_stream": 477,
            "frame_number": 30935,
            "display_filter": "frame.number == 30935",
            "timestamp_epoch": "1545161683.937459000"
          },
          {
            "tcp_stream": 477,
            "frame_number": 33694,
            "display_filter": "frame.number == 33694",
            "timestamp_epoch": "1545161711.641588000"
          },
          {
            "tcp_stream": 477,
            "frame_number": 33732,
            "display_filter": "frame.number == 33732",
            "timestamp_epoch": "1545161711.745015000"
          },
          {
            "tcp_stream": 767,
            "frame_number": 33861,
            "display_filter": "frame.number == 33861",
            "timestamp_epoch": "1545161711.970411000"
          },
          {
            "tcp_stream": 477,
            "frame_number": 38160,
            "display_filter": "frame.number == 38160",
            "timestamp_epoch": "1545161757.034758000"
          },
          {
            "tcp_stream": 767,
            "frame_number": 38191,
            "display_filter": "frame.number == 38191",
            "timestamp_epoch": "1545161757.115676000"
          },
          {
            "tcp_stream": 477,
            "frame_number": 38236,
            "display_filter": "frame.number == 38236",
            "timestamp_epoch": "1545161757.187380000"
          }
        ]
      },
      {
        "id": "finding-99d323a81ac5859ebc6d5a4a",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/javascripts/bfp_ssn.js?templateId=17&lightBfpSsn=false",
          "source": "23.67.59.9",
          "destination": "172.16.3.122",
          "content_type": "text/html; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 3759
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 483,
            "frame_number": 23996,
            "display_filter": "frame.number == 23996",
            "timestamp_epoch": "1545161656.433983000"
          },
          {
            "tcp_stream": 483,
            "frame_number": 24197,
            "display_filter": "frame.number == 24197",
            "timestamp_epoch": "1545161656.608695000"
          }
        ]
      },
      {
        "id": "finding-26a5d77618adf1e3d54d3b33",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/cenw.js",
          "source": "100.25.75.255",
          "destination": "172.16.3.122",
          "content_type": "text/html; charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 36
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 492,
            "frame_number": 24520,
            "display_filter": "frame.number == 24520",
            "timestamp_epoch": "1545161657.155442000"
          },
          {
            "tcp_stream": 492,
            "frame_number": 24616,
            "display_filter": "frame.number == 24616",
            "timestamp_epoch": "1545161657.224107000"
          }
        ]
      },
      {
        "id": "finding-b2ae318aa336e71c7025876f",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/sync.js?tc=8b5b419f-d667-4f0b-b560-29e50bdc54cf&u=http%3A%2F%2Ftime.com%2F5455078%2Fapple-ipad-pro-2018-review%2F&r=",
          "source": "54.230.19.177",
          "destination": "172.16.3.122",
          "content_type": "text/javascript;charset=utf-8",
          "response_count": 1,
          "declared_body_bytes": 947
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 493,
            "frame_number": 24525,
            "display_filter": "frame.number == 24525",
            "timestamp_epoch": "1545161657.163789000"
          },
          {
            "tcp_stream": 493,
            "frame_number": 24707,
            "display_filter": "frame.number == 24707",
            "timestamp_epoch": "1545161657.318215000"
          }
        ]
      },
      {
        "id": "finding-73268b67d35c04f05c0fbc90",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/quant.js",
          "source": "192.184.68.187",
          "destination": "172.16.3.122",
          "content_type": "application/x-javascript",
          "response_count": 1,
          "declared_body_bytes": 5456
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 495,
            "frame_number": 24744,
            "display_filter": "frame.number == 24744",
            "timestamp_epoch": "1545161657.340417000"
          },
          {
            "tcp_stream": 495,
            "frame_number": 24997,
            "display_filter": "frame.number == 24997",
            "timestamp_epoch": "1545161657.420212000"
          }
        ]
      },
      {
        "id": "finding-61f66cb153b01710a962e0e8",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/rules-p-00TsOkvHvnsZU.js",
          "source": "54.230.19.75",
          "destination": "172.16.3.122",
          "content_type": "application/x-javascript",
          "response_count": 1,
          "declared_body_bytes": 3
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 508,
            "frame_number": 25662,
            "display_filter": "frame.number == 25662",
            "timestamp_epoch": "1545161658.242411000"
          },
          {
            "tcp_stream": 508,
            "frame_number": 25688,
            "display_filter": "frame.number == 25688",
            "timestamp_epoch": "1545161658.314297000"
          }
        ]
      },
      {
        "id": "finding-3ae2c0cfae6c5f8c547c1d1f",
        "type": "pcap-finding",
        "label": "Script, archive, or executable transfer candidate",
        "source": "deterministic-pcap-analysis",
        "metrics": {
          "uri": "/www/delivery/fpi.js?{random}&_ADTIME_&z=583062&width=300&height=250",
          "source": "72.251.238.254",
          "destination": "172.16.3.122",
          "content_type": "text/javascript",
          "response_count": 1,
          "declared_body_bytes": 0
        },
        "rule_id": "script-or-executable-transfer",
        "severity": "medium",
        "confidence": 0.86,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "rule_version": "pcap-rules-v5",
        "frame_evidence": [
          {
            "tcp_stream": 513,
            "frame_number": 25870,
            "display_filter": "frame.number == 25870",
            "timestamp_epoch": "1545161658.589079000"
          },
          {
            "tcp_stream": 513,
            "frame_number": 25894,
            "display_filter": "frame.number == 25894",
            "timestamp_epoch": "1545161658.651091000"
          }
        ]
      },
      {
        "id": "identity-f67ac00c2c3c223369fa9d4e",
        "type": "identity",
        "label": "account: 279",
        "value": "279",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [],
        "identity_type": "account",
        "frame_evidence": [
          {
            "tcp_stream": 279,
            "frame_number": 17568,
            "display_filter": "frame.number == 17568",
            "timestamp_epoch": "1545161651.058552000"
          },
          {
            "tcp_stream": 279,
            "frame_number": 17568,
            "display_filter": "frame.number == 17568",
            "timestamp_epoch": "1545161651.058552000"
          }
        ]
      },
      {
        "id": "identity-22a9ad32e9a87e766cad43bc",
        "type": "identity",
        "label": "account: conception.varner",
        "value": "conception.varner",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [
          "172.16.3.133"
        ],
        "identity_type": "account",
        "frame_evidence": [
          {
            "tcp_stream": 870,
            "frame_number": 37227,
            "display_filter": "frame.number == 37227",
            "timestamp_epoch": "1545161744.447201000"
          },
          {
            "tcp_stream": 871,
            "frame_number": 37235,
            "display_filter": "frame.number == 37235",
            "timestamp_epoch": "1545161744.505960000"
          },
          {
            "tcp_stream": 887,
            "frame_number": 37682,
            "display_filter": "frame.number == 37682",
            "timestamp_epoch": "1545161751.067834000"
          },
          {
            "tcp_stream": 888,
            "frame_number": 37693,
            "display_filter": "frame.number == 37693",
            "timestamp_epoch": "1545161751.105847000"
          },
          {
            "tcp_stream": 888,
            "frame_number": 37695,
            "display_filter": "frame.number == 37695",
            "timestamp_epoch": "1545161751.107059000"
          },
          {
            "tcp_stream": 889,
            "frame_number": 37710,
            "display_filter": "frame.number == 37710",
            "timestamp_epoch": "1545161751.146508000"
          },
          {
            "tcp_stream": 892,
            "frame_number": 37737,
            "display_filter": "frame.number == 37737",
            "timestamp_epoch": "1545161752.106692000"
          },
          {
            "tcp_stream": 894,
            "frame_number": 37774,
            "display_filter": "frame.number == 37774",
            "timestamp_epoch": "1545161752.726723000"
          },
          {
            "tcp_stream": 897,
            "frame_number": 37812,
            "display_filter": "frame.number == 37812",
            "timestamp_epoch": "1545161752.898365000"
          },
          {
            "tcp_stream": 898,
            "frame_number": 37824,
            "display_filter": "frame.number == 37824",
            "timestamp_epoch": "1545161752.935933000"
          }
        ]
      },
      {
        "id": "identity-a87b75e9bf23f213d0632388",
        "type": "identity",
        "label": "account: emelda.goodson",
        "value": "emelda.goodson",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [
          "172.16.3.114"
        ],
        "identity_type": "account",
        "frame_evidence": [
          {
            "tcp_stream": 1209,
            "frame_number": 51171,
            "display_filter": "frame.number == 51171",
            "timestamp_epoch": "1545161875.976758000"
          },
          {
            "tcp_stream": 1210,
            "frame_number": 51187,
            "display_filter": "frame.number == 51187",
            "timestamp_epoch": "1545161876.014923000"
          },
          {
            "tcp_stream": 1210,
            "frame_number": 51189,
            "display_filter": "frame.number == 51189",
            "timestamp_epoch": "1545161876.016030000"
          },
          {
            "tcp_stream": 1211,
            "frame_number": 51213,
            "display_filter": "frame.number == 51213",
            "timestamp_epoch": "1545161876.074192000"
          },
          {
            "tcp_stream": 1214,
            "frame_number": 51238,
            "display_filter": "frame.number == 51238",
            "timestamp_epoch": "1545161876.406037000"
          },
          {
            "tcp_stream": 1226,
            "frame_number": 51409,
            "display_filter": "frame.number == 51409",
            "timestamp_epoch": "1545161877.038177000"
          },
          {
            "tcp_stream": 1229,
            "frame_number": 51447,
            "display_filter": "frame.number == 51447",
            "timestamp_epoch": "1545161877.176038000"
          },
          {
            "tcp_stream": 1230,
            "frame_number": 51458,
            "display_filter": "frame.number == 51458",
            "timestamp_epoch": "1545161877.233565000"
          }
        ]
      },
      {
        "id": "identity-021e31394395f28ed13dd972",
        "type": "identity",
        "label": "account: goodson-win-pc$",
        "value": "goodson-win-pc$",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [
          "172.16.3.114"
        ],
        "identity_type": "account",
        "frame_evidence": [
          {
            "tcp_stream": 788,
            "frame_number": 34672,
            "display_filter": "frame.number == 34672",
            "timestamp_epoch": "1545161717.445526000"
          },
          {
            "tcp_stream": 789,
            "frame_number": 34692,
            "display_filter": "frame.number == 34692",
            "timestamp_epoch": "1545161717.505796000"
          },
          {
            "tcp_stream": 789,
            "frame_number": 34694,
            "display_filter": "frame.number == 34694",
            "timestamp_epoch": "1545161717.506911000"
          },
          {
            "tcp_stream": 791,
            "frame_number": 34712,
            "display_filter": "frame.number == 34712",
            "timestamp_epoch": "1545161717.518589000"
          },
          {
            "tcp_stream": 796,
            "frame_number": 34785,
            "display_filter": "frame.number == 34785",
            "timestamp_epoch": "1545161717.757226000"
          },
          {
            "tcp_stream": 797,
            "frame_number": 34794,
            "display_filter": "frame.number == 34794",
            "timestamp_epoch": "1545161717.815663000"
          },
          {
            "tcp_stream": 797,
            "frame_number": 34796,
            "display_filter": "frame.number == 34796",
            "timestamp_epoch": "1545161717.816769000"
          },
          {
            "tcp_stream": 798,
            "frame_number": 34808,
            "display_filter": "frame.number == 34808",
            "timestamp_epoch": "1545161717.856950000"
          },
          {
            "tcp_stream": 807,
            "frame_number": 35037,
            "display_filter": "frame.number == 35037",
            "timestamp_epoch": "1545161718.757091000"
          },
          {
            "tcp_stream": 810,
            "frame_number": 35069,
            "display_filter": "frame.number == 35069",
            "timestamp_epoch": "1545161718.797681000"
          },
          {
            "tcp_stream": 812,
            "frame_number": 35135,
            "display_filter": "frame.number == 35135",
            "timestamp_epoch": "1545161718.906437000"
          },
          {
            "tcp_stream": 818,
            "frame_number": 35185,
            "display_filter": "frame.number == 35185",
            "timestamp_epoch": "1545161719.030365000"
          },
          {
            "tcp_stream": 820,
            "frame_number": 35206,
            "display_filter": "frame.number == 35206",
            "timestamp_epoch": "1545161719.099303000"
          },
          {
            "tcp_stream": 850,
            "frame_number": 36432,
            "display_filter": "frame.number == 36432",
            "timestamp_epoch": "1545161726.785605000"
          },
          {
            "tcp_stream": 851,
            "frame_number": 36440,
            "display_filter": "frame.number == 36440",
            "timestamp_epoch": "1545161726.845562000"
          },
          {
            "tcp_stream": 851,
            "frame_number": 36442,
            "display_filter": "frame.number == 36442",
            "timestamp_epoch": "1545161726.846666000"
          },
          {
            "tcp_stream": 852,
            "frame_number": 36453,
            "display_filter": "frame.number == 36453",
            "timestamp_epoch": "1545161726.887057000"
          },
          {
            "tcp_stream": 977,
            "frame_number": 41714,
            "display_filter": "frame.number == 41714",
            "timestamp_epoch": "1545161776.976832000"
          },
          {
            "tcp_stream": 978,
            "frame_number": 41725,
            "display_filter": "frame.number == 41725",
            "timestamp_epoch": "1545161777.034306000"
          },
          {
            "tcp_stream": 1602,
            "frame_number": 75937,
            "display_filter": "frame.number == 75937",
            "timestamp_epoch": "1545162616.800632000"
          }
        ]
      },
      {
        "id": "identity-605ab5059520bb18b47f66e7",
        "type": "identity",
        "label": "account: odell.palumbo",
        "value": "odell.palumbo",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [
          "172.16.3.189"
        ],
        "identity_type": "account",
        "frame_evidence": [
          {
            "tcp_stream": 84,
            "frame_number": 3142,
            "display_filter": "frame.number == 3142",
            "timestamp_epoch": "1545161609.655638000"
          },
          {
            "tcp_stream": 85,
            "frame_number": 3149,
            "display_filter": "frame.number == 3149",
            "timestamp_epoch": "1545161609.695640000"
          },
          {
            "tcp_stream": 85,
            "frame_number": 3151,
            "display_filter": "frame.number == 3151",
            "timestamp_epoch": "1545161609.696746000"
          },
          {
            "tcp_stream": 86,
            "frame_number": 3162,
            "display_filter": "frame.number == 3162",
            "timestamp_epoch": "1545161609.756098000"
          },
          {
            "tcp_stream": 88,
            "frame_number": 3182,
            "display_filter": "frame.number == 3182",
            "timestamp_epoch": "1545161612.216899000"
          },
          {
            "tcp_stream": 90,
            "frame_number": 3213,
            "display_filter": "frame.number == 3213",
            "timestamp_epoch": "1545161612.607214000"
          },
          {
            "tcp_stream": 93,
            "frame_number": 3249,
            "display_filter": "frame.number == 3249",
            "timestamp_epoch": "1545161612.748361000"
          },
          {
            "tcp_stream": 94,
            "frame_number": 3260,
            "display_filter": "frame.number == 3260",
            "timestamp_epoch": "1545161612.824393000"
          }
        ]
      },
      {
        "id": "identity-2277e24e9002575666c185cc",
        "type": "identity",
        "label": "account: palumbo-win-pc$",
        "value": "palumbo-win-pc$",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [
          "172.16.3.189"
        ],
        "identity_type": "account",
        "frame_evidence": [
          {
            "tcp_stream": 54,
            "frame_number": 2749,
            "display_filter": "frame.number == 2749",
            "timestamp_epoch": "1545161555.557465000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 2757,
            "display_filter": "frame.number == 2757",
            "timestamp_epoch": "1545161555.617364000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 2759,
            "display_filter": "frame.number == 2759",
            "timestamp_epoch": "1545161555.618549000"
          },
          {
            "tcp_stream": 56,
            "frame_number": 2770,
            "display_filter": "frame.number == 2770",
            "timestamp_epoch": "1545161555.659242000"
          },
          {
            "tcp_stream": 59,
            "frame_number": 2803,
            "display_filter": "frame.number == 2803",
            "timestamp_epoch": "1545161555.919802000"
          },
          {
            "tcp_stream": 60,
            "frame_number": 2811,
            "display_filter": "frame.number == 2811",
            "timestamp_epoch": "1545161555.977938000"
          },
          {
            "tcp_stream": 60,
            "frame_number": 2813,
            "display_filter": "frame.number == 2813",
            "timestamp_epoch": "1545161555.978996000"
          },
          {
            "tcp_stream": 61,
            "frame_number": 2825,
            "display_filter": "frame.number == 2825",
            "timestamp_epoch": "1545161556.018824000"
          },
          {
            "tcp_stream": 64,
            "frame_number": 2895,
            "display_filter": "frame.number == 2895",
            "timestamp_epoch": "1545161556.868048000"
          },
          {
            "tcp_stream": 65,
            "frame_number": 2910,
            "display_filter": "frame.number == 2910",
            "timestamp_epoch": "1545161556.886517000"
          },
          {
            "tcp_stream": 68,
            "frame_number": 2956,
            "display_filter": "frame.number == 2956",
            "timestamp_epoch": "1545161557.030542000"
          },
          {
            "tcp_stream": 71,
            "frame_number": 2978,
            "display_filter": "frame.number == 2978",
            "timestamp_epoch": "1545161557.118327000"
          },
          {
            "tcp_stream": 72,
            "frame_number": 2989,
            "display_filter": "frame.number == 2989",
            "timestamp_epoch": "1545161557.175835000"
          },
          {
            "tcp_stream": 76,
            "frame_number": 3078,
            "display_filter": "frame.number == 3078",
            "timestamp_epoch": "1545161565.146133000"
          },
          {
            "tcp_stream": 77,
            "frame_number": 3086,
            "display_filter": "frame.number == 3086",
            "timestamp_epoch": "1545161565.206147000"
          },
          {
            "tcp_stream": 77,
            "frame_number": 3088,
            "display_filter": "frame.number == 3088",
            "timestamp_epoch": "1545161565.207238000"
          },
          {
            "tcp_stream": 78,
            "frame_number": 3099,
            "display_filter": "frame.number == 3099",
            "timestamp_epoch": "1545161565.247309000"
          },
          {
            "tcp_stream": 96,
            "frame_number": 3299,
            "display_filter": "frame.number == 3299",
            "timestamp_epoch": "1545161615.076959000"
          },
          {
            "tcp_stream": 97,
            "frame_number": 3311,
            "display_filter": "frame.number == 3311",
            "timestamp_epoch": "1545161615.135407000"
          },
          {
            "tcp_stream": 1574,
            "frame_number": 74708,
            "display_filter": "frame.number == 74708",
            "timestamp_epoch": "1545162455.321875000"
          }
        ]
      },
      {
        "id": "identity-2bfa2036b434d1487242ad68",
        "type": "identity",
        "label": "account: varner-win-pc$",
        "value": "varner-win-pc$",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [
          "172.16.3.133"
        ],
        "identity_type": "account",
        "frame_evidence": [
          {
            "tcp_stream": 100,
            "frame_number": 3380,
            "display_filter": "frame.number == 3380",
            "timestamp_epoch": "1545161626.366579000"
          },
          {
            "tcp_stream": 101,
            "frame_number": 3388,
            "display_filter": "frame.number == 3388",
            "timestamp_epoch": "1545161626.432031000"
          },
          {
            "tcp_stream": 101,
            "frame_number": 3390,
            "display_filter": "frame.number == 3390",
            "timestamp_epoch": "1545161626.433116000"
          },
          {
            "tcp_stream": 102,
            "frame_number": 3402,
            "display_filter": "frame.number == 3402",
            "timestamp_epoch": "1545161626.468136000"
          },
          {
            "tcp_stream": 105,
            "frame_number": 3441,
            "display_filter": "frame.number == 3441",
            "timestamp_epoch": "1545161627.066853000"
          },
          {
            "tcp_stream": 106,
            "frame_number": 3450,
            "display_filter": "frame.number == 3450",
            "timestamp_epoch": "1545161627.126858000"
          },
          {
            "tcp_stream": 106,
            "frame_number": 3453,
            "display_filter": "frame.number == 3453",
            "timestamp_epoch": "1545161627.146984000"
          },
          {
            "tcp_stream": 107,
            "frame_number": 3465,
            "display_filter": "frame.number == 3465",
            "timestamp_epoch": "1545161627.188129000"
          },
          {
            "tcp_stream": 129,
            "frame_number": 4501,
            "display_filter": "frame.number == 4501",
            "timestamp_epoch": "1545161628.057465000"
          },
          {
            "tcp_stream": 133,
            "frame_number": 4571,
            "display_filter": "frame.number == 4571",
            "timestamp_epoch": "1545161628.099883000"
          },
          {
            "tcp_stream": 135,
            "frame_number": 4677,
            "display_filter": "frame.number == 4677",
            "timestamp_epoch": "1545161628.223394000"
          },
          {
            "tcp_stream": 144,
            "frame_number": 4819,
            "display_filter": "frame.number == 4819",
            "timestamp_epoch": "1545161628.320209000"
          },
          {
            "tcp_stream": 145,
            "frame_number": 4871,
            "display_filter": "frame.number == 4871",
            "timestamp_epoch": "1545161628.367509000"
          },
          {
            "tcp_stream": 187,
            "frame_number": 12721,
            "display_filter": "frame.number == 12721",
            "timestamp_epoch": "1545161636.307219000"
          },
          {
            "tcp_stream": 188,
            "frame_number": 12729,
            "display_filter": "frame.number == 12729",
            "timestamp_epoch": "1545161636.368001000"
          },
          {
            "tcp_stream": 188,
            "frame_number": 12731,
            "display_filter": "frame.number == 12731",
            "timestamp_epoch": "1545161636.369074000"
          },
          {
            "tcp_stream": 189,
            "frame_number": 12742,
            "display_filter": "frame.number == 12742",
            "timestamp_epoch": "1545161636.409004000"
          },
          {
            "tcp_stream": 686,
            "frame_number": 31390,
            "display_filter": "frame.number == 31390",
            "timestamp_epoch": "1545161685.887455000"
          },
          {
            "tcp_stream": 687,
            "frame_number": 31400,
            "display_filter": "frame.number == 31400",
            "timestamp_epoch": "1545161685.927660000"
          },
          {
            "tcp_stream": 1593,
            "frame_number": 75759,
            "display_filter": "frame.number == 75759",
            "timestamp_epoch": "1545162525.831224000"
          }
        ]
      },
      {
        "id": "identity-f51cf19b82dffef560fa84d0",
        "type": "identity",
        "label": "domain: EGGNOGSOUP",
        "value": "EGGNOGSOUP",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [
          "172.16.3.114",
          "172.16.3.133",
          "172.16.3.189"
        ],
        "identity_type": "domain",
        "frame_evidence": [
          {
            "tcp_stream": 68,
            "frame_number": 2956,
            "display_filter": "frame.number == 2956",
            "timestamp_epoch": "1545161557.030542000"
          },
          {
            "tcp_stream": 135,
            "frame_number": 4677,
            "display_filter": "frame.number == 4677",
            "timestamp_epoch": "1545161628.223394000"
          },
          {
            "tcp_stream": 812,
            "frame_number": 35135,
            "display_filter": "frame.number == 35135",
            "timestamp_epoch": "1545161718.906437000"
          }
        ]
      },
      {
        "id": "identity-0d21591b5cc96ad8b1aa2260",
        "type": "identity",
        "label": "hostname: amazon-7f8992614",
        "value": "amazon-7f8992614",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [],
        "identity_type": "hostname",
        "frame_evidence": [
          {
            "udp_stream": 0,
            "frame_number": 32364,
            "display_filter": "frame.number == 32364",
            "timestamp_epoch": "1545161701.402118000"
          }
        ]
      },
      {
        "id": "identity-58efc2c9953b932a3b68f4bf",
        "type": "identity",
        "label": "hostname: android-aa420602c94e4828",
        "value": "android-aa420602c94e4828",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [],
        "identity_type": "hostname",
        "frame_evidence": [
          {
            "udp_stream": 0,
            "frame_number": 41522,
            "display_filter": "frame.number == 41522",
            "timestamp_epoch": "1545161770.627628000"
          }
        ]
      },
      {
        "id": "identity-7ffc80adaa9659cef0fdba57",
        "type": "identity",
        "label": "hostname: EGGNOGSOUP-DC",
        "value": "EGGNOGSOUP-DC",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [
          "172.16.3.2"
        ],
        "identity_type": "hostname",
        "frame_evidence": [
          {
            "udp_stream": 538,
            "frame_number": 37126,
            "display_filter": "frame.number == 37126",
            "timestamp_epoch": "1545161735.620718000"
          },
          {
            "udp_stream": 538,
            "frame_number": 74766,
            "display_filter": "frame.number == 74766",
            "timestamp_epoch": "1545162456.437654000"
          }
        ]
      },
      {
        "id": "identity-5c702168df363fbd121e07fd",
        "type": "identity",
        "label": "hostname: Goodson-Win-PC",
        "value": "Goodson-Win-PC",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [
          "172.16.3.114"
        ],
        "identity_type": "hostname",
        "frame_evidence": [
          {
            "udp_stream": 0,
            "frame_number": 34516,
            "display_filter": "frame.number == 34516",
            "timestamp_epoch": "1545161716.890152000"
          },
          {
            "udp_stream": 518,
            "frame_number": 35612,
            "display_filter": "frame.number == 35612",
            "timestamp_epoch": "1545161720.102458000"
          },
          {
            "udp_stream": 491,
            "frame_number": 34523,
            "display_filter": "frame.number == 34523",
            "timestamp_epoch": "1545161716.968773000"
          },
          {
            "udp_stream": 491,
            "frame_number": 34525,
            "display_filter": "frame.number == 34525",
            "timestamp_epoch": "1545161716.968775000"
          },
          {
            "udp_stream": 491,
            "frame_number": 34526,
            "display_filter": "frame.number == 34526",
            "timestamp_epoch": "1545161716.991022000"
          },
          {
            "udp_stream": 491,
            "frame_number": 34528,
            "display_filter": "frame.number == 34528",
            "timestamp_epoch": "1545161716.991209000"
          },
          {
            "udp_stream": 491,
            "frame_number": 34765,
            "display_filter": "frame.number == 34765",
            "timestamp_epoch": "1545161717.717412000"
          },
          {
            "udp_stream": 491,
            "frame_number": 34766,
            "display_filter": "frame.number == 34766",
            "timestamp_epoch": "1545161717.718282000"
          },
          {
            "udp_stream": 491,
            "frame_number": 34781,
            "display_filter": "frame.number == 34781",
            "timestamp_epoch": "1545161717.740682000"
          },
          {
            "udp_stream": 491,
            "frame_number": 34783,
            "display_filter": "frame.number == 34783",
            "timestamp_epoch": "1545161717.740857000"
          },
          {
            "udp_stream": 491,
            "frame_number": 34933,
            "display_filter": "frame.number == 34933",
            "timestamp_epoch": "1545161718.468425000"
          },
          {
            "udp_stream": 491,
            "frame_number": 34935,
            "display_filter": "frame.number == 34935",
            "timestamp_epoch": "1545161718.468427000"
          },
          {
            "udp_stream": 491,
            "frame_number": 34936,
            "display_filter": "frame.number == 34936",
            "timestamp_epoch": "1545161718.490797000"
          },
          {
            "udp_stream": 491,
            "frame_number": 34938,
            "display_filter": "frame.number == 34938",
            "timestamp_epoch": "1545161718.490973000"
          },
          {
            "tcp_stream": 812,
            "frame_number": 35135,
            "display_filter": "frame.number == 35135",
            "timestamp_epoch": "1545161718.906437000"
          },
          {
            "udp_stream": 491,
            "frame_number": 35251,
            "display_filter": "frame.number == 35251",
            "timestamp_epoch": "1545161719.217256000"
          },
          {
            "udp_stream": 491,
            "frame_number": 35253,
            "display_filter": "frame.number == 35253",
            "timestamp_epoch": "1545161719.220462000"
          },
          {
            "udp_stream": 491,
            "frame_number": 35256,
            "display_filter": "frame.number == 35256",
            "timestamp_epoch": "1545161719.240389000"
          },
          {
            "udp_stream": 491,
            "frame_number": 35259,
            "display_filter": "frame.number == 35259",
            "timestamp_epoch": "1545161719.243063000"
          }
        ]
      },
      {
        "id": "identity-e1783f36ec893bc5fc02faeb",
        "type": "identity",
        "label": "hostname: iPhone",
        "value": "iPhone",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [],
        "identity_type": "hostname",
        "frame_evidence": [
          {
            "udp_stream": 0,
            "frame_number": 29338,
            "display_filter": "frame.number == 29338",
            "timestamp_epoch": "1545161673.807310000"
          }
        ]
      },
      {
        "id": "identity-7e27d7b49919251836855169",
        "type": "identity",
        "label": "hostname: MACBOOKPRO-8843",
        "value": "MACBOOKPRO-8843",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [
          "172.16.3.122"
        ],
        "identity_type": "hostname",
        "frame_evidence": [
          {
            "udp_stream": 111,
            "frame_number": 12803,
            "display_filter": "frame.number == 12803",
            "timestamp_epoch": "1545161642.887629000"
          },
          {
            "udp_stream": 111,
            "frame_number": 12806,
            "display_filter": "frame.number == 12806",
            "timestamp_epoch": "1545161642.908645000"
          },
          {
            "udp_stream": 111,
            "frame_number": 12922,
            "display_filter": "frame.number == 12922",
            "timestamp_epoch": "1545161644.110076000"
          },
          {
            "udp_stream": 111,
            "frame_number": 12923,
            "display_filter": "frame.number == 12923",
            "timestamp_epoch": "1545161644.131165000"
          },
          {
            "udp_stream": 111,
            "frame_number": 12973,
            "display_filter": "frame.number == 12973",
            "timestamp_epoch": "1545161645.605411000"
          },
          {
            "udp_stream": 111,
            "frame_number": 12974,
            "display_filter": "frame.number == 12974",
            "timestamp_epoch": "1545161645.626508000"
          },
          {
            "udp_stream": 873,
            "frame_number": 74601,
            "display_filter": "frame.number == 74601",
            "timestamp_epoch": "1545162151.222809000"
          },
          {
            "udp_stream": 873,
            "frame_number": 74602,
            "display_filter": "frame.number == 74602",
            "timestamp_epoch": "1545162151.236075000"
          }
        ]
      },
      {
        "id": "identity-c9809c7a1c907a38885d11d4",
        "type": "identity",
        "label": "hostname: Padme-Computer",
        "value": "Padme-Computer",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [],
        "identity_type": "hostname",
        "frame_evidence": [
          {
            "udp_stream": 0,
            "frame_number": 63607,
            "display_filter": "frame.number == 63607",
            "timestamp_epoch": "1545162014.728433000"
          },
          {
            "udp_stream": 0,
            "frame_number": 63609,
            "display_filter": "frame.number == 63609",
            "timestamp_epoch": "1545162014.831219000"
          }
        ]
      },
      {
        "id": "identity-cc897b454ab7ede5d04dcf0e",
        "type": "identity",
        "label": "hostname: Palumbo-Win-PC",
        "value": "Palumbo-Win-PC",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [
          "172.16.3.189"
        ],
        "identity_type": "hostname",
        "frame_evidence": [
          {
            "udp_stream": 0,
            "frame_number": 2707,
            "display_filter": "frame.number == 2707",
            "timestamp_epoch": "1545161554.988236000"
          },
          {
            "udp_stream": 48,
            "frame_number": 3021,
            "display_filter": "frame.number == 3021",
            "timestamp_epoch": "1545161558.276649000"
          },
          {
            "udp_stream": 48,
            "frame_number": 3332,
            "display_filter": "frame.number == 3332",
            "timestamp_epoch": "1545161625.791262000"
          },
          {
            "udp_stream": 48,
            "frame_number": 76300,
            "display_filter": "frame.number == 76300",
            "timestamp_epoch": "1545162744.660989000"
          },
          {
            "udp_stream": 37,
            "frame_number": 2714,
            "display_filter": "frame.number == 2714",
            "timestamp_epoch": "1545161555.063425000"
          },
          {
            "udp_stream": 37,
            "frame_number": 2716,
            "display_filter": "frame.number == 2716",
            "timestamp_epoch": "1545161555.064536000"
          },
          {
            "udp_stream": 37,
            "frame_number": 2717,
            "display_filter": "frame.number == 2717",
            "timestamp_epoch": "1545161555.082283000"
          },
          {
            "udp_stream": 37,
            "frame_number": 2719,
            "display_filter": "frame.number == 2719",
            "timestamp_epoch": "1545161555.083445000"
          },
          {
            "udp_stream": 37,
            "frame_number": 2786,
            "display_filter": "frame.number == 2786",
            "timestamp_epoch": "1545161555.813496000"
          },
          {
            "udp_stream": 37,
            "frame_number": 2788,
            "display_filter": "frame.number == 2788",
            "timestamp_epoch": "1545161555.816806000"
          },
          {
            "udp_stream": 37,
            "frame_number": 2792,
            "display_filter": "frame.number == 2792",
            "timestamp_epoch": "1545161555.832537000"
          },
          {
            "udp_stream": 37,
            "frame_number": 2794,
            "display_filter": "frame.number == 2794",
            "timestamp_epoch": "1545161555.832721000"
          },
          {
            "udp_stream": 37,
            "frame_number": 2867,
            "display_filter": "frame.number == 2867",
            "timestamp_epoch": "1545161556.563763000"
          },
          {
            "udp_stream": 37,
            "frame_number": 2869,
            "display_filter": "frame.number == 2869",
            "timestamp_epoch": "1545161556.563765000"
          },
          {
            "udp_stream": 37,
            "frame_number": 2870,
            "display_filter": "frame.number == 2870",
            "timestamp_epoch": "1545161556.581958000"
          },
          {
            "udp_stream": 37,
            "frame_number": 2872,
            "display_filter": "frame.number == 2872",
            "timestamp_epoch": "1545161556.582139000"
          },
          {
            "tcp_stream": 68,
            "frame_number": 2956,
            "display_filter": "frame.number == 2956",
            "timestamp_epoch": "1545161557.030542000"
          },
          {
            "udp_stream": 37,
            "frame_number": 3010,
            "display_filter": "frame.number == 3010",
            "timestamp_epoch": "1545161557.313498000"
          },
          {
            "udp_stream": 37,
            "frame_number": 3012,
            "display_filter": "frame.number == 3012",
            "timestamp_epoch": "1545161557.313500000"
          },
          {
            "udp_stream": 37,
            "frame_number": 3013,
            "display_filter": "frame.number == 3013",
            "timestamp_epoch": "1545161557.331733000"
          }
        ]
      },
      {
        "id": "identity-98777ee405da253ab2149447",
        "type": "identity",
        "label": "hostname: Varner-Win-PC",
        "value": "Varner-Win-PC",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [
          "172.16.3.133"
        ],
        "identity_type": "hostname",
        "frame_evidence": [
          {
            "udp_stream": 0,
            "frame_number": 3336,
            "display_filter": "frame.number == 3336",
            "timestamp_epoch": "1545161625.818470000"
          },
          {
            "udp_stream": 82,
            "frame_number": 6864,
            "display_filter": "frame.number == 6864",
            "timestamp_epoch": "1545161629.029771000"
          },
          {
            "udp_stream": 82,
            "frame_number": 47132,
            "display_filter": "frame.number == 47132",
            "timestamp_epoch": "1545161833.597328000"
          },
          {
            "udp_stream": 55,
            "frame_number": 3341,
            "display_filter": "frame.number == 3341",
            "timestamp_epoch": "1545161625.884528000"
          },
          {
            "udp_stream": 55,
            "frame_number": 3343,
            "display_filter": "frame.number == 3343",
            "timestamp_epoch": "1545161625.885366000"
          },
          {
            "udp_stream": 55,
            "frame_number": 3345,
            "display_filter": "frame.number == 3345",
            "timestamp_epoch": "1545161625.905386000"
          },
          {
            "udp_stream": 55,
            "frame_number": 3347,
            "display_filter": "frame.number == 3347",
            "timestamp_epoch": "1545161625.905547000"
          },
          {
            "udp_stream": 55,
            "frame_number": 3418,
            "display_filter": "frame.number == 3418",
            "timestamp_epoch": "1545161626.634968000"
          },
          {
            "udp_stream": 55,
            "frame_number": 3420,
            "display_filter": "frame.number == 3420",
            "timestamp_epoch": "1545161626.635967000"
          },
          {
            "udp_stream": 55,
            "frame_number": 3421,
            "display_filter": "frame.number == 3421",
            "timestamp_epoch": "1545161626.655928000"
          },
          {
            "udp_stream": 55,
            "frame_number": 3423,
            "display_filter": "frame.number == 3423",
            "timestamp_epoch": "1545161626.656076000"
          },
          {
            "udp_stream": 55,
            "frame_number": 3530,
            "display_filter": "frame.number == 3530",
            "timestamp_epoch": "1545161627.383883000"
          },
          {
            "udp_stream": 55,
            "frame_number": 3532,
            "display_filter": "frame.number == 3532",
            "timestamp_epoch": "1545161627.384821000"
          },
          {
            "udp_stream": 55,
            "frame_number": 3533,
            "display_filter": "frame.number == 3533",
            "timestamp_epoch": "1545161627.404583000"
          },
          {
            "udp_stream": 55,
            "frame_number": 3535,
            "display_filter": "frame.number == 3535",
            "timestamp_epoch": "1545161627.405275000"
          },
          {
            "udp_stream": 55,
            "frame_number": 4608,
            "display_filter": "frame.number == 4608",
            "timestamp_epoch": "1545161628.133765000"
          },
          {
            "udp_stream": 55,
            "frame_number": 4614,
            "display_filter": "frame.number == 4614",
            "timestamp_epoch": "1545161628.135444000"
          },
          {
            "udp_stream": 55,
            "frame_number": 4628,
            "display_filter": "frame.number == 4628",
            "timestamp_epoch": "1545161628.154552000"
          },
          {
            "udp_stream": 55,
            "frame_number": 4634,
            "display_filter": "frame.number == 4634",
            "timestamp_epoch": "1545161628.155473000"
          },
          {
            "tcp_stream": 135,
            "frame_number": 4677,
            "display_filter": "frame.number == 4677",
            "timestamp_epoch": "1545161628.223394000"
          }
        ]
      },
      {
        "id": "identity-d100f749d47db1b8c0e7762a",
        "type": "identity",
        "label": "hostname: Winfords-MBP",
        "value": "Winfords-MBP",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [],
        "identity_type": "hostname",
        "frame_evidence": [
          {
            "udp_stream": 0,
            "frame_number": 12759,
            "display_filter": "frame.number == 12759",
            "timestamp_epoch": "1545161639.602601000"
          }
        ]
      },
      {
        "id": "identity-a81558aa9743a6480758e185",
        "type": "identity",
        "label": "netbios-group: EGGNOGSOUP",
        "value": "EGGNOGSOUP",
        "source": "deterministic-pcap-analysis",
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "ip_addresses": [],
        "identity_type": "netbios-group",
        "frame_evidence": [
          {
            "udp_stream": 37,
            "frame_number": 2715,
            "display_filter": "frame.number == 2715",
            "timestamp_epoch": "1545161555.064535000"
          },
          {
            "udp_stream": 37,
            "frame_number": 2718,
            "display_filter": "frame.number == 2718",
            "timestamp_epoch": "1545161555.082727000"
          },
          {
            "udp_stream": 37,
            "frame_number": 2787,
            "display_filter": "frame.number == 2787",
            "timestamp_epoch": "1545161555.816805000"
          },
          {
            "udp_stream": 37,
            "frame_number": 2793,
            "display_filter": "frame.number == 2793",
            "timestamp_epoch": "1545161555.832538000"
          },
          {
            "udp_stream": 37,
            "frame_number": 2868,
            "display_filter": "frame.number == 2868",
            "timestamp_epoch": "1545161556.563765000"
          },
          {
            "udp_stream": 37,
            "frame_number": 2871,
            "display_filter": "frame.number == 2871",
            "timestamp_epoch": "1545161556.582138000"
          },
          {
            "udp_stream": 37,
            "frame_number": 3011,
            "display_filter": "frame.number == 3011",
            "timestamp_epoch": "1545161557.313499000"
          },
          {
            "udp_stream": 37,
            "frame_number": 3014,
            "display_filter": "frame.number == 3014",
            "timestamp_epoch": "1545161557.331887000"
          },
          {
            "udp_stream": 55,
            "frame_number": 3342,
            "display_filter": "frame.number == 3342",
            "timestamp_epoch": "1545161625.884530000"
          },
          {
            "udp_stream": 55,
            "frame_number": 3346,
            "display_filter": "frame.number == 3346",
            "timestamp_epoch": "1545161625.905546000"
          },
          {
            "udp_stream": 55,
            "frame_number": 3419,
            "display_filter": "frame.number == 3419",
            "timestamp_epoch": "1545161626.635965000"
          },
          {
            "udp_stream": 55,
            "frame_number": 3422,
            "display_filter": "frame.number == 3422",
            "timestamp_epoch": "1545161626.656075000"
          },
          {
            "udp_stream": 55,
            "frame_number": 3531,
            "display_filter": "frame.number == 3531",
            "timestamp_epoch": "1545161627.383884000"
          },
          {
            "udp_stream": 55,
            "frame_number": 3534,
            "display_filter": "frame.number == 3534",
            "timestamp_epoch": "1545161627.405274000"
          },
          {
            "udp_stream": 55,
            "frame_number": 4633,
            "display_filter": "frame.number == 4633",
            "timestamp_epoch": "1545161628.155374000"
          },
          {
            "udp_stream": 491,
            "frame_number": 34524,
            "display_filter": "frame.number == 34524",
            "timestamp_epoch": "1545161716.968774000"
          },
          {
            "udp_stream": 491,
            "frame_number": 34527,
            "display_filter": "frame.number == 34527",
            "timestamp_epoch": "1545161716.991208000"
          },
          {
            "udp_stream": 491,
            "frame_number": 34782,
            "display_filter": "frame.number == 34782",
            "timestamp_epoch": "1545161717.740683000"
          },
          {
            "udp_stream": 491,
            "frame_number": 34934,
            "display_filter": "frame.number == 34934",
            "timestamp_epoch": "1545161718.468427000"
          },
          {
            "udp_stream": 491,
            "frame_number": 34937,
            "display_filter": "frame.number == 34937",
            "timestamp_epoch": "1545161718.490799000"
          }
        ]
      },
      {
        "id": "artifact-4da70653da5ab2880ac2f666",
        "md5": "869155d0d474362357501876ae8cc61c",
        "sha1": "972a6bbba698dc771275a2387ec473ff4226a172",
        "type": "file-artifact",
        "label": "bridge3.266.0_en.html",
        "value": "f80a291952b00aeec16baeb2213562f21a7c066cc347a27992080f3f933f9329",
        "sha256": "f80a291952b00aeec16baeb2213562f21a7c066cc347a27992080f3f933f9329",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://imasdk.googleapis.com/js/core/bridge3.266.0_en.html",
            "client_ip": "172.16.3.122",
            "server_ip": "172.217.1.10",
            "tcp_stream": 297,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 19010,
            "response_frame": 19502
          }
        ],
        "size_bytes": 532987,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/html",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 297,
            "frame_number": 19502,
            "display_filter": "frame.number == 19502",
            "timestamp_epoch": "1545161652.773211000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-991d6c70b7e68e439dccbab8",
        "md5": "2943a4a426f8f7a26834ff6709dfbb44",
        "sha1": "2857c6d044145499c73ecde7f7a6e0049c57bd9c",
        "type": "file-artifact",
        "label": "Carambola_layer_136.min.js",
        "value": "50a659a2aa9e8bb6f5816079a0260a395ba58fd79644b752ce7d110797369309",
        "sha256": "50a659a2aa9e8bb6f5816079a0260a395ba58fd79644b752ce7d110797369309",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://cdata.carambo.la/Layer/InImage/Prod/cbola_platform/version_2.22.3.4/js/Carambola_layer_136.min.js",
            "client_ip": "172.16.3.122",
            "server_ip": "192.229.173.42",
            "tcp_stream": 220,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 14181,
            "response_frame": 14567
          }
        ],
        "size_bytes": 455954,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 220,
            "frame_number": 14567,
            "display_filter": "frame.number == 14567",
            "timestamp_epoch": "1545161649.341793000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-f173a7b8d5a22841d4841cbb",
        "md5": "71b11a6e8d96220821830e1265b16209",
        "sha1": "6b1e53042e71bd285a0252213c7014446f86a468",
        "type": "file-artifact",
        "label": "ijs_all_modules_cjs_min_71b11a6e8d96220821830e1265b16209.js",
        "value": "4ae13537e762b87532575cd0b68f58cd2d9def152b2a3cb9b4ba1119d9cc7fcd",
        "sha256": "4ae13537e762b87532575cd0b68f58cd2d9def152b2a3cb9b4ba1119d9cc7fcd",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://assets.bounceexchange.com/assets/tags/versioned/ijs_all_modules_cjs_min_71b11a6e8d96220821830e1265b16209.js",
            "client_ip": "172.16.3.122",
            "server_ip": "54.192.18.51",
            "tcp_stream": 279,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 17183,
            "response_frame": 17568
          }
        ],
        "size_bytes": 429886,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 279,
            "frame_number": 17568,
            "display_filter": "frame.number == 17568",
            "timestamp_epoch": "1545161651.058552000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-a4fd635155878106338f69c5",
        "md5": "1d868639af17e2b430cd8ec95aad234d",
        "sha1": "5744b353e72a51b6cb5eb7b4cd1dcaf503348c2e",
        "type": "file-artifact",
        "label": "gtm.js%3fid=GTM-K8GZZJG&l=dataLayer",
        "value": "7a52e16aa8b4482fbb1e7703857a9a8d81e34287ed1b9a16a8b9d7dfc338ec14",
        "sha256": "7a52e16aa8b4482fbb1e7703857a9a8d81e34287ed1b9a16a8b9d7dfc338ec14",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.googletagmanager.com/gtm.js?id=GTM-K8GZZJG&l=dataLayer",
            "client_ip": "172.16.3.122",
            "server_ip": "172.217.1.8",
            "tcp_stream": 222,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 14397,
            "response_frame": 15395
          }
        ],
        "size_bytes": 418903,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 222,
            "frame_number": 15395,
            "display_filter": "frame.number == 15395",
            "timestamp_epoch": "1545161649.669917000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-d0c7757612b2a5509f636d31",
        "md5": "53a1842aec0c5b5966dc62f48719c031",
        "sha1": "03802d108ab6f74610f58b11861f17f25595b1af",
        "type": "file-artifact",
        "label": "sic.js",
        "value": "a3fa497722d46e94af222413942f180a93425494ebccbc5c9168fea737fd3659",
        "sha256": "a3fa497722d46e94af222413942f180a93425494ebccbc5c9168fea737fd3659",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://cdn-sic.33across.com/1/javascripts/sic.js",
            "client_ip": "172.16.3.122",
            "server_ip": "104.16.38.14",
            "tcp_stream": 382,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 21180,
            "response_frame": 21750
          }
        ],
        "size_bytes": 413649,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 382,
            "frame_number": 21750,
            "display_filter": "frame.number == 21750",
            "timestamp_epoch": "1545161654.392106000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-4e044c5d4fde1abd7d29309b",
        "md5": "de9265a90a0630fdc0a6e0aec4ab3099",
        "sha1": "bc36aeb57d52391840701097e962f8062ba70655",
        "type": "file-artifact",
        "label": "ScriptResource.axd%3fd=z7nhdzmE0x4LMLL2OfCiAVPweFtb0PflBTmazLuGqonlpR-zFXMLnzC4FnRipWVmXenAFb6BCTDEh88FB_Bqw4lse4-3C8eQw_OW4bri9xnqrLfC7FOdDgnoHQMtx-gEh9_nMvP1Xenna2F4ra5EDvFuM6ou7wnHpHqxVVk_7JgUteZjO2pS_C4C4VnLlo5P4YMdRNnCOnhOfFMuVCk9z1Nvupn81O0gyVQ0lP1Y",
        "value": "4fb1ccd3d77c33b9e8f7e709986074b1f33eb9ce7a181e2601d65304919d48b6",
        "sha256": "4fb1ccd3d77c33b9e8f7e709986074b1f33eb9ce7a181e2601d65304919d48b6",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.cityofpella.com/ScriptResource.axd?d=z7nhdzmE0x4LMLL2OfCiAVPweFtb0PflBTmazLuGqonlpR-zFXMLnzC4FnRipWVmXenAFb6BCTDEh88FB_Bqw4lse4-3C8eQw_OW4bri9xnqrLfC7FOdDgnoHQMtx-gEh9_nMvP1Xenna2F4ra5EDvFuM6ou7wnHpHqxVVk_7JgUteZjO2pS_C4C4VnLlo5P4YMdRNnCOnhOfFMuVCk9z1Nvupn81O0gyVQ0lP1YhLVH3wixBitx82lL6y-_E8Vc08h5XYqCh1SIJILyhbb947xbPyi8d3dPAcAcP8xL8C1osNjL1qjUXyG7_owH1VR4gqzfTDXvguazdz8BAXTDiDLXRioTnQluIImlEVpsqRHd1YHg8Vrw1YQC00hQkjYId4GH1aW2osPsRveMPLKShvJP2PWw0vLKyVwqiFJK2TAWRMHmO-NNVYL5tVDgfCuQ2MXimpSr1Jkj2Bocncu3OknNXchZ0XAMS7wWd6ZRkmtU9I6kYFgccDikUXNVHwQN7H7i0suHMDxvDovf1i1OSMrjaqLrKNYS7vfqHojSxInSkGud-QgH_z1dS8MNvo2hEM_LQEaBWCDaAD0d9mNKgTd5fJGAJxG4OIT-kz2tA3cC3TBozTantiHsWcR0L74E1m23F7K8wLnH2Pn_EKCFx6SEZDXPly4h7MS78hsJGVn_YvJE3tbpNSOwDDFC_WYocNc0R8x_8NcACPvp_4QVH54pdr-YWQdg81C_DKPsCXoUbq9bg_Adqke5pjK2h3EkSTgqRkrPZTECOappQUC1LNdGMdxUX3I3OY_Z2brYDid22_178gwDJLfKWsuL7xtnPwvrxAQTznmYxb8QiN74YYu1kyLTDU-aMRfNUFCxJKo1",
            "client_ip": "172.16.3.112",
            "server_ip": "208.90.188.131",
            "tcp_stream": 1292,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 53397,
            "response_frame": 53637
          }
        ],
        "size_bytes": 367185,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1292,
            "frame_number": 53637,
            "display_filter": "frame.number == 53637",
            "timestamp_epoch": "1545161903.214483000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-2aadbeea1eaeb973e3bb5f8f",
        "md5": "721fa86eddebe5885e5ae34b4d6a2d6f",
        "sha1": "ab407f1e2c736784ea1352d56084605b5c3f3f07",
        "type": "file-artifact",
        "label": "1554575563.js",
        "value": "cc9ef51ad043a2dc708a4794ac901b1b844234a33acd53f0512d00d14162baf3",
        "sha256": "cc9ef51ad043a2dc708a4794ac901b1b844234a33acd53f0512d00d14162baf3",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.cityofpella.com/1554575563.js",
            "client_ip": "172.16.3.112",
            "server_ip": "208.90.188.131",
            "tcp_stream": 1290,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 53390,
            "response_frame": 53728
          }
        ],
        "size_bytes": 324382,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1290,
            "frame_number": 53728,
            "display_filter": "frame.number == 53728",
            "timestamp_epoch": "1545161903.317817000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-5360f206434283f1c01cb0d0",
        "md5": "5d06feaf949e8c39c8fa4e0de4cde9aa",
        "sha1": "13f3f1cd283e00ab81cabc0d9926ecdb4ad5b666",
        "type": "file-artifact",
        "label": "moatad.js",
        "value": "f781e2b69d0b488e3fb82a65256743b7b3af53c2f5a40c95bc51aabddf807929",
        "sha256": "f781e2b69d0b488e3fb82a65256743b7b3af53c2f5a40c95bc51aabddf807929",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://js.moatads.com/meredith678928442552/moatad.js",
            "client_ip": "172.16.3.122",
            "server_ip": "23.74.28.34",
            "tcp_stream": 378,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 21092,
            "response_frame": 21491
          }
        ],
        "size_bytes": 300165,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 378,
            "frame_number": 21491,
            "display_filter": "frame.number == 21491",
            "timestamp_epoch": "1545161654.299164000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-ff6af9bf32dad041160515d9",
        "md5": "569d9af199b3d20ecfab9716631da1d5",
        "sha1": "04696de3f32dabe40005ab8c171fda0d26186155",
        "type": "file-artifact",
        "label": "moatad(1).js",
        "value": "12b583b1d3c2b8680f9de5f1e420f55e40c95c799e9b2426aeb35b4968d46f2c",
        "sha256": "12b583b1d3c2b8680f9de5f1e420f55e40c95c799e9b2426aeb35b4968d46f2c",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://js.moatads.com/thetradedeskv275874568748/moatad.js",
            "client_ip": "172.16.3.122",
            "server_ip": "23.74.28.24",
            "tcp_stream": 1070,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 46463,
            "response_frame": 46593
          }
        ],
        "size_bytes": 298234,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1070,
            "frame_number": 46593,
            "display_filter": "frame.number == 46593",
            "timestamp_epoch": "1545161827.876139000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-1ef2f729f1f96f9c41836ae3",
        "md5": "9b43dc898e01df565ec96dd1612192f1",
        "sha1": "e8a92673bd425137b9d6c3a33faff1a45df7aabc",
        "type": "file-artifact",
        "label": "ima3.js",
        "value": "c60daa0065982f564213fb87ebcbe3a228c6afae063cc28c32497f2807c4ff4b",
        "sha256": "c60daa0065982f564213fb87ebcbe3a228c6afae063cc28c32497f2807c4ff4b",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://imasdk.googleapis.com/js/sdkloader/ima3.js",
            "client_ip": "172.16.3.122",
            "server_ip": "172.217.1.10",
            "tcp_stream": 297,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 17781,
            "response_frame": 18145
          }
        ],
        "size_bytes": 238436,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 297,
            "frame_number": 18145,
            "display_filter": "frame.number == 18145",
            "timestamp_epoch": "1545161651.825248000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-31cc30770995093145a0a8cb",
        "md5": "27660eb9c6bf26b799b7d0de5645902c",
        "sha1": "a6e84671104e63ae401f532423ce330cbd24fc95",
        "type": "file-artifact",
        "label": "sdk.js",
        "value": "1147e185964fba78458a7ed8abdf32ca78ef2ef3e0acdc5159b696d0bb404f96",
        "sha256": "1147e185964fba78458a7ed8abdf32ca78ef2ef3e0acdc5159b696d0bb404f96",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://connect.facebook.net/en_US/sdk.js",
            "client_ip": "172.16.3.188",
            "server_ip": "31.13.80.12",
            "tcp_stream": 1035,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 45119,
            "response_frame": 45232
          }
        ],
        "size_bytes": 199144,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1035,
            "frame_number": 45232,
            "display_filter": "frame.number == 45232",
            "timestamp_epoch": "1545161806.763377000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-2e0ecb1fc69a8ce0d155962c",
        "md5": "79cfb2182e402507e29541f0d18fbe16",
        "sha1": "9b4681d78d9f30dfe79f7b44f96b76f7fbbad45a",
        "type": "file-artifact",
        "label": "prebid.min.js",
        "value": "8b659598bce8eb96dbbe1c1c89b51b9981cde715a9464cf5b7c4d3c208391002",
        "sha256": "8b659598bce8eb96dbbe1c1c89b51b9981cde715a9464cf5b7c4d3c208391002",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://cdata.carambo.la/Layer/InImage/Prod/cbola_platform/version_2.22.3.4/external/prebid.min.js",
            "client_ip": "172.16.3.122",
            "server_ip": "192.229.173.42",
            "tcp_stream": 275,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 17029,
            "response_frame": 17147
          }
        ],
        "size_bytes": 156160,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 275,
            "frame_number": 17147,
            "display_filter": "frame.number == 17147",
            "timestamp_epoch": "1545161650.778833000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-8d7f6dbb69dcccb18436eab5",
        "md5": "0f47acd11052dce85c302d1f99843fa1",
        "sha1": "2d0fc30d464f1c3a1c4f816e3f883a036fa4140a",
        "type": "file-artifact",
        "label": "dVk_hwBIaehh(1)",
        "value": "4a6ff2d1af33424fe9033c836b8e64c8361e6428e8e45d0cc14a38892941cfd6",
        "sha256": "4a6ff2d1af33424fe9033c836b8e64c8361e6428e8e45d0cc14a38892941cfd6",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.prolightphotovideo.net/dVk_hwBIaehh/",
            "client_ip": "172.16.3.133",
            "server_ip": "93.90.146.108",
            "tcp_stream": 1124,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 48350,
            "response_frame": 48493
          }
        ],
        "size_bytes": 126976,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1124,
            "frame_number": 48493,
            "display_filter": "frame.number == 48493",
            "timestamp_epoch": "1545161853.480069000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-5884b4e6d79e5790274d7c32",
        "md5": "3b22fecb0c0d66e2730b4cbc8fc8611b",
        "sha1": "996e077ff9fd42b3c7aeec70ff5462f5222aaa31",
        "type": "file-artifact",
        "label": "Companies-Invoice-0970945(1)",
        "value": "c8212610730cc6902883eee501e0ba8a2b043b880f7ab374df4a5c585d88ac8b",
        "sha256": "c8212610730cc6902883eee501e0ba8a2b043b880f7ab374df4a5c585d88ac8b",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://entisrael.com/wp-content/uploads/2018/jemHu-SahjLpTw_r-7Kd/PaymentStatus/default/US_us/Companies-Invoice-0970945/",
            "client_ip": "172.16.3.133",
            "server_ip": "82.80.25.215",
            "tcp_stream": 1086,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 47166,
            "response_frame": 47322
          }
        ],
        "size_bytes": 121600,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1086,
            "frame_number": 47322,
            "display_filter": "frame.number == 47322",
            "timestamp_epoch": "1545161835.170795000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-3f4fe76d5a12a0c3542883d8",
        "md5": "fb87bdb7a8d8e17ee9b619cb69b2ad67",
        "sha1": "6bbe67438345a3eb60a50f128ed8ad5335429113",
        "type": "file-artifact",
        "label": "protobuf.min.js",
        "value": "04b075859121bd8bae2825f760da6f0a2f0a5e9c7755370a55d51c961e41354c",
        "sha256": "04b075859121bd8bae2825f760da6f0a2f0a5e9c7755370a55d51c961e41354c",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://cdata.carambo.la/Layer/InImage/Prod/cbola_platform/version_2.22.3.4/external/protobuf.min.js",
            "client_ip": "172.16.3.122",
            "server_ip": "192.229.173.42",
            "tcp_stream": 275,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 26828,
            "response_frame": 26880
          }
        ],
        "size_bytes": 70192,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 275,
            "frame_number": 26880,
            "display_filter": "frame.number == 26880",
            "timestamp_epoch": "1545161661.201520000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-dc1b5794a510a70916d698a1",
        "md5": "c1504a47fa537596f7eae02a2d3822c2",
        "sha1": "b2a26d392a02c7ec37256ae7446771a4d3f8006c",
        "type": "file-artifact",
        "label": "sh.e4e8af4de595fdb10ec1459d.html",
        "value": "4b3c73f33be94dea1c0d5fd4f461594e9ecab84f31b676cbd542997fcc7ffd07",
        "sha256": "4b3c73f33be94dea1c0d5fd4f461594e9ecab84f31b676cbd542997fcc7ffd07",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://s7.addthis.com/static/sh.e4e8af4de595fdb10ec1459d.html",
            "client_ip": "172.16.3.114",
            "server_ip": "23.194.180.46",
            "tcp_stream": 1335,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 55435,
            "response_frame": 55605
          }
        ],
        "size_bytes": 69697,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/html",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1335,
            "frame_number": 55605,
            "display_filter": "frame.number == 55605",
            "timestamp_epoch": "1545161917.591259000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-061435d8303c00d2f981899e",
        "md5": "d469e726922d988b1b92ac4db7740d7e",
        "sha1": "eb431051fe32f2125425ae5bc21210355b7217e8",
        "type": "file-artifact",
        "label": "i(1).js",
        "value": "b08fefb255b40cd18b0f7db8ec21c6f0c79d16aa828d7ed9157da12a38538682",
        "sha256": "b08fefb255b40cd18b0f7db8ec21c6f0c79d16aa828d7ed9157da12a38538682",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://mathid.mathtag.com/d/i.js",
            "client_ip": "172.16.3.122",
            "server_ip": "185.29.134.87",
            "tcp_stream": 635,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 30153,
            "response_frame": 30346
          }
        ],
        "size_bytes": 55420,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 635,
            "frame_number": 30346,
            "display_filter": "frame.number == 30346",
            "timestamp_epoch": "1545161681.856486000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-d08c52e66c425c7cbed4670f",
        "md5": "dd5084cd16b609eecf89e8221a70de0a",
        "sha1": "89242ba544cfd15b77a99ce74cbd020c8a6ce24e",
        "type": "file-artifact",
        "label": "ptrack-v1.1.1-engagedtime-slots-video.js",
        "value": "1661c39d1097783d784b69ce670ea0107b1ad26c2c4492127a78314bfbce8c25",
        "sha256": "1661c39d1097783d784b69ce670ea0107b1ad26c2c4492127a78314bfbce8c25",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://static.parsely.com/code/ptrack-v1.1.1-engagedtime-slots-video.js",
            "client_ip": "172.16.3.122",
            "server_ip": "52.85.146.12",
            "tcp_stream": 269,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 16605,
            "response_frame": 16749
          }
        ],
        "size_bytes": 51741,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 269,
            "frame_number": 16749,
            "display_filter": "frame.number == 16749",
            "timestamp_epoch": "1545161650.527303000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-345e1f944a6236a2044ed9bf",
        "md5": "d7b18d2e8e52d7b18ddacbdecf219be8",
        "sha1": "b976718bba0d168ed60925e3524e7ca990482ca7",
        "type": "file-artifact",
        "label": "sync",
        "value": "fade4a6826de29eb9bf1a7a124d3586fe6c9837de16b0419ecdca8cf52bb47b4",
        "sha256": "fade4a6826de29eb9bf1a7a124d3586fe6c9837de16b0419ecdca8cf52bb47b4",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://ap.lijit.com/sync",
            "client_ip": "172.16.3.122",
            "server_ip": "72.251.238.254",
            "tcp_stream": 513,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 25914,
            "response_frame": 25974
          }
        ],
        "size_bytes": 50035,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 513,
            "frame_number": 25974,
            "display_filter": "frame.number == 25974",
            "timestamp_epoch": "1545161658.847957000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-5609c9a67073af68f8bae01a",
        "md5": "0ac20b87baa97328aca30f7eff8667b1",
        "sha1": "0681512602cedf4d0331c715b3292a7db0e170c2",
        "type": "file-artifact",
        "label": "gwiq.js",
        "value": "2ecb9afac87ca44820ee0bae7027e57b8900b385fc8e39cd289fcc0518bd41c4",
        "sha256": "2ecb9afac87ca44820ee0bae7027e57b8900b385fc8e39cd289fcc0518bd41c4",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://gwiqcdn.globalwebindex.net/gwiq/gwiq.js",
            "client_ip": "172.16.3.122",
            "server_ip": "35.201.93.216",
            "tcp_stream": 252,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 15752,
            "response_frame": 16157
          }
        ],
        "size_bytes": 14165,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 252,
            "frame_number": 16157,
            "display_filter": "frame.number == 16157",
            "timestamp_epoch": "1545161650.228421000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-fd39774e426f3848b2fbd088",
        "md5": "760f1701aad76d6a4548ce5c39dc4992",
        "sha1": "223ebe0dc172040e5cbbf0f73e03982b5d7858d4",
        "type": "file-artifact",
        "label": "scripts.js%3fver=4.9",
        "value": "f7db88a5dd4feb92dafbf5b17b516ddb78cfe69daff23ed72453a6a561b367f1",
        "sha256": "f7db88a5dd4feb92dafbf5b17b516ddb78cfe69daff23ed72453a6a561b367f1",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://claytonpl.org/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=4.9",
            "client_ip": "172.16.3.189",
            "server_ip": "64.57.241.17",
            "tcp_stream": 98,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 4504,
            "response_frame": 4624
          }
        ],
        "size_bytes": 13908,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 98,
            "frame_number": 4624,
            "display_filter": "frame.number == 4624",
            "timestamp_epoch": "1545161628.152867000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-ef4c0c4f2e1248a2f721481c",
        "md5": "32d16879d1364e5c66b3a33304b603c9",
        "sha1": "cbd9a3ad636f1f6cffa86cc7da05d87329402f86",
        "type": "file-artifact",
        "label": "BvTIEteILZqRcskLLoLlPBoiUTY3LsR-M3DKm3lfPek.js",
        "value": "06f4c812d7882d9a9172c90b2e82e53c1a225136372ec47e3370ca9b795f3de9",
        "sha256": "06f4c812d7882d9a9172c90b2e82e53c1a225136372ec47e3370ca9b795f3de9",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://pagead2.googlesyndication.com/bg/BvTIEteILZqRcskLLoLlPBoiUTY3LsR-M3DKm3lfPek.js",
            "client_ip": "172.16.3.122",
            "server_ip": "172.217.1.162",
            "tcp_stream": 933,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 40377,
            "response_frame": 40405
          }
        ],
        "size_bytes": 11888,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 933,
            "frame_number": 40405,
            "display_filter": "frame.number == 40405",
            "timestamp_epoch": "1545161763.681819000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-a3a06eb3bdbaa5681cb90113",
        "md5": "afe2b01377d6dacb3dac3b80df6a3b24",
        "sha1": "3617fda366b7ecf225faad05f6cba62c6df58b53",
        "type": "file-artifact",
        "label": "aps_csm.js",
        "value": "6d6f482982f8f1a1814e279ff50df4ccc301533ca9655e4d080d6b90ec69d69e",
        "sha256": "6d6f482982f8f1a1814e279ff50df4ccc301533ca9655e4d080d6b90ec69d69e",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js",
            "client_ip": "172.16.3.122",
            "server_ip": "54.240.160.41",
            "tcp_stream": 321,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 18599,
            "response_frame": 18725
          }
        ],
        "size_bytes": 6456,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 321,
            "frame_number": 18725,
            "display_filter": "frame.number == 18725",
            "timestamp_epoch": "1545161652.097026000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-a5745bbb04a40cb75c86bfea",
        "md5": "a64106d60480daf529244cfff1656d5b",
        "sha1": "8ffb574b765580d6904fcf05d470cfd90cf2758e",
        "type": "file-artifact",
        "label": "popup-overlay-9eee10f7431522ac8108-min.en-US.js",
        "value": "3fe7cdf5049f3a7d2a8cb3a162deab8dc4976258efdfd21812189178a50b2c2d",
        "sha256": "3fe7cdf5049f3a7d2a8cb3a162deab8dc4976258efdfd21812189178a50b2c2d",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://static.squarespace.com/universal/scripts-compressed/popup-overlay-9eee10f7431522ac8108-min.en-US.js",
            "client_ip": "172.16.3.111",
            "server_ip": "151.101.0.238",
            "tcp_stream": 25,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 1844,
            "response_frame": 2421
          }
        ],
        "size_bytes": 3211051,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 25,
            "frame_number": 2421,
            "display_filter": "frame.number == 2421",
            "timestamp_epoch": "1545161519.919059000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-40d9c95ac35c2eb18880df46",
        "md5": "3f9fd74e0f7fd7422d84adda030f6376",
        "sha1": "bb0a7464bca9659f4d5af2a672d07323547c2294",
        "type": "file-artifact",
        "label": "commerce-b7bbc14ab020dc9dda48-min.en-US.js",
        "value": "396a6356867b014ce819c63b7762b2c739e1672f26b05bd2f02721f223ec2fac",
        "sha256": "396a6356867b014ce819c63b7762b2c739e1672f26b05bd2f02721f223ec2fac",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://static.squarespace.com/universal/scripts-compressed/commerce-b7bbc14ab020dc9dda48-min.en-US.js",
            "client_ip": "172.16.3.111",
            "server_ip": "151.101.0.238",
            "tcp_stream": 11,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 203,
            "response_frame": 1271
          }
        ],
        "size_bytes": 2941833,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 11,
            "frame_number": 1271,
            "display_filter": "frame.number == 1271",
            "timestamp_epoch": "1545161514.970668000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-d8c24529165e76296193be0c",
        "md5": "80957a09d25d3999789f1f006c53ba76",
        "sha1": "903de7c9f1d04ddf4a0ae3c7f6fa7caae499ad18",
        "type": "file-artifact",
        "label": "common-1e0479f03b5e7878ccce-min.en-US.js",
        "value": "4bbc8ff59d02dbaa811224358e1609a409ba3f979cc806d1b4362dfd8f677f31",
        "sha256": "4bbc8ff59d02dbaa811224358e1609a409ba3f979cc806d1b4362dfd8f677f31",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://static.squarespace.com/universal/scripts-compressed/common-1e0479f03b5e7878ccce-min.en-US.js",
            "client_ip": "172.16.3.111",
            "server_ip": "151.101.0.238",
            "tcp_stream": 10,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 172,
            "response_frame": 1441
          }
        ],
        "size_bytes": 2387668,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 10,
            "frame_number": 1441,
            "display_filter": "frame.number == 1441",
            "timestamp_epoch": "1545161515.158484000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-a9060730bcf82eb0ae16ab6c",
        "md5": "59d5b57cd9e4546ca8087493b24a0fc9",
        "sha1": "365714c8a581d4c03aea235b1d26c44b1502bd48",
        "type": "file-artifact",
        "label": "10.ac54590d17f11463bc1b.js",
        "value": "f715f78db25833672871d7724e0aa0dabceac9a5574805ea09467d544a5ecea9",
        "sha256": "f715f78db25833672871d7724e0aa0dabceac9a5574805ea09467d544a5ecea9",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://time.com/dist/10.ac54590d17f11463bc1b.js",
            "client_ip": "172.16.3.122",
            "server_ip": "99.84.216.18",
            "tcp_stream": 215,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 14270,
            "response_frame": 14944
          }
        ],
        "size_bytes": 1360682,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 215,
            "frame_number": 14944,
            "display_filter": "frame.number == 14944",
            "timestamp_epoch": "1545161649.517119000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-b1e9ca7c2c0ce481e9c4f7ab",
        "md5": "ebd341f38e7be2bbb9ad81a14d5ce646",
        "sha1": "501e618659bc54a661a9274666dee67f7d0a254c",
        "type": "file-artifact",
        "label": "%2f(2)",
        "value": "88a220fe058e6dc196ab111a5fc44c672913a422c85fb77b67e1ebad77df1720",
        "sha256": "88a220fe058e6dc196ab111a5fc44c672913a422c85fb77b67e1ebad77df1720",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://nymag.com/",
            "client_ip": "172.16.3.188",
            "server_ip": "151.101.64.70",
            "tcp_stream": 987,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 42039,
            "response_frame": 42599
          }
        ],
        "size_bytes": 1346940,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 987,
            "frame_number": 42599,
            "display_filter": "frame.number == 42599",
            "timestamp_epoch": "1545161782.301357000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-8a0176a3e28855bcaa617ec9",
        "md5": "6b5cda8fbf38c5e25642b580fa81591e",
        "sha1": "84b299d370fa763321eeade447df329f95bedfd9",
        "type": "file-artifact",
        "label": "index.min.js",
        "value": "bac6ba7b8afece229c6506105762d92df2d883f533f66efd37cc64988afb76eb",
        "sha256": "bac6ba7b8afece229c6506105762d92df2d883f533f66efd37cc64988afb76eb",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://players.brightcove.net/293884104/SJa0Thl7_default/index.min.js",
            "client_ip": "172.16.3.122",
            "server_ip": "23.194.182.6",
            "tcp_stream": 267,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 16354,
            "response_frame": 17007
          }
        ],
        "size_bytes": 967904,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 267,
            "frame_number": 17007,
            "display_filter": "frame.number == 17007",
            "timestamp_epoch": "1545161650.615701000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-11474122b716d831b31c8b38",
        "md5": "a498a371014feb5e480846af39f50724",
        "sha1": "c07679bfe390f0a079a88c1976c7310c9da87593",
        "type": "file-artifact",
        "label": "parks.png",
        "value": "2a90e41143fd37ec051d12d82eae3909d04773970b557445262a39306f8c913c",
        "sha256": "2a90e41143fd37ec051d12d82eae3909d04773970b557445262a39306f8c913c",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://cityofconway.org/static/site/img/main_slider/parks.png",
            "client_ip": "172.16.3.110",
            "server_ip": "199.59.102.11",
            "tcp_stream": 1520,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 65108,
            "response_frame": 71052
          }
        ],
        "size_bytes": 946108,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/png",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1520,
            "frame_number": 71052,
            "display_filter": "frame.number == 71052",
            "timestamp_epoch": "1545162078.389303000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-cc54efa340e3f997b4bc4ead",
        "md5": "3ba6f94e05f7599811f95513b68f8638",
        "sha1": "1c83fbf0f8204759308a681bf98c92398b0f9a8f",
        "type": "file-artifact",
        "label": "stage.png",
        "value": "6206f852bc1cd64ce101ca70097d2a77232605529fb15a729aa21ed3aea3bbd8",
        "sha256": "6206f852bc1cd64ce101ca70097d2a77232605529fb15a729aa21ed3aea3bbd8",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://cityofconway.org/static/site/img/main_slider/stage.png",
            "client_ip": "172.16.3.110",
            "server_ip": "199.59.102.11",
            "tcp_stream": 1522,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 65017,
            "response_frame": 71060
          }
        ],
        "size_bytes": 753200,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/png",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1522,
            "frame_number": 71060,
            "display_filter": "frame.number == 71060",
            "timestamp_epoch": "1545162078.390277000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-a36195106c73bb15e3ba1708",
        "md5": "f15452348b8a74aed01fe4ba0bf5fc93",
        "sha1": "654e6cbac12f31eddf5d45e100d798479088fa42",
        "type": "file-artifact",
        "label": "football.png",
        "value": "fad64ac0d48366e38d2b2e22373fd2f804d50f8b0a417fc30bb81e278090d9a8",
        "sha256": "fad64ac0d48366e38d2b2e22373fd2f804d50f8b0a417fc30bb81e278090d9a8",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://cityofconway.org/static/site/img/main_slider/football.png",
            "client_ip": "172.16.3.110",
            "server_ip": "199.59.102.11",
            "tcp_stream": 1518,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 65019,
            "response_frame": 68880
          }
        ],
        "size_bytes": 723597,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/png",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1518,
            "frame_number": 68880,
            "display_filter": "frame.number == 68880",
            "timestamp_epoch": "1545162078.188320000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-fab043ad43789d75e9d3e27c",
        "md5": "efee258ef0556f92e1d46324d4f65234",
        "sha1": "81bd12622128a43f74e40e69935e0c941f5f8acc",
        "type": "file-artifact",
        "label": "downtown.png",
        "value": "0ffe555fafbaf569e285db611aa573bd09f0e4b358e1822bc00b48eee0855759",
        "sha256": "0ffe555fafbaf569e285db611aa573bd09f0e4b358e1822bc00b48eee0855759",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://cityofconway.org/static/site/img/main_slider/downtown.png",
            "client_ip": "172.16.3.110",
            "server_ip": "199.59.102.11",
            "tcp_stream": 1521,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 65129,
            "response_frame": 71415
          }
        ],
        "size_bytes": 707810,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/png",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1521,
            "frame_number": 71415,
            "display_filter": "frame.number == 71415",
            "timestamp_epoch": "1545162078.438837000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-8db8043da6b988f0df2e2b3b",
        "md5": "3af4596d74a5c15d778bcc03ee962c1d",
        "sha1": "a51e0cad85dbd4d5343359d7479938ae42f2ea32",
        "type": "file-artifact",
        "label": "12-27-18-SFBC.jpg",
        "value": "53efeba640fea122192240ba054400f137a4c691a920a545866482ca71a12668",
        "sha256": "53efeba640fea122192240ba054400f137a4c691a920a545866482ca71a12668",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://claytonpl.org/wp-content/uploads/2018/12/12-27-18-SFBC.jpg",
            "client_ip": "172.16.3.189",
            "server_ip": "64.57.241.17",
            "tcp_stream": 98,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 4837,
            "response_frame": 10162
          }
        ],
        "size_bytes": 651289,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/jpeg",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 98,
            "frame_number": 10162,
            "display_filter": "frame.number == 10162",
            "timestamp_epoch": "1545161629.719978000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-e9b269f88ba9a11dd93b2e24",
        "md5": "11fccb8d1aeb676ea41a8f4067edfc07",
        "sha1": "133c3618e7415f31bf5843eb3c74fa3cd8845023",
        "type": "file-artifact",
        "label": "CCLS-Holiday-Closings.jpg",
        "value": "cfdab4883f015febd97801736b49e6210e3151ad3f9eff5e5ea9747e99b0da46",
        "sha256": "cfdab4883f015febd97801736b49e6210e3151ad3f9eff5e5ea9747e99b0da46",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://claytonpl.org/wp-content/uploads/2018/11/CCLS-Holiday-Closings.jpg",
            "client_ip": "172.16.3.189",
            "server_ip": "64.57.241.17",
            "tcp_stream": 111,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 4899,
            "response_frame": 9966
          }
        ],
        "size_bytes": 642430,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/jpeg",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 111,
            "frame_number": 9966,
            "display_filter": "frame.number == 9966",
            "timestamp_epoch": "1545161629.665897000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-e587ec1c3073c35b40eaf1f3",
        "md5": "22b99e064e7929133747d5502697d525",
        "sha1": "89f678fed05ae87ae1111dab94df6f01e85c750a",
        "type": "file-artifact",
        "label": "boat.png",
        "value": "3cc4463d5de527ef25ef342f7e44fc2f99f2a46569589322b449b87d1434abc5",
        "sha256": "3cc4463d5de527ef25ef342f7e44fc2f99f2a46569589322b449b87d1434abc5",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://cityofconway.org/static/site/img/main_slider/boat.png",
            "client_ip": "172.16.3.110",
            "server_ip": "199.59.102.11",
            "tcp_stream": 1519,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 65091,
            "response_frame": 69736
          }
        ],
        "size_bytes": 641666,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/png",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1519,
            "frame_number": 69736,
            "display_filter": "frame.number == 69736",
            "timestamp_epoch": "1545162078.269318000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-a479dfa4e521560beb6a24f3",
        "md5": "af1135af92e1572e2f7df0d161ffbf7e",
        "sha1": "b0b88ce888d7543d5603f1c5044e116c38aa24c2",
        "type": "file-artifact",
        "label": "style.css",
        "value": "1f156cfc7c341387b584c9676acfdf998fcacf49505d62d7567df5686500b015",
        "sha256": "1f156cfc7c341387b584c9676acfdf998fcacf49505d62d7567df5686500b015",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://time.com/dist/style.css",
            "client_ip": "172.16.3.122",
            "server_ip": "99.84.216.18",
            "tcp_stream": 199,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 13076,
            "response_frame": 13312
          }
        ],
        "size_bytes": 627627,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/css",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 199,
            "frame_number": 13312,
            "display_filter": "frame.number == 13312",
            "timestamp_epoch": "1545161648.593088000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-653b53b58895c884907496a4",
        "md5": "e23c8965be33add504a842c566ab3fc0",
        "sha1": "0c52c390aaca5b35dae728a1e4c54f861264b1d0",
        "type": "file-artifact",
        "label": "cropped-pixx-001.jpg",
        "value": "c9241b583095467515d7cb7da3a6f8fe1ae2246f189bc4aae83a4508b326648d",
        "sha256": "c9241b583095467515d7cb7da3a6f8fe1ae2246f189bc4aae83a4508b326648d",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.immusicmag.com/wp-content/uploads/2015/06/cropped-pixx-001.jpg",
            "client_ip": "172.16.3.114",
            "server_ip": "107.180.3.196",
            "tcp_stream": 1322,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 55644,
            "response_frame": 56713
          }
        ],
        "size_bytes": 541647,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/jpeg",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1322,
            "frame_number": 56713,
            "display_filter": "frame.number == 56713",
            "timestamp_epoch": "1545161918.175957000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-d4ab339444c3c46f1ccd3eba",
        "md5": "f981436509591e72e73d00a54d4d93ed",
        "sha1": "00fc45df07f6b20279f750bd78fc4e01a7630c92",
        "type": "file-artifact",
        "label": "Holiday-Event-Banner.jpg",
        "value": "89303c1f6abebac87cacb7d3d270804627ef80efcf09b549a2a837c77386cc2a",
        "sha256": "89303c1f6abebac87cacb7d3d270804627ef80efcf09b549a2a837c77386cc2a",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://claytonpl.org/wp-content/uploads/2018/11/Holiday-Event-Banner.jpg",
            "client_ip": "172.16.3.189",
            "server_ip": "64.57.241.17",
            "tcp_stream": 109,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 4850,
            "response_frame": 8710
          }
        ],
        "size_bytes": 513516,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/jpeg",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 109,
            "frame_number": 8710,
            "display_filter": "frame.number == 8710",
            "timestamp_epoch": "1545161629.408919000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-5f95f1d3d44f341cee76fa86",
        "md5": "7f8cd6c1da9d552ad2534cd40ddb1a30",
        "sha1": "8b441e801e4e20a1e1afcc7fff9767afd0b48c10",
        "type": "file-artifact",
        "label": "site.css%3f&filterFeatures=false",
        "value": "5f9c58bf94a15cf6a5fd90781c1fadb44861ac1df45e4ca19a692517212f2488",
        "sha256": "5f9c58bf94a15cf6a5fd90781c1fadb44861ac1df45e4ca19a692517212f2488",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://static1.squarespace.com/static/sitecss/56da576522482ece7bd12b08/2/52e96934e4b0ea14d0f64568/579da78b15d5dbc7b6f7906e/1117-05142015/1543254023709/site.css?&filterFeatures=false",
            "client_ip": "172.16.3.111",
            "server_ip": "151.101.0.238",
            "tcp_stream": 8,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 146,
            "response_frame": 431
          }
        ],
        "size_bytes": 503949,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 431,
            "display_filter": "frame.number == 431",
            "timestamp_epoch": "1545161514.698226000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-e4aed55dc686ebbc7eb01d20",
        "md5": "4624f6906befeb4f8dc2cf425bce0320",
        "sha1": "71d17922fbe09b0b4827503164cc307c1a0b2452",
        "type": "file-artifact",
        "label": "jquery-ui.js",
        "value": "6c35347e8829a9ebcdc3e29bded0325aa05e823678996df34cbc78c317ae8e3e",
        "sha256": "6c35347e8829a9ebcdc3e29bded0325aa05e823678996df34cbc78c317ae8e3e",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://cityofconway.org/static/site/jqui/jquery-ui.js",
            "client_ip": "172.16.3.110",
            "server_ip": "199.59.102.11",
            "tcp_stream": 1523,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 63849,
            "response_frame": 64797
          }
        ],
        "size_bytes": 477536,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1523,
            "frame_number": 64797,
            "display_filter": "frame.number == 64797",
            "timestamp_epoch": "1545162075.815925000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-6762ef5b4028c790a6fd0e14",
        "md5": "031683286a7ec99cb2b20381de7cb134",
        "sha1": "34db545c2891096bf5fca0430b4d89bbe4e364ff",
        "type": "file-artifact",
        "label": "Ferst-Readers-Banner.jpg",
        "value": "baf652065be4e640903f3302e4e262e6b4a57cd1e679988f29b2c5063bb4870d",
        "sha256": "baf652065be4e640903f3302e4e262e6b4a57cd1e679988f29b2c5063bb4870d",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://claytonpl.org/wp-content/uploads/2018/11/Ferst-Readers-Banner.jpg",
            "client_ip": "172.16.3.189",
            "server_ip": "64.57.241.17",
            "tcp_stream": 108,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 4868,
            "response_frame": 8358
          }
        ],
        "size_bytes": 430822,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/jpeg",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 108,
            "frame_number": 8358,
            "display_filter": "frame.number == 8358",
            "timestamp_epoch": "1545161629.342680000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-30ed8e29117f5e37168f862a",
        "md5": "89a431b9decb3005f7ec331357aee2df",
        "sha1": "0a9bfcab2fbf7d690aa73ca728b232d2fdb93631",
        "type": "file-artifact",
        "label": "sfp.js",
        "value": "956ac88e06fc9203c32f9823bbb40cf011c2a29eb344608cc0c4c707414bbd9b",
        "sha256": "956ac88e06fc9203c32f9823bbb40cf011c2a29eb344608cc0c4c707414bbd9b",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://native.sharethrough.com/assets/sfp.js",
            "client_ip": "172.16.3.122",
            "server_ip": "52.85.89.190",
            "tcp_stream": 202,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 13190,
            "response_frame": 13711
          }
        ],
        "size_bytes": 375292,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 202,
            "frame_number": 13711,
            "display_filter": "frame.number == 13711",
            "timestamp_epoch": "1545161648.751216000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-7545e48679e63bc773171671",
        "md5": "36c7ccdd23043db8d66cb93f4d380558",
        "sha1": "98bc4afaa60e42e4e76d46bbb584f61cae2c0155",
        "type": "file-artifact",
        "label": "render%3fcurrentUrl=%2F",
        "value": "3ace91627df6e1f8eb0b2dbc249ba719f88af0b1fc17b816d837abc66b2b6574",
        "sha256": "3ace91627df6e1f8eb0b2dbc249ba719f88af0b1fc17b816d837abc66b2b6574",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.sflmusic.com/api/popup-overlay/render?currentUrl=%2F",
            "client_ip": "172.16.3.111",
            "server_ip": "198.185.159.144",
            "tcp_stream": 4,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 2535,
            "response_frame": 2562
          }
        ],
        "size_bytes": 305504,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 2562,
            "display_filter": "frame.number == 2562",
            "timestamp_epoch": "1545161522.339167000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-f2439f06071535450dbe8501",
        "md5": "71cc249f7298b7e0c4761a09d31e2a53",
        "sha1": "41681d9722bb14e2894dae11b872ed777608ad3b",
        "type": "file-artifact",
        "label": "main.js",
        "value": "ad14316dbacb74ffb33914bb27f7e849080c67375797b22eda1995f7043737ad",
        "sha256": "ad14316dbacb74ffb33914bb27f7e849080c67375797b22eda1995f7043737ad",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://time.com/dist/main.js",
            "client_ip": "172.16.3.122",
            "server_ip": "99.84.216.18",
            "tcp_stream": 200,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 13089,
            "response_frame": 13529
          }
        ],
        "size_bytes": 305407,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 200,
            "frame_number": 13529,
            "display_filter": "frame.number == 13529",
            "timestamp_epoch": "1545161648.688747000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-b1ee4c48f2427a66a874a971",
        "md5": "8e0657fe79ca46c98e6fe323a33be4b5",
        "sha1": "24bb5afc7ecd6364b9a960dd0f8a17f404f16c73",
        "type": "file-artifact",
        "label": "analytics.min.js",
        "value": "aee404b31ed1fadce7e8cad113528f87ff543e99981904a28ac0a1037344d1cb",
        "sha256": "aee404b31ed1fadce7e8cad113528f87ff543e99981904a28ac0a1037344d1cb",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://cdn.segment.com/analytics.js/v1/Tjrt25JUOrbvQQX1cGykGGzC3GncV6F9/analytics.min.js",
            "client_ip": "172.16.3.122",
            "server_ip": "54.192.19.180",
            "tcp_stream": 207,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 13416,
            "response_frame": 13805
          }
        ],
        "size_bytes": 304664,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 207,
            "frame_number": 13805,
            "display_filter": "frame.number == 13805",
            "timestamp_epoch": "1545161648.808224000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-7b4aa7a38855b894059af02f",
        "md5": "b94b5c04a1157b4ef387618a8d1d7121",
        "sha1": "c52cb03841b8709a6a8c32f6e2ad48a5d885d92d",
        "type": "file-artifact",
        "label": "97e00b30_ai1ec_parsed_css.css%3fver=2.5.32",
        "value": "1c77cad7a54aaf86efb43ba3fd9e37e6bddb5eccdcb048506160cabcb28e193d",
        "sha256": "1c77cad7a54aaf86efb43ba3fd9e37e6bddb5eccdcb048506160cabcb28e193d",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://bluegrassheritage.org/wp-content/plugins/all-in-one-event-calendar/cache/97e00b30_ai1ec_parsed_css.css?ver=2.5.32",
            "client_ip": "172.16.3.189",
            "server_ip": "50.62.133.159",
            "tcp_stream": 1623,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 76366,
            "response_frame": 77281
          }
        ],
        "size_bytes": 269338,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1623,
            "frame_number": 77281,
            "display_filter": "frame.number == 77281",
            "timestamp_epoch": "1545162746.169834000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-df6675ba4567a287b5294e2a",
        "md5": "236c8d70248ed1c13feefdc501055f1b",
        "sha1": "60a8e2c64500fac0c9312b41274016649a660c7b",
        "type": "file-artifact",
        "label": "layers.c387ea0d8ef6d16b44e4.js",
        "value": "be5d411b5193346b9e9b033e7f8dba791d8150c114758e75aac7ab1f6523301b",
        "sha256": "be5d411b5193346b9e9b033e7f8dba791d8150c114758e75aac7ab1f6523301b",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://s7.addthis.com/static/layers.c387ea0d8ef6d16b44e4.js",
            "client_ip": "172.16.3.114",
            "server_ip": "23.194.180.46",
            "tcp_stream": 1335,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 56783,
            "response_frame": 56883
          }
        ],
        "size_bytes": 267110,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1335,
            "frame_number": 56883,
            "display_filter": "frame.number == 56883",
            "timestamp_epoch": "1545161918.427817000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-37d0af8854fd331d851b8b83",
        "md5": "6b062174eb19d53323cf9803d8381a37",
        "sha1": "60e152a19d261229e06ea4f51864fff5494ea9fe",
        "type": "file-artifact",
        "label": "Wylie-2019-Slider.jpg",
        "value": "99507656d39c82a5870c23b87df8193765090974f998b4ba0eb6aae95dbee9e9",
        "sha256": "99507656d39c82a5870c23b87df8193765090974f998b4ba0eb6aae95dbee9e9",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://bluegrassheritage.org/wp-content/uploads/Wylie-2019-Slider.jpg",
            "client_ip": "172.16.3.189",
            "server_ip": "50.62.133.159",
            "tcp_stream": 1624,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 78128,
            "response_frame": 79718
          }
        ],
        "size_bytes": 220761,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/jpeg",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1624,
            "frame_number": 79718,
            "display_filter": "frame.number == 79718",
            "timestamp_epoch": "1545162747.717818000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-517d35c334225f1fd9e38c51",
        "md5": "14b90c11e8d9cdb79a637b1eceffc427",
        "sha1": "74049dfc7c95bbe3530c8468748d51d702265f89",
        "type": "file-artifact",
        "label": "show_ads_impl.js",
        "value": "7fe76841236604a4fd3fb784a93cf922b5fc5e8c671c95f06d88fb083e5f20c3",
        "sha256": "7fe76841236604a4fd3fb784a93cf922b5fc5e8c671c95f06d88fb083e5f20c3",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://pagead2.googlesyndication.com/pagead/js/r20181205/r20180604/show_ads_impl.js",
            "client_ip": "172.16.3.122",
            "server_ip": "172.217.1.162",
            "tcp_stream": 366,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 23224,
            "response_frame": 23547
          }
        ],
        "size_bytes": 204484,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 366,
            "frame_number": 23547,
            "display_filter": "frame.number == 23547",
            "timestamp_epoch": "1545161655.926873000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-6a3153cc04c03d31935f23b4",
        "md5": "e0488b0491f29b7cba3cb7340e3fed81",
        "sha1": "683022feae950dc83be4b613c1689d304e4f1870",
        "type": "file-artifact",
        "label": "async-ads.js",
        "value": "7994e86b0dc1d2b4f6012d879296be37379ba548c4048c9018c0cb74ad8ffa68",
        "sha256": "7994e86b0dc1d2b4f6012d879296be37379ba548c4048c9018c0cb74ad8ffa68",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://cse.google.com/adsense/search/async-ads.js",
            "client_ip": "172.16.3.110",
            "server_ip": "172.217.1.14",
            "tcp_stream": 1538,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 73071,
            "response_frame": 73303
          }
        ],
        "size_bytes": 203675,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1538,
            "frame_number": 73303,
            "display_filter": "frame.number == 73303",
            "timestamp_epoch": "1545162079.405952000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-53502a9b228851ff5f65eed7",
        "md5": "9f318c5689afb71c5c4e5a831f36df80",
        "sha1": "bdde037a492a3074c8d8c9b88a06cabbed3bf82b",
        "type": "file-artifact",
        "label": "BHF-Fest-2019-Slider.jpg",
        "value": "9cc441714113403dbf4c389863c1d05633abbe05abb107f48acd13e0d5314f6e",
        "sha256": "9cc441714113403dbf4c389863c1d05633abbe05abb107f48acd13e0d5314f6e",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://bluegrassheritage.org/wp-content/uploads/BHF-Fest-2019-Slider.jpg",
            "client_ip": "172.16.3.189",
            "server_ip": "50.62.133.159",
            "tcp_stream": 1625,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 78092,
            "response_frame": 79379
          }
        ],
        "size_bytes": 189892,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/jpeg",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1625,
            "frame_number": 79379,
            "display_filter": "frame.number == 79379",
            "timestamp_epoch": "1545162747.643413000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-f0e2fff1cb015e20cf777ee8",
        "md5": "3cac0583f990039e210fbcaa98e2c1cc",
        "sha1": "b6737fdd037f53185a2fa683990f9e522889082a",
        "type": "file-artifact",
        "label": "documents%3fcount=6&crops=thumbnail%2Cmarquee_large_2x%2Capp_list_thumbnail_2x&page=0&types=post%2Cgallery&recirc=bottom&excluded=5455078",
        "value": "d3d8710df831286bc62ed79983f0a66f8d8eec7f213f31ac4f7a156b0c8458bd",
        "sha256": "d3d8710df831286bc62ed79983f0a66f8d8eec7f213f31ac4f7a156b0c8458bd",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://time.com/element-api/content-proxy/documents?count=6&crops=thumbnail%2Cmarquee_large_2x%2Capp_list_thumbnail_2x&page=0&types=post%2Cgallery&recirc=bottom&excluded=5455078",
            "client_ip": "172.16.3.122",
            "server_ip": "99.84.216.18",
            "tcp_stream": 200,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 14991,
            "response_frame": 16262
          }
        ],
        "size_bytes": 189375,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 200,
            "frame_number": 16262,
            "display_filter": "frame.number == 16262",
            "timestamp_epoch": "1545161650.256480000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-2bbaff40a58ba7f47a7df72d",
        "md5": "e59aadd4eb90b5acac6e8ecec36db78e",
        "sha1": "30d1266a2732ed58faa3b46fcd1bbb1a53adaf2a",
        "type": "file-artifact",
        "label": "1367909716.css",
        "value": "e64b7aefcb7dc39d473c0b72fdf360a4e7c14bb266afcdb2091c0e2fa50f3702",
        "sha256": "e64b7aefcb7dc39d473c0b72fdf360a4e7c14bb266afcdb2091c0e2fa50f3702",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.cityofpella.com/1367909716.css",
            "client_ip": "172.16.3.112",
            "server_ip": "208.90.188.131",
            "tcp_stream": 1289,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 53387,
            "response_frame": 53466
          }
        ],
        "size_bytes": 172417,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/css",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1289,
            "frame_number": 53466,
            "display_filter": "frame.number == 53466",
            "timestamp_epoch": "1545161902.952684000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-d95a8c2b6b20a9e5840ee5fe",
        "md5": "37d54a70e7d86e8a143d1db77700a24c",
        "sha1": "767f365b8d9f07715f6a2da8da5a77b416dc8b5b",
        "type": "file-artifact",
        "label": "Bobby-Osborne-Bluegrass-Star-Award-Slider.jpg",
        "value": "6b299e8c84abcfd95c63d0e3b850460001301ad0a535035b95a37552e5865811",
        "sha256": "6b299e8c84abcfd95c63d0e3b850460001301ad0a535035b95a37552e5865811",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://bluegrassheritage.org/wp-content/uploads/Bobby-Osborne-Bluegrass-Star-Award-Slider.jpg",
            "client_ip": "172.16.3.189",
            "server_ip": "50.62.133.159",
            "tcp_stream": 1622,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 78241,
            "response_frame": 78916
          }
        ],
        "size_bytes": 172072,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/jpeg",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1622,
            "frame_number": 78916,
            "display_filter": "frame.number == 78916",
            "timestamp_epoch": "1545162747.478799000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-0fe998a74d183a19a2aaa421",
        "md5": "1305bc1d727001a36ef86a101f3b96b5",
        "sha1": "433e4ee5f0a2328cad0efe9ebcff0242e1896c00",
        "type": "file-artifact",
        "label": "Skaggs-Star-Award-Slider.jpg",
        "value": "2a4dcedfc4b31f4432b7656211ba40f2236899aed2b762fc1d3f77f3a70cc103",
        "sha256": "2a4dcedfc4b31f4432b7656211ba40f2236899aed2b762fc1d3f77f3a70cc103",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://bluegrassheritage.org/wp-content/uploads/Skaggs-Star-Award-Slider.jpg",
            "client_ip": "172.16.3.189",
            "server_ip": "50.62.133.159",
            "tcp_stream": 1623,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 78277,
            "response_frame": 79954
          }
        ],
        "size_bytes": 167789,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/jpeg",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1623,
            "frame_number": 79954,
            "display_filter": "frame.number == 79954",
            "timestamp_epoch": "1545162747.833066000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-ee751e6a84c6ceffec7ac0a5",
        "md5": "88914b78be03c7e10424ed41e6aae513",
        "sha1": "dbefe80602b5957e07b992343e4995c70fddf33f",
        "type": "file-artifact",
        "label": "cvpro.min.js%3fver=5.3.4.3",
        "value": "dc72d1591a2a5559ba7e2a591a4cf5692658d20fa7a749c807e37b19773df1e0",
        "sha256": "dc72d1591a2a5559ba7e2a591a4cf5692658d20fa7a749c807e37b19773df1e0",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://bluegrassheritage.org/wp-content/plugins/pt-content-views-pro/public/assets/js/cvpro.min.js?ver=5.3.4.3",
            "client_ip": "172.16.3.189",
            "server_ip": "50.62.133.159",
            "tcp_stream": 1623,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 77588,
            "response_frame": 78271
          }
        ],
        "size_bytes": 158265,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1623,
            "frame_number": 78271,
            "display_filter": "frame.number == 78271",
            "timestamp_epoch": "1545162747.141475000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-a811c9326909a70f9def9192",
        "md5": "dddaf1212c1aa9c138eecb8f12f126fe",
        "sha1": "f7aa9077673d4b973860c472e47d4aa11fddf580",
        "type": "file-artifact",
        "label": "18.e92a96c5e90778a35391.js",
        "value": "b1e47f618b52533358b9f8e8635983d6b06156f974674661067f053a06de8437",
        "sha256": "b1e47f618b52533358b9f8e8635983d6b06156f974674661067f053a06de8437",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://time.com/dist/18.e92a96c5e90778a35391.js",
            "client_ip": "172.16.3.122",
            "server_ip": "99.84.216.18",
            "tcp_stream": 217,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 14132,
            "response_frame": 14450
          }
        ],
        "size_bytes": 144481,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 217,
            "frame_number": 14450,
            "display_filter": "frame.number == 14450",
            "timestamp_epoch": "1545161649.310498000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-a86ce330d3c5ed780265076b",
        "md5": "87be48720d1eba900c288e2a971dcbd1",
        "sha1": "a9d0aba468edbc1dc8aa9862ad0bb9113b605a28",
        "type": "file-artifact",
        "label": "sharethis.js",
        "value": "71a3fb52603f32ca505dd2954a81e883ab54eaccf962553c0b6d57a1f288c92c",
        "sha256": "71a3fb52603f32ca505dd2954a81e883ab54eaccf962553c0b6d57a1f288c92c",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://platform-api.sharethis.com/js/sharethis.js",
            "client_ip": "172.16.3.114",
            "server_ip": "104.88.68.125",
            "tcp_stream": 1330,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 54885,
            "response_frame": 54995
          }
        ],
        "size_bytes": 139283,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1330,
            "frame_number": 54995,
            "display_filter": "frame.number == 54995",
            "timestamp_epoch": "1545161916.591132000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-deb1fc2893b4c3db4554cbda",
        "md5": "228d7903301f52edf03788311a5e7a02",
        "sha1": "244dcf5429f969f38a07309c53d45245d8e971f0",
        "type": "file-artifact",
        "label": "bootstrap.css%3fver=1.0",
        "value": "57006a0337a67cc281451cd29c8a4fc1ff3163c2eaf1b545378bbce3b91f8c4e",
        "sha256": "57006a0337a67cc281451cd29c8a4fc1ff3163c2eaf1b545378bbce3b91f8c4e",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://bluegrassheritage.org/wp-content/themes/BHF/bootstrap/css/bootstrap.css?ver=1.0",
            "client_ip": "172.16.3.189",
            "server_ip": "50.62.133.159",
            "tcp_stream": 1624,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 76670,
            "response_frame": 77424
          }
        ],
        "size_bytes": 132073,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1624,
            "frame_number": 77424,
            "display_filter": "frame.number == 77424",
            "timestamp_epoch": "1545162746.311980000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-566949f40fb9640127997688",
        "md5": "1faa589b221c62ceb4567f77badd7ad6",
        "sha1": "ea751f66128649d944d6cf267425ef180787d54c",
        "type": "file-artifact",
        "label": "Del-Star-Award-Slider1.jpg",
        "value": "9a39f4a4b470cd99c522ebc9367c8d50cc185ac7898cc18d44d6f44e93ac4ee6",
        "sha256": "9a39f4a4b470cd99c522ebc9367c8d50cc185ac7898cc18d44d6f44e93ac4ee6",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://bluegrassheritage.org/wp-content/uploads/Del-Star-Award-Slider1.jpg",
            "client_ip": "172.16.3.189",
            "server_ip": "50.62.133.159",
            "tcp_stream": 1622,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 79339,
            "response_frame": 80656
          }
        ],
        "size_bytes": 128198,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/jpeg",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1622,
            "frame_number": 80656,
            "display_filter": "frame.number == 80656",
            "timestamp_epoch": "1545162748.041606000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-5e59da619b2b81e39a932700",
        "md5": "a103f22603028cebc29909c7070d309d",
        "sha1": "fd15ef4ff092abcb481ba5588ddf3ae83fd7c9cb",
        "type": "file-artifact",
        "label": "apple-ipad-pro-2018-review",
        "value": "cecbd5d0d48c3f3a5f19eb2aeeb73a142bec219792a1827f996217aa6959314d",
        "sha256": "cecbd5d0d48c3f3a5f19eb2aeeb73a142bec219792a1827f996217aa6959314d",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://time.com/5455078/apple-ipad-pro-2018-review/",
            "client_ip": "172.16.3.122",
            "server_ip": "99.84.216.18",
            "tcp_stream": 199,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 13022,
            "response_frame": 13068
          }
        ],
        "size_bytes": 126946,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 199,
            "frame_number": 13068,
            "display_filter": "frame.number == 13068",
            "timestamp_epoch": "1545161648.375694000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-0acc74d403d8e267ae582bd8",
        "md5": "3c614a211c2e1d1294310694feb1d954",
        "sha1": "8ef540f4d6d20d2ca534293400370a27bb353576",
        "type": "file-artifact",
        "label": "documents%3fcount=4&crops=thumbnail%2Cmarquee_large_2x%2Capp_list_thumbnail_2x&types=post%2Cgallery&excluded=5455078&vocabulary=category&term=Tech&recirc=top",
        "value": "d039e87e1e74ffd47f1ce901ccc8b68ca881054750c0043ef3d1e4ba8575f693",
        "sha256": "d039e87e1e74ffd47f1ce901ccc8b68ca881054750c0043ef3d1e4ba8575f693",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://time.com/element-api/content-proxy/documents?count=4&crops=thumbnail%2Cmarquee_large_2x%2Capp_list_thumbnail_2x&types=post%2Cgallery&excluded=5455078&vocabulary=category&term=Tech&recirc=top",
            "client_ip": "172.16.3.122",
            "server_ip": "99.84.216.18",
            "tcp_stream": 199,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 14990,
            "response_frame": 15848
          }
        ],
        "size_bytes": 123740,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 199,
            "frame_number": 15848,
            "display_filter": "frame.number == 15848",
            "timestamp_epoch": "1545161650.114923000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-d0521eab10fb2aef28e70c75",
        "md5": "5032c4b77e0f87ce4385c5ac606dff26",
        "sha1": "bddb0d30b6b4779420c97a6ca45ead1acfc85fa4",
        "type": "file-artifact",
        "label": "%2f(14)",
        "value": "38e428ec4a5d1309b71d461766afeca6dbba262734577ff3b1ef5a15cfb83c47",
        "sha256": "38e428ec4a5d1309b71d461766afeca6dbba262734577ff3b1ef5a15cfb83c47",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://69.195.223.154:7080/",
            "client_ip": "172.16.3.133",
            "server_ip": "69.195.223.154",
            "tcp_stream": 1566,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 74443,
            "response_frame": 74570
          }
        ],
        "size_bytes": 123428,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1566,
            "frame_number": 74570,
            "display_filter": "frame.number == 74570",
            "timestamp_epoch": "1545162148.036891000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-627b39c133a37f5b06df7040",
        "md5": "45013554beedea969198997945414cc6",
        "sha1": "88f0f4f3cf3939139ffb21d025509dbcbe262216",
        "type": "file-artifact",
        "label": "nv-main.js",
        "value": "e51ef559c59405552078b0a0101ccda5f6c76671ee57d959536ce5affd5f2c39",
        "sha256": "e51ef559c59405552078b0a0101ccda5f6c76671ee57d959536ce5affd5f2c39",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://s.update.adsrvr.org/2/4.41.0/nv-main.js",
            "client_ip": "172.16.3.122",
            "server_ip": "54.156.10.4",
            "tcp_stream": 720,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 32859,
            "response_frame": 32969
          }
        ],
        "size_bytes": 121207,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 720,
            "frame_number": 32969,
            "display_filter": "frame.number == 32969",
            "timestamp_epoch": "1545161703.902024000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-ede22176c9f6527f704893fe",
        "md5": "1767211e4ae798914ad573a2dadf1d21",
        "sha1": "b6897ccc0ff1b32e25291d682bc9e35d0105295d",
        "type": "file-artifact",
        "label": "Jerry-Star-Award-Slider.jpg",
        "value": "cd5a60f0dea684bb49194540239670500eaa353861ee3ec4f422efec7f7a13a7",
        "sha256": "cd5a60f0dea684bb49194540239670500eaa353861ee3ec4f422efec7f7a13a7",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://bluegrassheritage.org/wp-content/uploads/Jerry-Star-Award-Slider.jpg",
            "client_ip": "172.16.3.189",
            "server_ip": "50.62.133.159",
            "tcp_stream": 1625,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 79388,
            "response_frame": 80706
          }
        ],
        "size_bytes": 120236,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/jpeg",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1625,
            "frame_number": 80706,
            "display_filter": "frame.number == 80706",
            "timestamp_epoch": "1545162748.074795000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-0008ac9137c11ae9e2923a80",
        "md5": "334ca1c43d0c33dae86ebc892b75193e",
        "sha1": "c086766c472a607d10f9e08fb5f6cebf49373120",
        "type": "file-artifact",
        "label": "containertag%3fcontainerId=18&zoneId=583070&v=2",
        "value": "548f95f35857b6ba270842050b720d45589aff9ad6e618536bd70969cea96809",
        "sha256": "548f95f35857b6ba270842050b720d45589aff9ad6e618536bd70969cea96809",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://ap.lijit.com/containertag?containerId=18&zoneId=583071&v=2",
            "client_ip": "172.16.3.122",
            "server_ip": "72.251.238.254",
            "tcp_stream": 513,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 26830,
            "response_frame": 26891
          },
          {
            "url": "http://ap.lijit.com/containertag?containerId=18&zoneId=583070&v=2",
            "client_ip": "172.16.3.122",
            "server_ip": "72.251.238.254",
            "tcp_stream": 516,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 26834,
            "response_frame": 26898
          },
          {
            "url": "http://ap.lijit.com/containertag?containerId=18&zoneId=583175&v=2",
            "client_ip": "172.16.3.122",
            "server_ip": "72.251.238.254",
            "tcp_stream": 515,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 26833,
            "response_frame": 26905
          },
          {
            "url": "http://ap.lijit.com/containertag?containerId=18&zoneId=583070&v=2",
            "client_ip": "172.16.3.122",
            "server_ip": "63.251.114.137",
            "tcp_stream": 1173,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 50285,
            "response_frame": 50398
          },
          {
            "url": "http://ap.lijit.com/containertag?containerId=18&zoneId=583071&v=2",
            "client_ip": "172.16.3.122",
            "server_ip": "63.251.114.137",
            "tcp_stream": 1174,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 50286,
            "response_frame": 50404
          },
          {
            "url": "http://ap.lijit.com/containertag?containerId=18&zoneId=583175&v=2",
            "client_ip": "172.16.3.122",
            "server_ip": "63.251.114.137",
            "tcp_stream": 1175,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 50292,
            "response_frame": 50430
          }
        ],
        "size_bytes": 117122,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 513,
            "frame_number": 26891,
            "display_filter": "frame.number == 26891",
            "timestamp_epoch": "1545161661.212257000"
          },
          {
            "tcp_stream": 516,
            "frame_number": 26898,
            "display_filter": "frame.number == 26898",
            "timestamp_epoch": "1545161661.216126000"
          },
          {
            "tcp_stream": 515,
            "frame_number": 26905,
            "display_filter": "frame.number == 26905",
            "timestamp_epoch": "1545161661.220929000"
          },
          {
            "tcp_stream": 1173,
            "frame_number": 50398,
            "display_filter": "frame.number == 50398",
            "timestamp_epoch": "1545161869.720661000"
          },
          {
            "tcp_stream": 1174,
            "frame_number": 50404,
            "display_filter": "frame.number == 50404",
            "timestamp_epoch": "1545161869.721227000"
          },
          {
            "tcp_stream": 1175,
            "frame_number": 50430,
            "display_filter": "frame.number == 50430",
            "timestamp_epoch": "1545161869.728760000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-ec169444577a885dddd4e8f5",
        "md5": "0309efe0560e41fcbc4a9d6c7e04ab9f",
        "sha1": "3d0bb6f0840acb01806051459b345d6b970e6fd6",
        "type": "file-artifact",
        "label": "outbrain.js",
        "value": "47f4ab517a213319a68ed29a448a93bdfa9adf97adffb187fb80c09126687c0d",
        "sha256": "47f4ab517a213319a68ed29a448a93bdfa9adf97adffb187fb80c09126687c0d",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://widgets.outbrain.com/outbrain.js",
            "client_ip": "172.16.3.122",
            "server_ip": "23.194.182.69",
            "tcp_stream": 239,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 15180,
            "response_frame": 15514
          }
        ],
        "size_bytes": 112021,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 239,
            "frame_number": 15514,
            "display_filter": "frame.number == 15514",
            "timestamp_epoch": "1545161649.734472000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-d66376a184e4e7e8494ee0ce",
        "md5": "adde1c87fdec0ded2d8d2ce7e8cac610",
        "sha1": "a6bcd409de76bbcbe6a22442a1e7f6c17e9a5c38",
        "type": "file-artifact",
        "label": "documents%3fcount=4&crops=thumbnail%2Cmarquee_large_2x%2Capp_list_thumbnail_2x&page=0&types=post%2Cgallery&excluded=5455078&recirc=right-rail",
        "value": "c9f63bb8981d39a217046d824043b1a89e3dbb4b4c4d908e940d67f87e27f927",
        "sha256": "c9f63bb8981d39a217046d824043b1a89e3dbb4b4c4d908e940d67f87e27f927",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://time.com/element-api/content-proxy/documents?count=4&crops=thumbnail%2Cmarquee_large_2x%2Capp_list_thumbnail_2x&page=0&types=post%2Cgallery&excluded=5455078&recirc=right-rail",
            "client_ip": "172.16.3.122",
            "server_ip": "99.84.216.18",
            "tcp_stream": 201,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 14993,
            "response_frame": 15803
          }
        ],
        "size_bytes": 110370,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 201,
            "frame_number": 15803,
            "display_filter": "frame.number == 15803",
            "timestamp_epoch": "1545161650.091147000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-ce24e09ce3be642683f5990a",
        "md5": "da9ac5f9b2492ea3c4c0307e64c92bc4",
        "sha1": "969a05fd6697d8adf5edf3ab11ec67873e587593",
        "type": "file-artifact",
        "label": "Volunteers-Slider.jpg",
        "value": "a016d22ad575ad0014be1a800024dbe55ddfe008efe5331220b4eedd83f854f0",
        "sha256": "a016d22ad575ad0014be1a800024dbe55ddfe008efe5331220b4eedd83f854f0",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://bluegrassheritage.org/wp-content/uploads/Volunteers-Slider.jpg",
            "client_ip": "172.16.3.189",
            "server_ip": "50.62.133.159",
            "tcp_stream": 1624,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 79741,
            "response_frame": 80586
          }
        ],
        "size_bytes": 107284,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/jpeg",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1624,
            "frame_number": 80586,
            "display_filter": "frame.number == 80586",
            "timestamp_epoch": "1545162748.006088000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-246f1a56e27bb4689c306c44",
        "md5": "6cf129d81f74f0685746f5c90d22729f",
        "sha1": "2d55518bf51ea7784e6e96ad9d5b65d950bfdf0d",
        "type": "file-artifact",
        "label": "front.css%3fver=2.0.20",
        "value": "0e484f825b9765eb54f997170ca8d75f2397f5a91bad2eefd4da1721fe5e977a",
        "sha256": "0e484f825b9765eb54f997170ca8d75f2397f5a91bad2eefd4da1721fe5e977a",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.immusicmag.com/wp-content/plugins/simple-social-buttons/assets/css/front.css?ver=2.0.20",
            "client_ip": "172.16.3.114",
            "server_ip": "107.180.3.196",
            "tcp_stream": 1325,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 54807,
            "response_frame": 54867
          }
        ],
        "size_bytes": 101686,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1325,
            "frame_number": 54867,
            "display_filter": "frame.number == 54867",
            "timestamp_epoch": "1545161916.437408000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-cc202fa49eb4cd483b611dc6",
        "md5": "921874516b927acc0dd883a49d626be3",
        "sha1": "84ce4ddfe1e7f11256f013db58917006cc5768cf",
        "type": "file-artifact",
        "label": "%2f",
        "value": "71649c3557cde15418c917ecec2dfa016ca01aa6e35922a948b1a03418e9582c",
        "sha256": "71649c3557cde15418c917ecec2dfa016ca01aa6e35922a948b1a03418e9582c",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.sflmusic.com/",
            "client_ip": "172.16.3.111",
            "server_ip": "198.185.159.144",
            "tcp_stream": 4,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 74,
            "response_frame": 123
          }
        ],
        "size_bytes": 100475,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 123,
            "display_filter": "frame.number == 123",
            "timestamp_epoch": "1545161514.357063000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-08914b7b915eb5be070b7fbd",
        "md5": "dda356d3ea39f3b405a9192ecbd73fd1",
        "sha1": "87fc2a8c30db6e5b5c2ae0e3cfe96d48a78d2e22",
        "type": "file-artifact",
        "label": "a-01be.min.js",
        "value": "5a9236336d658bf76b9176b7658ccf4a83b3c3dc4a0c2943f85816bcdd8c946d",
        "sha256": "5a9236336d658bf76b9176b7658ccf4a83b3c3dc4a0c2943f85816bcdd8c946d",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://b-code.liadm.com/a-01be.min.js",
            "client_ip": "172.16.3.122",
            "server_ip": "66.110.100.33",
            "tcp_stream": 576,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 28059,
            "response_frame": 28171
          }
        ],
        "size_bytes": 98989,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 576,
            "frame_number": 28171,
            "display_filter": "frame.number == 28171",
            "timestamp_epoch": "1545161668.075475000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-b219e81ce6c2c2f7da4df75f",
        "md5": "8610f03fe77640dee8c4cc924e060f12",
        "sha1": "076524186dbbdd4c41afbbd6b260d9e46a095811",
        "type": "file-artifact",
        "label": "jquery.js%3fver=1.12(1).4",
        "value": "fc48d1d80ece71a79a7b39877f4104d49d3da6c3665cf6dc203000fb7df4447e",
        "sha256": "fc48d1d80ece71a79a7b39877f4104d49d3da6c3665cf6dc203000fb7df4447e",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://claytonpl.org/wp-includes/js/jquery/jquery.js?ver=1.12.4",
            "client_ip": "172.16.3.189",
            "server_ip": "64.57.241.17",
            "tcp_stream": 109,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 3877,
            "response_frame": 4182
          },
          {
            "url": "http://www.immusicmag.com/wp-includes/js/jquery/jquery.js?ver=1.12.4",
            "client_ip": "172.16.3.114",
            "server_ip": "107.180.3.196",
            "tcp_stream": 1322,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 54845,
            "response_frame": 55077
          }
        ],
        "size_bytes": 97184,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 109,
            "frame_number": 4182,
            "display_filter": "frame.number == 4182",
            "timestamp_epoch": "1545161627.881867000"
          },
          {
            "tcp_stream": 1322,
            "frame_number": 55077,
            "display_filter": "frame.number == 55077",
            "timestamp_epoch": "1545161916.669832000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-79c3356ebee70ede3457f829",
        "md5": "b792294f206c1e12d00d546ed411ad4d",
        "sha1": "ecd6339d65e32f24cfe2e05a40487e1d378fce43",
        "type": "file-artifact",
        "label": "widgets.js",
        "value": "f4eaa5ec2a4a26394c0c150e2d40d3564117fc738245e835f59fb7705498550a",
        "sha256": "f4eaa5ec2a4a26394c0c150e2d40d3564117fc738245e835f59fb7705498550a",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://platform.twitter.com/widgets.js",
            "client_ip": "172.16.3.114",
            "server_ip": "72.21.91.66",
            "tcp_stream": 1342,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 55989,
            "response_frame": 56083
          }
        ],
        "size_bytes": 95222,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1342,
            "frame_number": 56083,
            "display_filter": "frame.number == 56083",
            "timestamp_epoch": "1545161917.872804000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-2e9f695fd2b686c4f03aacb5",
        "md5": "397754ba49e9e0cf4e7c190da78dda05",
        "sha1": "ae49e56999d82802727455f0ba83b63acd90a22b",
        "type": "file-artifact",
        "label": "jquery.js%3fver=8645e0e570a3b6c6dac0c6a11b3abc41",
        "value": "c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4",
        "sha256": "c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://bluegrassheritage.org/wp-content/themes/BHF/jquery.js?ver=8645e0e570a3b6c6dac0c6a11b3abc41",
            "client_ip": "172.16.3.189",
            "server_ip": "50.62.133.159",
            "tcp_stream": 1625,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 77356,
            "response_frame": 77658
          }
        ],
        "size_bytes": 92629,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1625,
            "frame_number": 77658,
            "display_filter": "frame.number == 77658",
            "timestamp_epoch": "1545162746.476828000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-4fa81ce674d68652b3aa455e",
        "md5": "8f27921293ada3709a72e1d17120d1c3",
        "sha1": "a8438b0aa115208aa0885e6098cb84494b712a17",
        "type": "file-artifact",
        "label": "sm_sp.js",
        "value": "a6ba6e06e1e6809af57d8eaac34825bb868aa17a27cd3c76a9043c4c484d1e34",
        "sha256": "a6ba6e06e1e6809af57d8eaac34825bb868aa17a27cd3c76a9043c4c484d1e34",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://cdn.selectablemedia.com/ro/c/js/sm_sp.js",
            "client_ip": "172.16.3.122",
            "server_ip": "54.230.19.252",
            "tcp_stream": 262,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 16010,
            "response_frame": 16277
          }
        ],
        "size_bytes": 91665,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 262,
            "frame_number": 16277,
            "display_filter": "frame.number == 16277",
            "timestamp_epoch": "1545161650.267508000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-0596fd9945a7e07d67065ef5",
        "md5": "71a6cd38ce5e34aca1e0b17b2ad945de",
        "sha1": "18728a879a5dca6da4dade98418a1b057599a528",
        "type": "file-artifact",
        "label": "17.400ac20a4415c3b13bbd.js",
        "value": "3cd71387f6bb4b0c781ccabad01f3a9999801b91e451f2f6e4bf507636df0431",
        "sha256": "3cd71387f6bb4b0c781ccabad01f3a9999801b91e451f2f6e4bf507636df0431",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://time.com/dist/17.400ac20a4415c3b13bbd.js",
            "client_ip": "172.16.3.122",
            "server_ip": "99.84.216.18",
            "tcp_stream": 200,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 14107,
            "response_frame": 14250
          }
        ],
        "size_bytes": 87736,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 200,
            "frame_number": 14250,
            "display_filter": "frame.number == 14250",
            "timestamp_epoch": "1545161649.230048000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-fb763dd955e7b7d4d247b09c",
        "md5": "2a6e5eae9503a12016957ab0c8eaaacd",
        "sha1": "35ae0e3308e6f4150470d9faca2430e0fcb6737e",
        "type": "file-artifact",
        "label": "cv.css%3fver=2.1.2",
        "value": "92f78af020e68a9cc550f429e828bc83528171d5d21e62e00481964f40275bda",
        "sha256": "92f78af020e68a9cc550f429e828bc83528171d5d21e62e00481964f40275bda",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://bluegrassheritage.org/wp-content/plugins/content-views-query-and-display-post-page/public/assets/css/cv.css?ver=2.1.2",
            "client_ip": "172.16.3.189",
            "server_ip": "50.62.133.159",
            "tcp_stream": 1626,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 76365,
            "response_frame": 76820
          }
        ],
        "size_bytes": 77749,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1626,
            "frame_number": 76820,
            "display_filter": "frame.number == 76820",
            "timestamp_epoch": "1545162745.871266000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-39000fc7f508874ac6a1570a",
        "md5": "c9b4051d40a7a295f7bb260f2fe7544f",
        "sha1": "b10b5e9e929aba5325b4d34aeafc390a5e16c627",
        "type": "file-artifact",
        "label": "adsbygoogle.js",
        "value": "55648fd4a223b7b5aa46fbafa92212ae89698574a2f3f1bb5fe540fe024bd4d4",
        "sha256": "55648fd4a223b7b5aa46fbafa92212ae89698574a2f3f1bb5fe540fe024bd4d4",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js",
            "client_ip": "172.16.3.188",
            "server_ip": "172.217.2.98",
            "tcp_stream": 1010,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 44215,
            "response_frame": 44392
          }
        ],
        "size_bytes": 76680,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1010,
            "frame_number": 44392,
            "display_filter": "frame.number == 44392",
            "timestamp_epoch": "1545161790.432069000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-32dde1dc92b0ba6a02436426",
        "md5": "08b677bf9cd82b1fe2f4a352707dd389",
        "sha1": "94e104240ddadf855c5c696fd09e726c7d3ae404",
        "type": "file-artifact",
        "label": "14.e3387e4d38ae58482a1a.js",
        "value": "f403cc8b5914c44d8eac3b9be5ae4c566b1e2a7840bf734f2b12527beed38d75",
        "sha256": "f403cc8b5914c44d8eac3b9be5ae4c566b1e2a7840bf734f2b12527beed38d75",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://time.com/dist/14.e3387e4d38ae58482a1a.js",
            "client_ip": "172.16.3.122",
            "server_ip": "99.84.216.18",
            "tcp_stream": 199,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 14112,
            "response_frame": 14293
          }
        ],
        "size_bytes": 76416,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 199,
            "frame_number": 14293,
            "display_filter": "frame.number == 14293",
            "timestamp_epoch": "1545161649.237012000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-1bdf248d6d5a4e98b0171879",
        "md5": "d0965decf25c6223e6a8e3e3593e1df0",
        "sha1": "903d6e8a4d35110c59be420294d5ac4d99e150f1",
        "type": "file-artifact",
        "label": "npfm.js%3fcid=8CUDF41E5",
        "value": "47eceb6a15fe67900c5eea5298f4666f019818870043954761d8a5a99d1fb5a2",
        "sha256": "47eceb6a15fe67900c5eea5298f4666f019818870043954761d8a5a99d1fb5a2",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://cperformmedia-a.akamaihd.net/npfm.js?cid=8CUDF41E5",
            "client_ip": "172.16.3.122",
            "server_ip": "23.67.59.8",
            "tcp_stream": 414,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 22177,
            "response_frame": 22463
          }
        ],
        "size_bytes": 76156,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 414,
            "frame_number": 22463,
            "display_filter": "frame.number == 22463",
            "timestamp_epoch": "1545161654.937676000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-095cb00e1fd3d752cf6a38da",
        "md5": "fe9dfc08f4a15e272c4e6b57d5a44161",
        "sha1": "d85eebeea527421ffc57ee0c07753f715836d45c",
        "type": "file-artifact",
        "label": "cvpro.min.css%3fver=5.3.4.3",
        "value": "8718a0c9e90880a7fe228db0c07333baa82dcc41e4ac99f02e2dabb04219ada1",
        "sha256": "8718a0c9e90880a7fe228db0c07333baa82dcc41e4ac99f02e2dabb04219ada1",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://bluegrassheritage.org/wp-content/plugins/pt-content-views-pro/public/assets/css/cvpro.min.css?ver=5.3.4.3",
            "client_ip": "172.16.3.189",
            "server_ip": "50.62.133.159",
            "tcp_stream": 1625,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 76370,
            "response_frame": 77159
          }
        ],
        "size_bytes": 73262,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1625,
            "frame_number": 77159,
            "display_filter": "frame.number == 77159",
            "timestamp_epoch": "1545162746.045231000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-9006b5badeefbd074d83e479",
        "md5": "12e6ba8a1cefe6d5ee7d99a1fa350673",
        "sha1": "4a0388027e584007738ba98c5cae1229a6fe02f4",
        "type": "file-artifact",
        "label": "osd.js",
        "value": "0dc9542b043f4622f82261f8d3ca79bb0c29bcbdacf2056a2fc633a488922dd4",
        "sha256": "0dc9542b043f4622f82261f8d3ca79bb0c29bcbdacf2056a2fc633a488922dd4",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://pagead2.googlesyndication.com/pagead/osd.js",
            "client_ip": "172.16.3.122",
            "server_ip": "172.217.1.162",
            "tcp_stream": 366,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 20186,
            "response_frame": 20378
          }
        ],
        "size_bytes": 73122,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 366,
            "frame_number": 20378,
            "display_filter": "frame.number == 20378",
            "timestamp_epoch": "1545161653.724884000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-173a75f71518d9c21097b665",
        "md5": "c275d97683d54352f8c9e7b569801752",
        "sha1": "a6247230bbcfc3eab38a74cf802d31f34174ee03",
        "type": "file-artifact",
        "label": "epicenterfestival2019lineups-370x556.jpg",
        "value": "363e22d8c45e86da47fc7994e61788c490445b38778bb95e7a8d80a3ca662fce",
        "sha256": "363e22d8c45e86da47fc7994e61788c490445b38778bb95e7a8d80a3ca662fce",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.immusicmag.com/wp-content/uploads/2018/12/epicenterfestival2019lineups-370x556.jpg",
            "client_ip": "172.16.3.114",
            "server_ip": "107.180.3.196",
            "tcp_stream": 1325,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 55427,
            "response_frame": 55976
          }
        ],
        "size_bytes": 71075,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/jpeg",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1325,
            "frame_number": 55976,
            "display_filter": "frame.number == 55976",
            "timestamp_epoch": "1545161917.790196000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-6af726180522789c043d15de",
        "md5": "53f6233f0969b44c0115bd7da49f7dae",
        "sha1": "bd7458df921597f7f0e676c05b9b06153c424718",
        "type": "file-artifact",
        "label": "%3fformat=1500w",
        "value": "280e26d35f3432326aa89faf3431fce1a3d217f1cfe483db3cdfad7510c0e750",
        "sha256": "280e26d35f3432326aa89faf3431fce1a3d217f1cfe483db3cdfad7510c0e750",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://static1.squarespace.com/static/56da576522482ece7bd12b08/t/58ee76be59cc68f3613caf5d/1544327909101/?format=1500w",
            "client_ip": "172.16.3.111",
            "server_ip": "151.101.0.238",
            "tcp_stream": 9,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 153,
            "response_frame": 507
          }
        ],
        "size_bytes": 69864,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 9,
            "frame_number": 507,
            "display_filter": "frame.number == 507",
            "timestamp_epoch": "1545161514.710943000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-cf0bb9de8aac0dd20ca19f1d",
        "md5": "e084253157b9a18c50cabbf2b9e97594",
        "sha1": "1ed9acb328a54ac808a78a1cb3c4ab29fec9976e",
        "type": "file-artifact",
        "label": "%2f(4)",
        "value": "e79e23fb38564bc347f1e172c7c1491d1d61aaaae97a70791b7ef3462e63cfba",
        "sha256": "e79e23fb38564bc347f1e172c7c1491d1d61aaaae97a70791b7ef3462e63cfba",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.immusicmag.com/",
            "client_ip": "172.16.3.114",
            "server_ip": "107.180.3.196",
            "tcp_stream": 1319,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 54689,
            "response_frame": 54776
          }
        ],
        "size_bytes": 67295,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1319,
            "frame_number": 54776,
            "display_filter": "frame.number == 54776",
            "timestamp_epoch": "1545161916.267883000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-79dbf694c8d58d98364c08ed",
        "md5": "7e5eb53e5ab31e18d972d139263dc14d",
        "sha1": "0efa14869a1ba2e266cadbaa3abce9ed16ca4803",
        "type": "file-artifact",
        "label": "eyJpdSI6IjFmMjdhNTJhYTZmYmY2YmIyNDFmZjk4MjgzMmUxNGRhNTkxMmViN2NlODk1MmFiNWQxYzYyZGFmMDk4MTY3NGIiLCJ3IjozMDAsImgiOjE2OSwiZCI6MS41LCJjcyI6MCwiZiI6Mn0.png",
        "value": "6399dd4262849f87bb2d0f186503ca8b8c404dddb333d9b173b2dc762562d3d8",
        "sha256": "6399dd4262849f87bb2d0f186503ca8b8c404dddb333d9b173b2dc762562d3d8",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://images.outbrainimg.com/transform/v3/eyJpdSI6IjFmMjdhNTJhYTZmYmY2YmIyNDFmZjk4MjgzMmUxNGRhNTkxMmViN2NlODk1MmFiNWQxYzYyZGFmMDk4MTY3NGIiLCJ3IjozMDAsImgiOjE2OSwiZCI6MS41LCJjcyI6MCwiZiI6Mn0.png",
            "client_ip": "172.16.3.122",
            "server_ip": "96.7.66.138",
            "tcp_stream": 312,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 18324,
            "response_frame": 18737
          }
        ],
        "size_bytes": 63231,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "image/png",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 312,
            "frame_number": 18737,
            "display_filter": "frame.number == 18737",
            "timestamp_epoch": "1545161652.128749000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-aede0cea040a13cfdfc8131e",
        "md5": "bace5212e2b37b89cffced67b9f1700c",
        "sha1": "0fc480eea8be97c287c46770aef02af4073379d4",
        "type": "file-artifact",
        "label": "make_it_logo_web-e1508859702308.png",
        "value": "fca74616e2ffb66b98a7a26d760ac89ce7cfce0a8cabffa4d5d3e2511763c8ab",
        "sha256": "fca74616e2ffb66b98a7a26d760ac89ce7cfce0a8cabffa4d5d3e2511763c8ab",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://claytonpl.org/wp-content/uploads/2017/06/make_it_logo_web-e1508859702308.png",
            "client_ip": "172.16.3.189",
            "server_ip": "64.57.241.17",
            "tcp_stream": 150,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 6474,
            "response_frame": 7752
          }
        ],
        "size_bytes": 61965,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "image/png",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 150,
            "frame_number": 7752,
            "display_filter": "frame.number == 7752",
            "timestamp_epoch": "1545161629.209218000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-a9d795d9719cd38f59a50fe0",
        "md5": "2bf6fd68e49ed93bf6aa594b0639baed",
        "sha1": "0bacb0ec335f96ee76403bfdbb683529710945f4",
        "type": "file-artifact",
        "label": "nrrV820.js",
        "value": "4dafb6833e371a9b6b7ae50ad7093517bdb7d1e37cd8ba559cf82f4246ad9c9d",
        "sha256": "4dafb6833e371a9b6b7ae50ad7093517bdb7d1e37cd8ba559cf82f4246ad9c9d",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://cperformmedia-a.akamaihd.net/__media__/js/util/nrrV820.js",
            "client_ip": "172.16.3.122",
            "server_ip": "23.67.59.8",
            "tcp_stream": 414,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 23652,
            "response_frame": 23847
          }
        ],
        "size_bytes": 60713,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 414,
            "frame_number": 23847,
            "display_filter": "frame.number == 23847",
            "timestamp_epoch": "1545161656.256862000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-8740546d53e8be3075764c74",
        "md5": "f65983c7c0f136480a18d3857e32667a",
        "sha1": "8f5020ba19617097e313e802ea60aeb8f944fc0d",
        "type": "file-artifact",
        "label": "%2f(16)",
        "value": "b16fd60bd687bd8ee1e640f930553fc10c8c9d0807b6c0e84ba9c9d4a19ec32c",
        "sha256": "b16fd60bd687bd8ee1e640f930553fc10c8c9d0807b6c0e84ba9c9d4a19ec32c",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://bluegrassheritage.org/",
            "client_ip": "172.16.3.189",
            "server_ip": "50.62.133.159",
            "tcp_stream": 1622,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 76310,
            "response_frame": 76351
          }
        ],
        "size_bytes": 60612,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1622,
            "frame_number": 76351,
            "display_filter": "frame.number == 76351",
            "timestamp_epoch": "1545162745.387017000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-3a902961315beed0b5308e8f",
        "md5": "6ab8a054e0368cc300ab40a0e13a1d17",
        "sha1": "ff4b4d424fda294d570d38b390babd25ca0c133d",
        "type": "file-artifact",
        "label": "show_ads.js",
        "value": "182ce34511f709018637c0f7f73019ae9b3f44e68b8527d87e874d40c7f59b31",
        "sha256": "182ce34511f709018637c0f7f73019ae9b3f44e68b8527d87e874d40c7f59b31",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://pagead2.googlesyndication.com/pagead/show_ads.js",
            "client_ip": "172.16.3.122",
            "server_ip": "172.217.1.162",
            "tcp_stream": 367,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 22796,
            "response_frame": 22985
          }
        ],
        "size_bytes": 59839,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 367,
            "frame_number": 22985,
            "display_filter": "frame.number == 22985",
            "timestamp_epoch": "1545161655.415165000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-89d73375575370d77812aad0",
        "md5": "cbbf80e1733d43795c2beb41dff8068a",
        "sha1": "45043666c1d4db583c7f39f31f54e9c677062c77",
        "type": "file-artifact",
        "label": "bootstrap.js%3fver=0.91",
        "value": "2a0a953369d361695d49d2a040339dc31189da223e55516baab4e3fd090662dd",
        "sha256": "2a0a953369d361695d49d2a040339dc31189da223e55516baab4e3fd090662dd",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://bluegrassheritage.org/wp-content/themes/BHF/bootstrap/js/bootstrap.js?ver=0.91",
            "client_ip": "172.16.3.189",
            "server_ip": "50.62.133.159",
            "tcp_stream": 1624,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 77596,
            "response_frame": 77890
          }
        ],
        "size_bytes": 58516,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1624,
            "frame_number": 77890,
            "display_filter": "frame.number == 77890",
            "timestamp_epoch": "1545162746.742050000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-5b2cb666130539f6f63709c2",
        "md5": "86b7575101409cb9b108fa684ac3d082",
        "sha1": "d418f05f1ffee0fc94fd1f93ecf4fed4483d3f09",
        "type": "file-artifact",
        "label": "mediamain.html%3f&cid=8CUDF41E5&cpcd=TyWTjHO2ivmIdtb1fEbAQA%3D%3D&crid=515973768&pid=8POC6L8GY&size=728x90&cpnet=yVb1sHm-0KKoFeunLBVJxco5Awr2H4ucIaBDtba8xww%3D&cme=3440UVyi8gQmzk-9ffqFLBtsxYoRo6rK_BlHL4hLgc4YTJnkwsUzWT-eXvcYMjCUivhW-RMA5sHR1aN2C7ZLf-xjot2",
        "value": "4da2e9dfff3d485d7daa00b61ff4ae6063abfa53f0914e6cfeddfcfcd6e73166",
        "sha256": "4da2e9dfff3d485d7daa00b61ff4ae6063abfa53f0914e6cfeddfcfcd6e73166",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://cperformmedia-a.akamaihd.net/mediamain.html?&cid=8CUDF41E5&cpcd=TyWTjHO2ivmIdtb1fEbAQA%3D%3D&crid=515973768&pid=8POC6L8GY&size=728x90&cpnet=yVb1sHm-0KKoFeunLBVJxco5Awr2H4ucIaBDtba8xww%3D&cme=3440UVyi8gQmzk-9ffqFLBtsxYoRo6rK_BlHL4hLgc4YTJnkwsUzWT-eXvcYMjCUivhW-RMA5sHR1aN2C7ZLf-xjot2luuy-vm1JA58hPhUH0_S1CIAVjoGL-Pmsl8Lw-WEkILIfkNU%3D%7C%7CNDHRnZ9Gz3KXlI-i9OnZqQ%3D%3D%7Cm_AtKA-EW0svu-fDC4wIpQ%3D%3D%7CtrJ5NInYpv8CZl4BkxiFgKp3djHKBfl5%7CRrUTbnOe6NcS2omRz7bBw-YcJlRMDmZF%7CN7fu2vKt8_s%3D%7COjVbOW8Tf3h-PiU_TVuM62a6tItoxWzC5U8ItUA9RbBJiMNq5jPypxtBiXVKshKou6day3I_C7DIBpUMv_88LEqD2BlhYgphmR2t0y5tQg0%3D%7CsRBSg3CPSiQ%3D%7C&cc=US&bf=0&vif=2&nse=1&vi=1545161654809532215&lw=1&ugd=4&bdrId=4&ib=0&katid=802318043&katbid=-21&nb=1",
            "client_ip": "172.16.3.122",
            "server_ip": "23.67.59.8",
            "tcp_stream": 471,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 23879,
            "response_frame": 24354
          }
        ],
        "size_bytes": 57498,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 471,
            "frame_number": 24354,
            "display_filter": "frame.number == 24354",
            "timestamp_epoch": "1545161657.015008000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-84d02fe1a7b11c197e32280f",
        "md5": "91dcbab189110d04e1ad99c0f7ed6443",
        "sha1": "c08dede7945172199bd2dd322a407e39ad0e5f6b",
        "type": "file-artifact",
        "label": "%2f(1)",
        "value": "ac82a286548c8cecae194955b1ffafe56ca133251756cd6a9ec28e85875c6ded",
        "sha256": "ac82a286548c8cecae194955b1ffafe56ca133251756cd6a9ec28e85875c6ded",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://claytonpl.org/",
            "client_ip": "172.16.3.189",
            "server_ip": "64.57.241.17",
            "tcp_stream": 98,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 3351,
            "response_frame": 3496
          }
        ],
        "size_bytes": 57059,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 98,
            "frame_number": 3496,
            "display_filter": "frame.number == 3496",
            "timestamp_epoch": "1545161627.279073000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-a2c3a91a7c2e79442947bf75",
        "md5": "d5f8fde453cc9d099595bf7c3fe72751",
        "sha1": "fbc204988dabac1ccf1fbbf32e53e5a742dd08bf",
        "type": "file-artifact",
        "label": "piwik(1).js",
        "value": "aa0708631ac18f439c07a501a9774ed6bfb11a23f8dc58d829a803ba2f4e469a",
        "sha256": "aa0708631ac18f439c07a501a9774ed6bfb11a23f8dc58d829a803ba2f4e469a",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://analytics.civicplus.com//piwik.js",
            "client_ip": "172.16.3.112",
            "server_ip": "208.90.189.37",
            "tcp_stream": 1301,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 53973,
            "response_frame": 54074
          }
        ],
        "size_bytes": 56050,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1301,
            "frame_number": 54074,
            "display_filter": "frame.number == 54074",
            "timestamp_epoch": "1545161905.413692000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-655c1ea33bb3317738ac5f87",
        "md5": "75c3aa8b9e3a2fd67bacfbb23c797688",
        "sha1": "227a53351f9793ba4ccff25dba10688dc9d9af5a",
        "type": "file-artifact",
        "label": "style.css%3fver=2.0.18",
        "value": "ffc1cef1737122de8f04f02ed805a2fa2aab2557fe0a45cf026d96321fdc83f7",
        "sha256": "ffc1cef1737122de8f04f02ed805a2fa2aab2557fe0a45cf026d96321fdc83f7",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://www.immusicmag.com/wp-content/themes/oblique/style.css?ver=2.0.18",
            "client_ip": "172.16.3.114",
            "server_ip": "107.180.3.196",
            "tcp_stream": 1324,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 54810,
            "response_frame": 54875
          }
        ],
        "size_bytes": 55470,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1324,
            "frame_number": 54875,
            "display_filter": "frame.number == 54875",
            "timestamp_epoch": "1545161916.441102000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-4a9b676bcc0ae19d18d42662",
        "md5": "03f5d3d5e3a277eeab2a5799a1aa7fda",
        "sha1": "04944f4326115a572d8390028e609c579154521f",
        "type": "file-artifact",
        "label": "piwik.js",
        "value": "bd816aa696baaaecb101ad5e78360d69beb0dcd782a0f595b4717f4b56ae9354",
        "sha256": "bd816aa696baaaecb101ad5e78360d69beb0dcd782a0f595b4717f4b56ae9354",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://sflmusic.piwikpro.com/piwik.js",
            "client_ip": "172.16.3.111",
            "server_ip": "35.153.36.84",
            "tcp_stream": 21,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 1565,
            "response_frame": 1706
          }
        ],
        "size_bytes": 55388,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "unknown",
        "content_type": "text/javascript",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 21,
            "frame_number": 1706,
            "display_filter": "frame.number == 1706",
            "timestamp_epoch": "1545161518.606362000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-fbff14d5c26b1fe1b6632d85",
        "md5": "6cb07a80b58e05d77cc1413e29d3e03e",
        "sha1": "df1961c974d57bfc9da2d04070d2f9dacff4f211",
        "type": "file-artifact",
        "label": "script.js%3fver=8645e0e570a3b6c6dac0c6a11b3abc41",
        "value": "65dd4e059961012bcaf18c7a9521f15752bd82e9929dc43960d7dbac474eed63",
        "sha256": "65dd4e059961012bcaf18c7a9521f15752bd82e9929dc43960d7dbac474eed63",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://bluegrassheritage.org/wp-content/themes/BHF/script.js?ver=8645e0e570a3b6c6dac0c6a11b3abc41",
            "client_ip": "172.16.3.189",
            "server_ip": "50.62.133.159",
            "tcp_stream": 1622,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 77368,
            "response_frame": 77832
          }
        ],
        "size_bytes": 54651,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "application/octet-stream",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1622,
            "frame_number": 77832,
            "display_filter": "frame.number == 77832",
            "timestamp_epoch": "1545162746.631921000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      },
      {
        "id": "artifact-50e250a6c3fec4bf7281a0a0",
        "md5": "7f9e6bfe6c8b68c1c439b793c526d950",
        "sha1": "39b45e278223aaf328c722422bd00ed470267eeb",
        "type": "file-artifact",
        "label": "style(1).css",
        "value": "6dd88538f3d90cbc95b777f6f36fef6fbf693872ad2f657300eac03d8f745a51",
        "sha256": "6dd88538f3d90cbc95b777f6f36fef6fbf693872ad2f657300eac03d8f745a51",
        "source": "deterministic-pcap-analysis",
        "transfers": [
          {
            "url": "http://bluegrassheritage.org/wp-content/themes/BHF/style.css",
            "client_ip": "172.16.3.189",
            "server_ip": "50.62.133.159",
            "tcp_stream": 1622,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 76353,
            "response_frame": 76717
          }
        ],
        "size_bytes": 54313,
        "source_ref": "2018-12-18-traffic-analysis-exercise.pcap",
        "analysis_id": "0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "source_refs": [
          "2018-12-18-traffic-analysis-exercise.pcap",
          "deterministic-pcap-analysis"
        ],
        "completeness": "matches-declared-content-length",
        "content_type": "text/css",
        "ioc_candidate": false,
        "frame_evidence": [
          {
            "tcp_stream": 1622,
            "frame_number": 76717,
            "display_filter": "frame.number == 76717",
            "timestamp_epoch": "1545162745.786194000"
          }
        ],
        "extraction_method": "tshark-http-export-objects"
      }
    ],
    "evidence_edges": [
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-7847750ebbbb66c6b2d5be72",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-9557299bc5fc5d564e4b292d",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-11974c145fadd86af9e0f5c6",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-0131278d2ccad3790efef02a",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-bed2c089ef73c16503a8b402",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-c475fa679df65c7869ea8bcb",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-ee2012bda20dee4f976baa38",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-1c92a92244d68a6018ca3f94",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-3d6d0a878ade118f15ed10f3",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-1157f436ca750568b1670f17",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-cf4995db15d23699fc9ace28",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-410f7f800ddb9c137ac31575",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-96a24c69107819d6fc759e20",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-23a1b829f53bee79dccedfcf",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-385b7605d6295b835ff95e60",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-dadac480b3f601bdce586f6c",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-b31b8438945718dcbbbed9f7",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-86cc5de894edf1799ed4146c",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-6c8ec36ae810261ebf37d8e5",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-70423c97528060c37e35623c",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-ca6a036fef767b8b77449827",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-586f4c6d2522ed8e723d72c1",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-ba9dd33710156e0e71ea6cdf",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-e4d8ab6ba20a7bbbc4a5edce",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-f18dccfa6ba5faaff94a0503",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-7ac39ed4520a3ddf432bfa9b",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-5de8bc5cf11b1f079a54f623",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-3702b39f8585ea41695846c6",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-8bdc464394859607d1251436",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-75d100c4698e8e38cb2646aa",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-b64454fb727294fd5ee4cd0a",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-b0c2da62089a3857ef5306ab",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-2221d1fb227c2d015912578b",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-8e7b68406c88956c7af548aa",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-4e9e1966f27098d7d0191d1a",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-e0811635e0aa3fece676f2bb",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-38cc96604edd8619bceae1e3",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-79ff8dab239421e51c823fdf",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-c7a1a8610f14a4b939362b17",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-4a25d477ba2a8d73ae6eed16",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-c4569be4b15e90b66ac04b77",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-d4cf2ac33f1d5c4b8eccb2f3",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-0d281588182c588e4739e98d",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-c6ade164bae4aba1558087b3",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-aa649dc44cdf42eec6366fd7",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-dd855fc5eff290992609ca89",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-a58dbc644098d4299a656650",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-4e2a8c7c04eb9af797d51cfb",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-1a5fc92c02b3b0ca47cf4038",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-45e03c5ac4d3d3fb7eb4308e",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-2fa78a7855a66ab58899e75c",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-af8b0cb64e9546bfb4c88dcb",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-234f942b226e5651269c920f",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-6ab6b7348dbc2cd61f94384f",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-80ea0293a0e22cdb97c2a4fc",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-7aceee2346835940ca2899bd",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-a8c7fa231b972aa6ebbe0b87",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-4da23735fd610caa74c65de3",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-3452e3dc2df6a55fa79ea97c",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-d6cc22275786cac40137b0a8",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-93a03196e75b831713ae165e",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-02de4f99beabbea930ad7e7d",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-a9bc8355ae8aba7fc1f2f375",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-737d9b07965bf8331668849a",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-2b916b91fca529682f1041f7",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-dab3363c240d7f790c1ec05d",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-62adb51afc249d77fc7f1bf3",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-b4bf5076e12331977c003cfe",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-003655d9390178a7fbd1f5f5",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-1e5ec1dacc318302b8253c28",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-ad6d38bc1706af786108ae20",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-daeb53c3daddc228f4a26986",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-2fa75380735c27e7a3fc0807",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-38dcd893630fb8ed9fa262a4",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-3e727d5096ac2cb3f5b2cb62",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-724dffe091a5edd27a3aec07",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-92afc1bffe0472bd3190c0c0",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-1806d220cc62e8d92d6b6b3d",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-f1b86a8a8f8dcd933e073155",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-fbb8e3c8fac02a45040be4ab",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-85e4094e82e4a03fca9a8c30",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-25680176b1c38c862da27502",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-c9be899439d8d34a667f6a0a",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-b0e227b87018056938aed9a2",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-c57017182518e45573bd42e7",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-86f36b8ebd86d157d9ee4938",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-5735df165c8fa9cef45c7d22",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-5d083c11a3e26d8eba5d67aa",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-23897dec6962f6f6686afa29",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-25f6e5136c9fc95398a8bf1d",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-4e3985b8b325c9c44a0e7979",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-0c9c4af959a915278586a9b1",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-7fa9a41f23c987887e1024f5",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-5830192e7dc06b101e1b4633",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-99d323a81ac5859ebc6d5a4a",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-26a5d77618adf1e3d54d3b33",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-b2ae318aa336e71c7025876f",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-73268b67d35c04f05c0fbc90",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-61f66cb153b01710a962e0e8",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "supports-rule-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "finding-3ae2c0cfae6c5f8c547c1d1f",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "source_analysis_ref": "/api/pcap/analyses/0c443755-98f4-45dd-a9c4-e04e0415fe14"
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "f80a291952b00aeec16baeb2213562f21a7c066cc347a27992080f3f933f9329",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-4da70653da5ab2880ac2f666",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "50a659a2aa9e8bb6f5816079a0260a395ba58fd79644b752ce7d110797369309",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-991d6c70b7e68e439dccbab8",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "4ae13537e762b87532575cd0b68f58cd2d9def152b2a3cb9b4ba1119d9cc7fcd",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-f173a7b8d5a22841d4841cbb",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "7a52e16aa8b4482fbb1e7703857a9a8d81e34287ed1b9a16a8b9d7dfc338ec14",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-a4fd635155878106338f69c5",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "a3fa497722d46e94af222413942f180a93425494ebccbc5c9168fea737fd3659",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-d0c7757612b2a5509f636d31",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "4fb1ccd3d77c33b9e8f7e709986074b1f33eb9ce7a181e2601d65304919d48b6",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-4e044c5d4fde1abd7d29309b",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "cc9ef51ad043a2dc708a4794ac901b1b844234a33acd53f0512d00d14162baf3",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-2aadbeea1eaeb973e3bb5f8f",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "f781e2b69d0b488e3fb82a65256743b7b3af53c2f5a40c95bc51aabddf807929",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-5360f206434283f1c01cb0d0",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "12b583b1d3c2b8680f9de5f1e420f55e40c95c799e9b2426aeb35b4968d46f2c",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-ff6af9bf32dad041160515d9",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "c60daa0065982f564213fb87ebcbe3a228c6afae063cc28c32497f2807c4ff4b",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-1ef2f729f1f96f9c41836ae3",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "1147e185964fba78458a7ed8abdf32ca78ef2ef3e0acdc5159b696d0bb404f96",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-31cc30770995093145a0a8cb",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "8b659598bce8eb96dbbe1c1c89b51b9981cde715a9464cf5b7c4d3c208391002",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-2e0ecb1fc69a8ce0d155962c",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "4a6ff2d1af33424fe9033c836b8e64c8361e6428e8e45d0cc14a38892941cfd6",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-8d7f6dbb69dcccb18436eab5",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "c8212610730cc6902883eee501e0ba8a2b043b880f7ab374df4a5c585d88ac8b",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-5884b4e6d79e5790274d7c32",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "04b075859121bd8bae2825f760da6f0a2f0a5e9c7755370a55d51c961e41354c",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-3f4fe76d5a12a0c3542883d8",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "4b3c73f33be94dea1c0d5fd4f461594e9ecab84f31b676cbd542997fcc7ffd07",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-dc1b5794a510a70916d698a1",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "b08fefb255b40cd18b0f7db8ec21c6f0c79d16aa828d7ed9157da12a38538682",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-061435d8303c00d2f981899e",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "1661c39d1097783d784b69ce670ea0107b1ad26c2c4492127a78314bfbce8c25",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-d08c52e66c425c7cbed4670f",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "fade4a6826de29eb9bf1a7a124d3586fe6c9837de16b0419ecdca8cf52bb47b4",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-345e1f944a6236a2044ed9bf",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "2ecb9afac87ca44820ee0bae7027e57b8900b385fc8e39cd289fcc0518bd41c4",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-5609c9a67073af68f8bae01a",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "f7db88a5dd4feb92dafbf5b17b516ddb78cfe69daff23ed72453a6a561b367f1",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-fd39774e426f3848b2fbd088",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "06f4c812d7882d9a9172c90b2e82e53c1a225136372ec47e3370ca9b795f3de9",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-ef4c0c4f2e1248a2f721481c",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "6d6f482982f8f1a1814e279ff50df4ccc301533ca9655e4d080d6b90ec69d69e",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-a3a06eb3bdbaa5681cb90113",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "3fe7cdf5049f3a7d2a8cb3a162deab8dc4976258efdfd21812189178a50b2c2d",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-a5745bbb04a40cb75c86bfea",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "396a6356867b014ce819c63b7762b2c739e1672f26b05bd2f02721f223ec2fac",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-40d9c95ac35c2eb18880df46",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "4bbc8ff59d02dbaa811224358e1609a409ba3f979cc806d1b4362dfd8f677f31",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-d8c24529165e76296193be0c",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "f715f78db25833672871d7724e0aa0dabceac9a5574805ea09467d544a5ecea9",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-a9060730bcf82eb0ae16ab6c",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "88a220fe058e6dc196ab111a5fc44c672913a422c85fb77b67e1ebad77df1720",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-b1e9ca7c2c0ce481e9c4f7ab",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "bac6ba7b8afece229c6506105762d92df2d883f533f66efd37cc64988afb76eb",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-8a0176a3e28855bcaa617ec9",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "2a90e41143fd37ec051d12d82eae3909d04773970b557445262a39306f8c913c",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-11474122b716d831b31c8b38",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "6206f852bc1cd64ce101ca70097d2a77232605529fb15a729aa21ed3aea3bbd8",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-cc54efa340e3f997b4bc4ead",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "fad64ac0d48366e38d2b2e22373fd2f804d50f8b0a417fc30bb81e278090d9a8",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-a36195106c73bb15e3ba1708",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "0ffe555fafbaf569e285db611aa573bd09f0e4b358e1822bc00b48eee0855759",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-fab043ad43789d75e9d3e27c",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "53efeba640fea122192240ba054400f137a4c691a920a545866482ca71a12668",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-8db8043da6b988f0df2e2b3b",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "cfdab4883f015febd97801736b49e6210e3151ad3f9eff5e5ea9747e99b0da46",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-e9b269f88ba9a11dd93b2e24",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "3cc4463d5de527ef25ef342f7e44fc2f99f2a46569589322b449b87d1434abc5",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-e587ec1c3073c35b40eaf1f3",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "1f156cfc7c341387b584c9676acfdf998fcacf49505d62d7567df5686500b015",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-a479dfa4e521560beb6a24f3",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "c9241b583095467515d7cb7da3a6f8fe1ae2246f189bc4aae83a4508b326648d",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-653b53b58895c884907496a4",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "89303c1f6abebac87cacb7d3d270804627ef80efcf09b549a2a837c77386cc2a",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-d4ab339444c3c46f1ccd3eba",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "5f9c58bf94a15cf6a5fd90781c1fadb44861ac1df45e4ca19a692517212f2488",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-5f95f1d3d44f341cee76fa86",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "6c35347e8829a9ebcdc3e29bded0325aa05e823678996df34cbc78c317ae8e3e",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-e4aed55dc686ebbc7eb01d20",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "baf652065be4e640903f3302e4e262e6b4a57cd1e679988f29b2c5063bb4870d",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-6762ef5b4028c790a6fd0e14",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "956ac88e06fc9203c32f9823bbb40cf011c2a29eb344608cc0c4c707414bbd9b",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-30ed8e29117f5e37168f862a",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "3ace91627df6e1f8eb0b2dbc249ba719f88af0b1fc17b816d837abc66b2b6574",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-7545e48679e63bc773171671",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "ad14316dbacb74ffb33914bb27f7e849080c67375797b22eda1995f7043737ad",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-f2439f06071535450dbe8501",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "aee404b31ed1fadce7e8cad113528f87ff543e99981904a28ac0a1037344d1cb",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-b1ee4c48f2427a66a874a971",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "1c77cad7a54aaf86efb43ba3fd9e37e6bddb5eccdcb048506160cabcb28e193d",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-7b4aa7a38855b894059af02f",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "be5d411b5193346b9e9b033e7f8dba791d8150c114758e75aac7ab1f6523301b",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-df6675ba4567a287b5294e2a",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "99507656d39c82a5870c23b87df8193765090974f998b4ba0eb6aae95dbee9e9",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-37d0af8854fd331d851b8b83",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "7fe76841236604a4fd3fb784a93cf922b5fc5e8c671c95f06d88fb083e5f20c3",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-517d35c334225f1fd9e38c51",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "7994e86b0dc1d2b4f6012d879296be37379ba548c4048c9018c0cb74ad8ffa68",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-6a3153cc04c03d31935f23b4",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "9cc441714113403dbf4c389863c1d05633abbe05abb107f48acd13e0d5314f6e",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-53502a9b228851ff5f65eed7",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "d3d8710df831286bc62ed79983f0a66f8d8eec7f213f31ac4f7a156b0c8458bd",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-f0e2fff1cb015e20cf777ee8",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "e64b7aefcb7dc39d473c0b72fdf360a4e7c14bb266afcdb2091c0e2fa50f3702",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-2bbaff40a58ba7f47a7df72d",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "6b299e8c84abcfd95c63d0e3b850460001301ad0a535035b95a37552e5865811",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-d95a8c2b6b20a9e5840ee5fe",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "2a4dcedfc4b31f4432b7656211ba40f2236899aed2b762fc1d3f77f3a70cc103",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-0fe998a74d183a19a2aaa421",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "dc72d1591a2a5559ba7e2a591a4cf5692658d20fa7a749c807e37b19773df1e0",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-ee751e6a84c6ceffec7ac0a5",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "b1e47f618b52533358b9f8e8635983d6b06156f974674661067f053a06de8437",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-a811c9326909a70f9def9192",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "71a3fb52603f32ca505dd2954a81e883ab54eaccf962553c0b6d57a1f288c92c",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-a86ce330d3c5ed780265076b",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "57006a0337a67cc281451cd29c8a4fc1ff3163c2eaf1b545378bbce3b91f8c4e",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-deb1fc2893b4c3db4554cbda",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "9a39f4a4b470cd99c522ebc9367c8d50cc185ac7898cc18d44d6f44e93ac4ee6",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-566949f40fb9640127997688",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "cecbd5d0d48c3f3a5f19eb2aeeb73a142bec219792a1827f996217aa6959314d",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-5e59da619b2b81e39a932700",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "d039e87e1e74ffd47f1ce901ccc8b68ca881054750c0043ef3d1e4ba8575f693",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-0acc74d403d8e267ae582bd8",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "38e428ec4a5d1309b71d461766afeca6dbba262734577ff3b1ef5a15cfb83c47",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-d0521eab10fb2aef28e70c75",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "e51ef559c59405552078b0a0101ccda5f6c76671ee57d959536ce5affd5f2c39",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-627b39c133a37f5b06df7040",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "cd5a60f0dea684bb49194540239670500eaa353861ee3ec4f422efec7f7a13a7",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-ede22176c9f6527f704893fe",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "548f95f35857b6ba270842050b720d45589aff9ad6e618536bd70969cea96809",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-0008ac9137c11ae9e2923a80",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "47f4ab517a213319a68ed29a448a93bdfa9adf97adffb187fb80c09126687c0d",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-ec169444577a885dddd4e8f5",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "c9f63bb8981d39a217046d824043b1a89e3dbb4b4c4d908e940d67f87e27f927",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-d66376a184e4e7e8494ee0ce",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "a016d22ad575ad0014be1a800024dbe55ddfe008efe5331220b4eedd83f854f0",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-ce24e09ce3be642683f5990a",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "0e484f825b9765eb54f997170ca8d75f2397f5a91bad2eefd4da1721fe5e977a",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-246f1a56e27bb4689c306c44",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "71649c3557cde15418c917ecec2dfa016ca01aa6e35922a948b1a03418e9582c",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-cc202fa49eb4cd483b611dc6",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "5a9236336d658bf76b9176b7658ccf4a83b3c3dc4a0c2943f85816bcdd8c946d",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-08914b7b915eb5be070b7fbd",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "fc48d1d80ece71a79a7b39877f4104d49d3da6c3665cf6dc203000fb7df4447e",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-b219e81ce6c2c2f7da4df75f",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "f4eaa5ec2a4a26394c0c150e2d40d3564117fc738245e835f59fb7705498550a",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-79c3356ebee70ede3457f829",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-2e9f695fd2b686c4f03aacb5",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "a6ba6e06e1e6809af57d8eaac34825bb868aa17a27cd3c76a9043c4c484d1e34",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-4fa81ce674d68652b3aa455e",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "3cd71387f6bb4b0c781ccabad01f3a9999801b91e451f2f6e4bf507636df0431",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-0596fd9945a7e07d67065ef5",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "92f78af020e68a9cc550f429e828bc83528171d5d21e62e00481964f40275bda",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-fb763dd955e7b7d4d247b09c",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "55648fd4a223b7b5aa46fbafa92212ae89698574a2f3f1bb5fe540fe024bd4d4",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-39000fc7f508874ac6a1570a",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "f403cc8b5914c44d8eac3b9be5ae4c566b1e2a7840bf734f2b12527beed38d75",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-32dde1dc92b0ba6a02436426",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "47eceb6a15fe67900c5eea5298f4666f019818870043954761d8a5a99d1fb5a2",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-1bdf248d6d5a4e98b0171879",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "8718a0c9e90880a7fe228db0c07333baa82dcc41e4ac99f02e2dabb04219ada1",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-095cb00e1fd3d752cf6a38da",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "0dc9542b043f4622f82261f8d3ca79bb0c29bcbdacf2056a2fc633a488922dd4",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-9006b5badeefbd074d83e479",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "363e22d8c45e86da47fc7994e61788c490445b38778bb95e7a8d80a3ca662fce",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-173a75f71518d9c21097b665",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "280e26d35f3432326aa89faf3431fce1a3d217f1cfe483db3cdfad7510c0e750",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-6af726180522789c043d15de",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "e79e23fb38564bc347f1e172c7c1491d1d61aaaae97a70791b7ef3462e63cfba",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-cf0bb9de8aac0dd20ca19f1d",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "6399dd4262849f87bb2d0f186503ca8b8c404dddb333d9b173b2dc762562d3d8",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-79dbf694c8d58d98364c08ed",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "fca74616e2ffb66b98a7a26d760ac89ce7cfce0a8cabffa4d5d3e2511763c8ab",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-aede0cea040a13cfdfc8131e",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "4dafb6833e371a9b6b7ae50ad7093517bdb7d1e37cd8ba559cf82f4246ad9c9d",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-a9d795d9719cd38f59a50fe0",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "b16fd60bd687bd8ee1e640f930553fc10c8c9d0807b6c0e84ba9c9d4a19ec32c",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-8740546d53e8be3075764c74",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "182ce34511f709018637c0f7f73019ae9b3f44e68b8527d87e874d40c7f59b31",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-3a902961315beed0b5308e8f",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "2a0a953369d361695d49d2a040339dc31189da223e55516baab4e3fd090662dd",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-89d73375575370d77812aad0",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "4da2e9dfff3d485d7daa00b61ff4ae6063abfa53f0914e6cfeddfcfcd6e73166",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-5b2cb666130539f6f63709c2",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "ac82a286548c8cecae194955b1ffafe56ca133251756cd6a9ec28e85875c6ded",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-84d02fe1a7b11c197e32280f",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "aa0708631ac18f439c07a501a9774ed6bfb11a23f8dc58d829a803ba2f4e469a",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-a2c3a91a7c2e79442947bf75",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "ffc1cef1737122de8f04f02ed805a2fa2aab2557fe0a45cf026d96321fdc83f7",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-655c1ea33bb3317738ac5f87",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "bd816aa696baaaecb101ad5e78360d69beb0dcd782a0f595b4717f4b56ae9354",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-4a9b676bcc0ae19d18d42662",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "65dd4e059961012bcaf18c7a9521f15752bd82e9929dc43960d7dbac474eed63",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-fbff14d5c26b1fe1b6632d85",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "contains-exported-bytes",
        "sha256": "6dd88538f3d90cbc95b777f6f36fef6fbf693872ad2f657300eac03d8f745a51",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "artifact-50e250a6c3fec4bf7281a0a0",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "identity-f67ac00c2c3c223369fa9d4e",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "identity-22a9ad32e9a87e766cad43bc",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "identity-a87b75e9bf23f213d0632388",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "identity-021e31394395f28ed13dd972",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "identity-605ab5059520bb18b47f66e7",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "identity-2277e24e9002575666c185cc",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "identity-2bfa2036b434d1487242ad68",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "identity-f51cf19b82dffef560fa84d0",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "identity-0d21591b5cc96ad8b1aa2260",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "identity-58efc2c9953b932a3b68f4bf",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "identity-7ffc80adaa9659cef0fdba57",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "identity-5c702168df363fbd121e07fd",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "identity-e1783f36ec893bc5fc02faeb",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "identity-7e27d7b49919251836855169",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "identity-c9809c7a1c907a38885d11d4",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "identity-cc897b454ab7ede5d04dcf0e",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "identity-98777ee405da253ab2149447",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "identity-d100f749d47db1b8c0e7762a",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "records-identity-value",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "identity-a81558aa9743a6480758e185",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ]
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:analytics.carambo.la",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:ap.lijit.com",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:as.casalemedia.com",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:hbopenbid.pubmatic.com",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:ib.adnxs.com",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:ocsp.pki.goog",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:odb.outbrain.com",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:revee.outbrain.com",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:ssc.33across.com",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:us-u.openx.net",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:104.36.115.111",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:151.101.2.2",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:172.217.0.238",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:173.241.244.143",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:23.74.28.9",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:50.31.185.52",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:52.2.229.61",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:52.203.49.123",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:54.236.163.4",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:54.87.174.85",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:63.251.114.137",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:64.74.236.18",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:68.67.179.197",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:http://analytics.carambo.la/SetAdsRequest",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:http://analytics.carambo.la/SetHbBidRequestProto",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:http://ap.lijit.com/rtb/bid?src=prebid_prebid_1.26.0",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:http://as.casalemedia.com/headerstats?s=282603&u=http%3A%2F%2Ftime.com%2F5455078%2Fapple-ipad-pro-2018-review%2F&v=3",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:http://hbopenbid.pubmatic.com/translator?source=index-client",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:http://hbopenbid.pubmatic.com/translator?source=prebid-client",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:http://ib.adnxs.com/ut/v3/prebid",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:http://ocsp.pki.goog/GTSGIAG3",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:http://odb.outbrain.com/utils/get?url=http%3A%2F%2Ftime.com%2F5455078%2Fapple-ipad-pro-2018-review%2F&settings=true&recs=true&widgetJSId=AR_24&key=NANOWDGT01&idx=0&version=01010807&apv=false&sig=47oTMHvb&format=html&rand=23549&winW=1240&winH=671&scrW=1280&scrH=800&adblck=false&ref=",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:http://odb.outbrain.com/utils/get?url=http%3A%2F%2Ftime.com%2F5455078%2Fapple-ipad-pro-2018-review%2F&settings=true&recs=true&widgetJSId=SB_24&key=NANOWDGT01&idx=1&version=01010807&apv=true&sig=47oTMHvb&format=html&rand=26262&lsd=971a9d56-3b13-4c25-a6fd-1208d64ee011&lsdt=1545161651772&t=MV83ZWE2MDA4MWY2ZjFmMmI4NjdiOTgyYzE4NDBhN2FmZl8w&winW=1240&winH=671&scrW=1280&scrH=800&adblck=false&ref=",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:http://odb.outbrain.com/utils/get?url=http%3A%2F%2Ftime.com%2F5455078%2Fapple-ipad-pro-2018-review%2F&settings=true&recs=true&widgetJSId=SB_30&key=NANOWDGT01&idx=2&version=01010807&apv=true&sig=47oTMHvb&format=html&rand=45545&lsd=971a9d56-3b13-4c25-a6fd-1208d64ee011&lsdt=1545161651772&t=MV83ZWE2MDA4MWY2ZjFmMmI4NjdiOTgyYzE4NDBhN2FmZl8w&winW=1240&winH=671&scrW=1280&scrH=800&adblck=false&ref=",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:http://revee.outbrain.com/page/update",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:http://ssc.33across.com/api/exchange",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:http://us-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=eab9ff18-1f65-4a26-8531-cb990181cabb&gdpr=0",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      },
      {
        "type": "has-review-candidate",
        "source": "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14",
        "target": "ioc:http://us-u.openx.net/w/1.0/pd?plm=6&ph=eab9ff18-1f65-4a26-8531-cb990181cabb&gdpr=0",
        "source_refs": [
          "log-pcap:0c443755-98f4-45dd-a9c4-e04e0415fe14"
        ],
        "interpretation": "Not automatic maliciousness confirmation"
      }
    ],
    "timeline": [
      {
        "at": "2026-09-22T18:30:11.323Z",
        "event": "Added Log/PCAP analysis 2018-12-18-traffic-analysis-exercise.pcap",
        "source": "Log/PCAP analysis 2018-12-18-traffic-analysis-exercise.pcap",
        "actor_count": 0,
        "report_count": 0,
        "technique_count": 2
      }
    ],
    "created_at": "2026-09-22T18:30:04.462177+00:00",
    "updated_at": "2026-09-22T18:30:11.372761+00:00"
  }
}