{ "analysis_id": "f4c6d05d-a600-4616-9c66-c96965645a65", "session_id": "8ebc3993-dc06-42b5-b19b-dfde2feb75a3", "status": "completed", "filename": "2019-01-28-traffic-analysis-exercise.pcap", "source_sha256": "2fc08b2bcdd1be009dab7cea877464e6ce9f93c65bc3e45b1583266e164408db", "source_size_bytes": 2452574, "schema_version": "pcap-analysis-v1", "semantic_sha256": "ab7a82d96e9823701e95f900ce1b3e1865a929208fd4c7742f02dbedcc5a2b69", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "summary": "Decoded 3690 packets across 12 IP endpoints and 118 transport flows. Observed 52 DNS events, 9 HTTP requests, 8 TLS ClientHello events, and 2 recovered file/message object(s). Deterministic rules produced 4 finding(s): 0 high, 0 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2019-01-28-traffic-analysis-exercise.pcap\nCapture SHA-256: `2fc08b2bcdd1be009dab7cea877464e6ce9f93c65bc3e45b1583266e164408db`\nSemantic result SHA-256: `ab7a82d96e9823701e95f900ce1b3e1865a929208fd4c7742f02dbedcc5a2b69`\nAnalyzer manifest SHA-256: `1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0`\n\n## Executive summary\n\nDecoded 3690 packets across 12 IP endpoints and 118 transport flows. Observed 52 DNS events, 9 HTTP requests, 8 TLS ClientHello events, and 2 recovered file/message object(s). Deterministic rules produced 4 finding(s): 0 high, 0 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 3690\n- Duration: 746.993131 seconds\n- Captured bytes: 2393510\n- Endpoints: 12\n- Flows: 118\n\n## Deterministic findings\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 57 / TCP stream 1, frame 59 / TCP stream 1, frame 61 / TCP stream 1, frame 63 / TCP stream 1, frame 167 / TCP stream 1.\n\nMetrics: `{\"destination\":\"172.17.8.2\",\"event_count\":21,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"172.17.8.109\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 130 / TCP stream 10, frame 148 / TCP stream 10, frame 151 / TCP stream 10, frame 203 / TCP stream 13, frame 220 / TCP stream 13.\n\nMetrics: `{\"destination\":\"172.17.8.2\",\"event_count\":41,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"172.17.8.109\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 58 / TCP stream 1, frame 60 / TCP stream 1, frame 62 / TCP stream 1, frame 64 / TCP stream 1, frame 168 / TCP stream 1.\n\nMetrics: `{\"destination\":\"172.17.8.109\",\"event_count\":21,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"172.17.8.2\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 132 / TCP stream 10, frame 150 / TCP stream 10, frame 205 / TCP stream 13, frame 222 / TCP stream 13, frame 224 / TCP stream 13.\n\nMetrics: `{\"destination\":\"172.17.8.109\",\"event_count\":33,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"172.17.8.2\"}`\n\n## ATT&CK candidates\n\n- No deterministic ATT&CK candidates.\n\n## Identities\n\n- account: `dunn-windows-pc$`; client IPs: 172.17.8.109; frames: 24, 32, 34, 46, 75\n- account: `margaret.dunn`; client IPs: 172.17.8.109; frames: 604, 612, 614, 626, 648\n- hostname: `Dunn-Windows-PC`; client IPs: 172.17.8.109; frames: 409, 1058, 1980, 1, 154\n- netbios-group: `TIMBERSHADE`; client IPs: unbound subject; frames: 2, 176, 387, 404\n\n## Observed network and file inventory — not an IOC verdict\n\n- domain: `3.10.214.10.in-addr.arpa`; roles: dns-query\n- domain: `dns.msftncsi.com`; roles: dns-query\n- domain: `dunn-windows-pc.timbershade.info`; roles: dns-query\n- domain: `isatap.localdomain`; roles: dns-query\n- domain: `isatap.timbershade.info`; roles: dns-query\n- domain: `timbershade-dc.timbershade.info`; roles: dns-query\n- domain: `timbershade.info`; roles: dns-query\n- domain: `timbershade.info.timbershade.info`; roles: dns-query\n- domain: `wpad.localdomain`; roles: dns-query\n- domain: `wpad.timbershade.info`; roles: dns-query\n- domain: `www.download.windowsupdate.com`; roles: dns-query, http-host\n- domain: `www.msftncsi.com`; roles: dns-query, http-host\n- ipv4: `131.107.255.255`; roles: dns-answer\n- ipv4: `172.17.8.109`; roles: dns-answer, network-endpoint\n- ipv4: `172.17.8.2`; roles: dns-answer, network-endpoint\n- ipv4: `172.17.8.255`; roles: network-endpoint\n- ipv4: `192.241.220.183`; roles: network-endpoint\n- ipv4: `204.2.193.162`; roles: dns-answer\n- ipv4: `204.2.193.184`; roles: dns-answer, network-endpoint\n- ipv4: `216.239.94.252`; roles: network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.50.224.56`; roles: dns-answer\n- ipv4: `23.50.224.8`; roles: dns-answer, network-endpoint\n- ipv4: `239.255.255.250`; roles: http-host, network-endpoint\n- ipv4: `255.255.255.255`; roles: network-endpoint\n- ipv4: `91.121.30.169`; roles: http-host, network-endpoint\n- ipv6: `fd3e:4f5a:5b81::1`; roles: dns-answer\n- ja3: `74927e242d6c3febf8cb9cab10a7f889`; roles: tls-client-fingerprint\n- sha256: `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; roles: exported-object\n- sha256: `9f6e3e65aedca997c6445329663bd1d279392a34cfda7d1b56461eb41641fa08`; roles: exported-object\n- url: `http://239.255.255.250:1900*`; roles: http-request\n- url: `http://91.121.30.169:8000/91msE95B/actiV.bin`; roles: http-request\n- url: `http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab`; roles: http-request\n- url: `http://www.msftncsi.com/ncsi.txt`; roles: http-request\n- user_agent: `Microsoft NCSI`; roles: http-client\n- user_agent: `Microsoft-CryptoAPI/6.1`; roles: http-client\n- exported object `actiV.bin`; SHA-256 `9f6e3e65aedca997c6445329663bd1d279392a34cfda7d1b56461eb41641fa08`; size 155648 bytes\n SHA-1: `1be37077fb27bf26d83ceae3903c50e0b6b43874`; MD5: `57a42e1b04fe508838ad375dd707c0b0`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"172.17.8.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":802,\"response_frame\":983,\"server_ip\":\"91.121.30.169\",\"status_code\":\"200\",\"tcp_stream\":50,\"url\":\"http://91.121.30.169:8000/91msE95B/actiV.bin\"}]`.\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":155648,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":\"executable\"}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":155648,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ncsi.txt`; SHA-256 `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; size 14 bytes\n SHA-1: `33bf88d5b82df3723d5863c7d23445e345828904`; MD5: `cd5a4d3fdd5bffc16bf959ef75cf37bc`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"172.17.8.109\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":445,\"response_frame\":447,\"server_ip\":\"23.50.224.8\",\"status_code\":\"200\",\"tcp_stream\":27,\"url\":\"http://www.msftncsi.com/ncsi.txt\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":14,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n\n## Actor similarity leads\n\n- No actor lead was calculated.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `f5e8f9f7b35c4de65ced40a8c75691fb8f84ac7827a01e79f2fd3fa14e44dfde`; recorded 2026-09-22T16:08:49.520398+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":37,\"observable_limit\":5000,\"observables_checked\":37,\"observables_total\":37,\"prior_case_limit_reached\":true,\"prior_cases_checked\":50,\"truncated\":false}`\n\n- Prior analysis `5bff54cd-16de-44cb-a009-c88818ce138f` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `bd9602ed-341a-4123-aae3-9fafa5731518` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `0bb7a995-231c-4046-95ec-acea419eb7b4` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `d4027bcf-0ef6-4e3c-a68a-68dfe35adb33` shares 8 observations. This does not establish a common campaign.\n- Prior analysis `8879e360-655c-4073-beb9-68018699a4d4` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `961bdc9a-7460-440f-a246-f55748149bcc` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `1c2e6d58-c62a-4009-939b-3aa82de281a2` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `76f521c2-4e4a-41d5-95ad-a44fd9887dd8` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `fa0da8be-03fb-404d-a526-6c99c6b4f000` shares 7 observations. This does not establish a common campaign.\n- Prior analysis `05851801-c224-489b-b9da-9e5d035c60b4` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `d9aa0de8-e06d-40b7-bffc-2e1af3c53ea0` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `246dbce6-c561-4434-bedb-dd496ba758d2` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `c66676ab-7276-4989-8c27-65017a63c2ba` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `476c88cb-8e1a-42e4-a8bd-e2ad2e63b0cd` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `044c22d0-fd65-4c60-8644-c22ff5e1b31c` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `73129515-519f-4544-905f-145c9d2de3d8` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `5ddffc9a-7544-4749-b7bc-17ad98beaadb` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `fc2de8b3-a6ce-4024-9d9b-5602034db53d` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `b12014b8-9e64-4e70-bdb8-90620d23ac22` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `ada03a66-9d3d-4c08-b448-f9758ac8bac5` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `0b13588f-0835-4e15-9f97-8a9411ad7f7f` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `92de15ed-01f0-4a43-8105-a56b60130430` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `fdf1584a-1c2d-4a49-92b2-8dcb98436eb0` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `fab22e38-ca53-4105-924e-f5722b5f53fe` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `b60c4dbb-eb8f-46a7-89b9-24606fd43e46` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `8174eaa7-e189-467f-b05e-fb7397bfcf16` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `e37603cf-d241-45ee-95ec-bcf92a063147` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `7c54479c-cce3-4570-80c9-69d03571a645` shares 4 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":2,\"export_status\":\"completed\",\"exported_objects\":2,\"hashed_bytes\":155662,\"hashed_objects\":2,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":2,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":2}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 4/4, identities 4/4, observables 37/37, artifacts 2/2. Full returned inventory is in the JSON result.\n\n## Evidence-backed IOC assessment\n\n34 typed observations; 0 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.\n\nPolicy: `pcap-assessment-v3`; assessment SHA-256: `11e7180a9adf28038c2964e66a13d721736fb68d55b96aeaff6601db461a24c7`.\n\n\nOrdinary observations remain in the capture inventory; they are not declared malicious IOCs.\n\nReputation snapshot: `10df7878459e5f677df532f14d5db840559509e5c5b293b279433a9171e677c0`; updated 2026-09-22T17:47:27.775449+00:00. Each target retains its query time. Coverage: `{\"active_scans\":0,\"batch_results\":[{\"observable_id\":\"observable-fff825e4111b97ccf1d4275e\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-fff825e4111b97ccf1d4275e\",\"provider\":\"threatfox\",\"status\":\"not_found\"}],\"batch_targets\":1,\"cache_hits\":0,\"full_urls_disclosed\":0,\"payload_uploads\":0,\"provider_lookups_started\":1,\"retained_targets\":11,\"targets_omitted\":0}`.\n- No detections, no record, missing credentials and provider errors do not mean benign.\n- Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.\n- A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.\n- Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure.\n", "result": { "flows": [ { "bytes": 2516, "stream": 0, "flow_id": "flow-ec4e4f6883d68a169209634f", "packets": 25, "transport": "udp", "last_frame": 2009, "first_frame": 1, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.255", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 2516, "last_seen_epoch": "1548712552.845075", "responder_bytes": 0, "first_seen_epoch": "1548711854.050143" }, { "bytes": 261, "stream": 1, "flow_id": "flow-5eb2f6f5ddfc69f928d4947c", "packets": 2, "transport": "udp", "last_frame": 4, "first_frame": 3, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 50112, "responder_port": 53, "initiator_bytes": 97, "last_seen_epoch": "1548711854.062853", "responder_bytes": 164, "first_seen_epoch": "1548711854.061892" }, { "bytes": 198, "stream": 2, "flow_id": "flow-cf3ab9375f21009ccdf99a4a", "packets": 2, "transport": "udp", "last_frame": 6, "first_frame": 5, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 57492, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1548711854.065534", "responder_bytes": 107, "first_seen_epoch": "1548711854.065444" }, { "bytes": 453, "stream": 3, "flow_id": "flow-09f83a71c595c169c9f0b8e5", "packets": 2, "transport": "udp", "last_frame": 8, "first_frame": 7, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 57494, "responder_port": 389, "initiator_bytes": 216, "last_seen_epoch": "1548711854.073427", "responder_bytes": 237, "first_seen_epoch": "1548711854.073427" }, { "bytes": 453, "stream": 4, "flow_id": "flow-8673e6a99160ef8590cbd57a", "packets": 2, "transport": "udp", "last_frame": 10, "first_frame": 9, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 57495, "responder_port": 389, "initiator_bytes": 216, "last_seen_epoch": "1548711854.075144", "responder_bytes": 237, "first_seen_epoch": "1548711854.074919" }, { "bytes": 2380, "stream": 0, "flow_id": "flow-40d40b9e99fd7503d005fd9b", "packets": 18, "transport": "tcp", "last_frame": 540, "first_frame": 11, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49155, "responder_port": 135, "initiator_bytes": 1270, "last_seen_epoch": "1548711883.016856", "responder_bytes": 1110, "first_seen_epoch": "1548711854.170069" }, { "bytes": 10588, "stream": 1, "flow_id": "flow-8dfc0b7de9dd468fbc144da4", "packets": 37, "transport": "tcp", "last_frame": 544, "first_frame": 18, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49156, "responder_port": 49155, "initiator_bytes": 7108, "last_seen_epoch": "1548711913.071572", "responder_bytes": 3480, "first_seen_epoch": "1548711854.173012" }, { "bytes": 1008, "stream": 2, "flow_id": "flow-3b08d953e31105e4be838eed", "packets": 8, "transport": "tcp", "last_frame": 28, "first_frame": 21, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49157, "responder_port": 88, "initiator_bytes": 476, "last_seen_epoch": "1548711854.1927", "responder_bytes": 532, "first_seen_epoch": "1548711854.189404" }, { "bytes": 2535, "stream": 3, "flow_id": "flow-1812b354137db0073b70a049", "packets": 10, "transport": "tcp", "last_frame": 38, "first_frame": 29, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49158, "responder_port": 88, "initiator_bytes": 610, "last_seen_epoch": "1548711854.204424", "responder_bytes": 1925, "first_seen_epoch": "1548711854.202793" }, { "bytes": 4006, "stream": 4, "flow_id": "flow-701504199a7a03f5ea2c77f1", "packets": 12, "transport": "tcp", "last_frame": 50, "first_frame": 39, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49159, "responder_port": 88, "initiator_bytes": 2014, "last_seen_epoch": "1548711854.208393", "responder_bytes": 1992, "first_seen_epoch": "1548711854.205896" }, { "bytes": 6844, "stream": 5, "flow_id": "flow-93635855350982cf9f7f429b", "packets": 24, "transport": "tcp", "last_frame": 525, "first_frame": 65, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49160, "responder_port": 445, "initiator_bytes": 4856, "last_seen_epoch": "1548711871.107009", "responder_bytes": 1988, "first_seen_epoch": "1548711854.240693" }, { "bytes": 1008, "stream": 6, "flow_id": "flow-655894142f364f0ca602f619", "packets": 8, "transport": "tcp", "last_frame": 79, "first_frame": 72, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49161, "responder_port": 88, "initiator_bytes": 476, "last_seen_epoch": "1548711854.275848", "responder_bytes": 532, "first_seen_epoch": "1548711854.273303" }, { "bytes": 2535, "stream": 7, "flow_id": "flow-000917ac3f798b7a32f8a280", "packets": 10, "transport": "tcp", "last_frame": 89, "first_frame": 80, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49162, "responder_port": 88, "initiator_bytes": 610, "last_seen_epoch": "1548711854.288782", "responder_bytes": 1925, "first_seen_epoch": "1548711854.286371" }, { "bytes": 3972, "stream": 8, "flow_id": "flow-c977d95e14633f8c57bcf3e5", "packets": 12, "transport": "tcp", "last_frame": 101, "first_frame": 90, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49163, "responder_port": 88, "initiator_bytes": 1996, "last_seen_epoch": "1548711854.293786", "responder_bytes": 1976, "first_seen_epoch": "1548711854.290315" }, { "bytes": 3671, "stream": 9, "flow_id": "flow-1dee4aa9625b9b00b35dcde5", "packets": 12, "transport": "tcp", "last_frame": 113, "first_frame": 102, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49164, "responder_port": 88, "initiator_bytes": 1829, "last_seen_epoch": "1548711854.295911", "responder_bytes": 1842, "first_seen_epoch": "1548711854.294157" }, { "bytes": 303, "stream": 5, "flow_id": "flow-e003c6ba5e31cc52c0e08cce", "packets": 2, "transport": "udp", "last_frame": 118, "first_frame": 117, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 55475, "responder_port": 53, "initiator_bytes": 118, "last_seen_epoch": "1548711854.297327", "responder_bytes": 185, "first_seen_epoch": "1548711854.297327" }, { "bytes": 453, "stream": 6, "flow_id": "flow-ecbacdbc8b3347658bb5e6d3", "packets": 2, "transport": "udp", "last_frame": 122, "first_frame": 121, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 55476, "responder_port": 389, "initiator_bytes": 216, "last_seen_epoch": "1548711854.298699", "responder_bytes": 237, "first_seen_epoch": "1548711854.298698" }, { "bytes": 5538, "stream": 10, "flow_id": "flow-742b96ec1e224aeb6ac0a4f6", "packets": 14, "transport": "tcp", "last_frame": 153, "first_frame": 127, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49166, "responder_port": 389, "initiator_bytes": 2624, "last_seen_epoch": "1548711854.419345", "responder_bytes": 2914, "first_seen_epoch": "1548711854.411293" }, { "bytes": 4006, "stream": 11, "flow_id": "flow-184346d09780e4213813afcd", "packets": 12, "transport": "tcp", "last_frame": 146, "first_frame": 134, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49167, "responder_port": 88, "initiator_bytes": 2014, "last_seen_epoch": "1548711854.416771", "responder_bytes": 1992, "first_seen_epoch": "1548711854.4139" }, { "bytes": 261, "stream": 7, "flow_id": "flow-e5a9d186cbb4a921e15e783d", "packets": 2, "transport": "udp", "last_frame": 180, "first_frame": 179, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 53728, "responder_port": 53, "initiator_bytes": 97, "last_seen_epoch": "1548711855.058966", "responder_bytes": 164, "first_seen_epoch": "1548711855.058824" }, { "bytes": 496, "stream": 8, "flow_id": "flow-074cff88c8c6a9256d686dcd", "packets": 2, "transport": "udp", "last_frame": 182, "first_frame": 181, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 55479, "responder_port": 389, "initiator_bytes": 259, "last_seen_epoch": "1548711855.060203", "responder_bytes": 237, "first_seen_epoch": "1548711855.060043" }, { "bytes": 4563, "stream": 12, "flow_id": "flow-891563699de61438ea1da9c0", "packets": 20, "transport": "tcp", "last_frame": 538, "first_frame": 185, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49168, "responder_port": 49158, "initiator_bytes": 2649, "last_seen_epoch": "1548711883.016681", "responder_bytes": 1914, "first_seen_epoch": "1548711855.160361" }, { "bytes": 9088, "stream": 13, "flow_id": "flow-086ec4973f25f161687c9f36", "packets": 28, "transport": "tcp", "last_frame": 274, "first_frame": 200, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49169, "responder_port": 389, "initiator_bytes": 4419, "last_seen_epoch": "1548711855.374878", "responder_bytes": 4669, "first_seen_epoch": "1548711855.165885" }, { "bytes": 3972, "stream": 14, "flow_id": "flow-7b45f90b799fbbb1931d2e12", "packets": 12, "transport": "tcp", "last_frame": 218, "first_frame": 207, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49170, "responder_port": 88, "initiator_bytes": 1996, "last_seen_epoch": "1548711855.169316", "responder_bytes": 1976, "first_seen_epoch": "1548711855.167812" }, { "bytes": 333, "stream": 9, "flow_id": "flow-07bf9bf371dc1b95edd10dfd", "packets": 2, "transport": "udp", "last_frame": 228, "first_frame": 227, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 51649, "responder_port": 53, "initiator_bytes": 133, "last_seen_epoch": "1548711855.172355", "responder_bytes": 200, "first_seen_epoch": "1548711855.172197" }, { "bytes": 438, "stream": 10, "flow_id": "flow-54865bd420de025e42cba607", "packets": 2, "transport": "udp", "last_frame": 230, "first_frame": 229, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 51650, "responder_port": 389, "initiator_bytes": 194, "last_seen_epoch": "1548711855.173291", "responder_bytes": 244, "first_seen_epoch": "1548711855.173144" }, { "bytes": 348, "stream": 15, "flow_id": "flow-3c4fffb9f0dbd3f0ff0a0e37", "packets": 6, "transport": "tcp", "last_frame": 237, "first_frame": 232, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49171, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1548711855.270318", "responder_bytes": 174, "first_seen_epoch": "1548711855.269322" }, { "bytes": 333, "stream": 11, "flow_id": "flow-4128fee67d3d73aae1dfa531", "packets": 2, "transport": "udp", "last_frame": 241, "first_frame": 240, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 62964, "responder_port": 53, "initiator_bytes": 133, "last_seen_epoch": "1548711855.271285", "responder_bytes": 200, "first_seen_epoch": "1548711855.271153" }, { "bytes": 438, "stream": 12, "flow_id": "flow-7b40be79da55bd3b387052b2", "packets": 2, "transport": "udp", "last_frame": 243, "first_frame": 242, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 62965, "responder_port": 389, "initiator_bytes": 194, "last_seen_epoch": "1548711855.27219", "responder_bytes": 244, "first_seen_epoch": "1548711855.272075" }, { "bytes": 348, "stream": 16, "flow_id": "flow-cf4eeff0e5d6ace347320e94", "packets": 6, "transport": "tcp", "last_frame": 252, "first_frame": 246, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49172, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1548711855.37042", "responder_bytes": 174, "first_seen_epoch": "1548711855.369553" }, { "bytes": 348, "stream": 17, "flow_id": "flow-6b0a861d2cd02dd9b27f3555", "packets": 6, "transport": "tcp", "last_frame": 260, "first_frame": 254, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49173, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1548711855.371912", "responder_bytes": 174, "first_seen_epoch": "1548711855.371155" }, { "bytes": 348, "stream": 18, "flow_id": "flow-4def329a1c4379ee9d244dca", "packets": 6, "transport": "tcp", "last_frame": 268, "first_frame": 262, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49174, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1548711855.373813", "responder_bytes": 174, "first_seen_epoch": "1548711855.37308" }, { "bytes": 344, "stream": 13, "flow_id": "flow-5bdeba3bdb7018a693bf21eb", "packets": 2, "transport": "udp", "last_frame": 276, "first_frame": 275, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 54441, "responder_port": 53, "initiator_bytes": 133, "last_seen_epoch": "1548711855.401703", "responder_bytes": 211, "first_seen_epoch": "1548711855.401511" }, { "bytes": 282, "stream": 14, "flow_id": "flow-5df8a3822c665c0a640ca2ee", "packets": 2, "transport": "udp", "last_frame": 278, "first_frame": 277, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 51404, "responder_port": 53, "initiator_bytes": 102, "last_seen_epoch": "1548711855.402227", "responder_bytes": 180, "first_seen_epoch": "1548711855.402134" }, { "bytes": 8127, "stream": 19, "flow_id": "flow-3a0421208309a127a4e7d7d1", "packets": 18, "transport": "tcp", "last_frame": 400, "first_frame": 279, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49175, "responder_port": 389, "initiator_bytes": 3371, "last_seen_epoch": "1548711855.910242", "responder_bytes": 4756, "first_seen_epoch": "1548711855.403569" }, { "bytes": 3907, "stream": 20, "flow_id": "flow-1d14333c6d1af28354862492", "packets": 12, "transport": "tcp", "last_frame": 301, "first_frame": 290, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49176, "responder_port": 88, "initiator_bytes": 1975, "last_seen_epoch": "1548711855.416791", "responder_bytes": 1932, "first_seen_epoch": "1548711855.415376" }, { "bytes": 3697, "stream": 21, "flow_id": "flow-e7b0e17433e42bde2eca59e3", "packets": 12, "transport": "tcp", "last_frame": 315, "first_frame": 304, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49177, "responder_port": 88, "initiator_bytes": 1835, "last_seen_epoch": "1548711855.420691", "responder_bytes": 1862, "first_seen_epoch": "1548711855.419317" }, { "bytes": 3406, "stream": 22, "flow_id": "flow-6438ec98ad0fefa6e59b7ccd", "packets": 13, "transport": "tcp", "last_frame": 386, "first_frame": 316, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49178, "responder_port": 389, "initiator_bytes": 2550, "last_seen_epoch": "1548711855.437814", "responder_bytes": 856, "first_seen_epoch": "1548711855.420806" }, { "bytes": 3357, "stream": 23, "flow_id": "flow-48557473e96be1b104ee0c2d", "packets": 10, "transport": "tcp", "last_frame": 328, "first_frame": 317, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49179, "responder_port": 88, "initiator_bytes": 2929, "last_seen_epoch": "1548711855.422214", "responder_bytes": 428, "first_seen_epoch": "1548711855.420807" }, { "bytes": 12494, "stream": 24, "flow_id": "flow-56a9606745b5e78299e44f50", "packets": 44, "transport": "tcp", "last_frame": 532, "first_frame": 339, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49180, "responder_port": 445, "initiator_bytes": 7362, "last_seen_epoch": "1548711871.107792", "responder_bytes": 5132, "first_seen_epoch": "1548711855.427959" }, { "bytes": 3972, "stream": 25, "flow_id": "flow-45eabc1eeeef05571988151c", "packets": 12, "transport": "tcp", "last_frame": 355, "first_frame": 344, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49181, "responder_port": 88, "initiator_bytes": 1996, "last_seen_epoch": "1548711855.430004", "responder_bytes": 1976, "first_seen_epoch": "1548711855.428775" }, { "bytes": 3671, "stream": 26, "flow_id": "flow-78b2c0e79473e816994bdf05", "packets": 12, "transport": "tcp", "last_frame": 367, "first_frame": 356, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49182, "responder_port": 88, "initiator_bytes": 1829, "last_seen_epoch": "1548711855.430885", "responder_bytes": 1842, "first_seen_epoch": "1548711855.430095" }, { "bytes": 150, "stream": 15, "flow_id": "flow-8f52690454f806861280b4ef", "packets": 2, "transport": "udp", "last_frame": 414, "first_frame": 408, "initiator_ip": "172.17.8.109", "responder_ip": "224.0.0.252", "initiator_port": 63543, "responder_port": 5355, "initiator_bytes": 150, "last_seen_epoch": "1548711857.011958", "responder_bytes": 0, "first_seen_epoch": "1548711856.917465" }, { "bytes": 1026, "stream": 16, "flow_id": "flow-98a2a1e9ab68e1ceba0e891f", "packets": 3, "transport": "udp", "last_frame": 1980, "first_frame": 409, "initiator_ip": "172.17.8.109", "responder_ip": "255.255.255.255", "initiator_port": 68, "responder_port": 67, "initiator_bytes": 1026, "last_seen_epoch": "1548712551.309633", "responder_bytes": 0, "first_seen_epoch": "1548711856.923768" }, { "bytes": 1026, "stream": 17, "flow_id": "flow-3d4150066f56831894b0b1d7", "packets": 3, "transport": "udp", "last_frame": 1981, "first_frame": 410, "initiator_ip": "172.17.8.2", "responder_ip": "172.17.8.109", "initiator_port": 67, "responder_port": 68, "initiator_bytes": 1026, "last_seen_epoch": "1548712551.310063", "responder_bytes": 0, "first_seen_epoch": "1548711856.923987" }, { "bytes": 240, "stream": 18, "flow_id": "flow-eafd5b0ae6e84567bfeb3e2a", "packets": 2, "transport": "udp", "last_frame": 412, "first_frame": 411, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 53764, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1548711856.927211", "responder_bytes": 159, "first_seen_epoch": "1548711856.926984" }, { "bytes": 128, "stream": 19, "flow_id": "flow-291da80a4e29b63dabbeb2d0", "packets": 2, "transport": "udp", "last_frame": 415, "first_frame": 413, "initiator_ip": "172.17.8.109", "responder_ip": "224.0.0.252", "initiator_port": 54171, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1548711857.02167", "responder_bytes": 0, "first_seen_epoch": "1548711856.927754" }, { "bytes": 198, "stream": 20, "flow_id": "flow-c01c2eebee1252e63fca89b4", "packets": 2, "transport": "udp", "last_frame": 423, "first_frame": 422, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 51145, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1548711857.450982", "responder_bytes": 107, "first_seen_epoch": "1548711857.450893" }, { "bytes": 244, "stream": 21, "flow_id": "flow-2619b9aa41d3957131ae83a1", "packets": 2, "transport": "udp", "last_frame": 428, "first_frame": 426, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 61929, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1548711857.457941", "responder_bytes": 161, "first_seen_epoch": "1548711857.457724" }, { "bytes": 150, "stream": 22, "flow_id": "flow-f3eeef722d7a76bf07f01187", "packets": 2, "transport": "udp", "last_frame": 429, "first_frame": 427, "initiator_ip": "172.17.8.109", "responder_ip": "224.0.0.252", "initiator_port": 62725, "responder_port": 5355, "initiator_bytes": 150, "last_seen_epoch": "1548711857.552916", "responder_bytes": 0, "first_seen_epoch": "1548711857.457725" }, { "bytes": 231, "stream": 23, "flow_id": "flow-e9dbe653b31cdabce31bdff4", "packets": 2, "transport": "udp", "last_frame": 431, "first_frame": 430, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 52343, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1548711857.601268", "responder_bytes": 153, "first_seen_epoch": "1548711857.573963" }, { "bytes": 198, "stream": 24, "flow_id": "flow-4d2d0fe94b1b7814e739bbda", "packets": 2, "transport": "udp", "last_frame": 437, "first_frame": 436, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 51080, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1548711858.950439", "responder_bytes": 107, "first_seen_epoch": "1548711858.950153" }, { "bytes": 220, "stream": 25, "flow_id": "flow-3ddd28037cdc030d91e64e34", "packets": 2, "transport": "udp", "last_frame": 439, "first_frame": 438, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 123, "responder_port": 123, "initiator_bytes": 110, "last_seen_epoch": "1548711858.953207", "responder_bytes": 110, "first_seen_epoch": "1548711858.950914" }, { "bytes": 258, "stream": 26, "flow_id": "flow-191f4f00fcc966c272c411ed", "packets": 2, "transport": "udp", "last_frame": 441, "first_frame": 440, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 52143, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1548711859.547107", "responder_bytes": 182, "first_seen_epoch": "1548711859.498695" }, { "bytes": 778, "stream": 27, "flow_id": "flow-245e209d75a6a6f5dde00e74", "packets": 9, "transport": "tcp", "last_frame": 450, "first_frame": 442, "initiator_ip": "172.17.8.109", "responder_ip": "23.50.224.8", "initiator_port": 49183, "responder_port": 80, "initiator_bytes": 379, "last_seen_epoch": "1548711859.895944", "responder_bytes": 399, "first_seen_epoch": "1548711859.549622" }, { "bytes": 262, "stream": 27, "flow_id": "flow-3eb691347a1f2975ab50505a", "packets": 2, "transport": "udp", "last_frame": 452, "first_frame": 451, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 64053, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1548711861.934873", "responder_bytes": 170, "first_seen_epoch": "1548711861.93467" }, { "bytes": 320, "stream": 28, "flow_id": "flow-3a90e45c6d27478c466b324b", "packets": 2, "transport": "udp", "last_frame": 454, "first_frame": 453, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 52192, "responder_port": 53, "initiator_bytes": 160, "last_seen_epoch": "1548711861.936735", "responder_bytes": 160, "first_seen_epoch": "1548711861.936065" }, { "bytes": 7294, "stream": 28, "flow_id": "flow-3d4221617b5bca6ef665b34d", "packets": 22, "transport": "tcp", "last_frame": 520, "first_frame": 455, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49185, "responder_port": 389, "initiator_bytes": 3483, "last_seen_epoch": "1548711865.048399", "responder_bytes": 3811, "first_seen_epoch": "1548711865.020933" }, { "bytes": 4245, "stream": 29, "flow_id": "flow-48e630ff282bae17c279e2c3", "packets": 14, "transport": "tcp", "last_frame": 517, "first_frame": 474, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49186, "responder_port": 389, "initiator_bytes": 3429, "last_seen_epoch": "1548711865.048154", "responder_bytes": 816, "first_seen_epoch": "1548711865.029931" }, { "bytes": 1008, "stream": 30, "flow_id": "flow-43a00cfdcd1622bd9683846d", "packets": 8, "transport": "tcp", "last_frame": 490, "first_frame": 483, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49187, "responder_port": 88, "initiator_bytes": 476, "last_seen_epoch": "1548711865.034422", "responder_bytes": 532, "first_seen_epoch": "1548711865.033676" }, { "bytes": 2535, "stream": 31, "flow_id": "flow-b5fe93baf217cee47ff0f0fb", "packets": 10, "transport": "tcp", "last_frame": 500, "first_frame": 491, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49188, "responder_port": 88, "initiator_bytes": 610, "last_seen_epoch": "1548711865.045215", "responder_bytes": 1925, "first_seen_epoch": "1548711865.044129" }, { "bytes": 3845, "stream": 32, "flow_id": "flow-51ef288a54d6d17a4f2eedf0", "packets": 12, "transport": "tcp", "last_frame": 512, "first_frame": 501, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49189, "responder_port": 88, "initiator_bytes": 1941, "last_seen_epoch": "1548711865.046544", "responder_bytes": 1904, "first_seen_epoch": "1548711865.045523" }, { "bytes": 1280, "stream": 33, "flow_id": "flow-7e83fc6886bc585b4b133c25", "packets": 12, "transport": "tcp", "last_frame": 572, "first_frame": 545, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49190, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1548711977.336643", "responder_bytes": 562, "first_seen_epoch": "1548711962.305024" }, { "bytes": 1471, "stream": 34, "flow_id": "flow-b473319debf4cded221baefa", "packets": 12, "transport": "tcp", "last_frame": 570, "first_frame": 552, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49191, "responder_port": 49155, "initiator_bytes": 877, "last_seen_epoch": "1548711977.336473", "responder_bytes": 594, "first_seen_epoch": "1548711962.306188" }, { "bytes": 1050, "stream": 29, "flow_id": "flow-1f55d9fe0e9dddac55c24fbe", "packets": 6, "transport": "udp", "last_frame": 576, "first_frame": 562, "initiator_ip": "172.17.8.109", "responder_ip": "239.255.255.250", "initiator_port": 52195, "responder_port": 1900, "initiator_bytes": 1050, "last_seen_epoch": "1548711981.315491", "responder_bytes": 0, "first_seen_epoch": "1548711974.925375" }, { "bytes": 1280, "stream": 35, "flow_id": "flow-16649cd41b1c18e19cb5bf11", "packets": 12, "transport": "tcp", "last_frame": 600, "first_frame": 577, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49192, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1548712109.435671", "responder_bytes": 562, "first_seen_epoch": "1548712094.795441" }, { "bytes": 1647, "stream": 36, "flow_id": "flow-78e3f4c04a3b8e51e3cbfd63", "packets": 12, "transport": "tcp", "last_frame": 598, "first_frame": 584, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49193, "responder_port": 49155, "initiator_bytes": 877, "last_seen_epoch": "1548712109.435669", "responder_bytes": 770, "first_seen_epoch": "1548712094.796454" }, { "bytes": 933, "stream": 37, "flow_id": "flow-fa775d5b0bd6487b50ab5ecd", "packets": 8, "transport": "tcp", "last_frame": 608, "first_frame": 601, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49194, "responder_port": 88, "initiator_bytes": 463, "last_seen_epoch": "1548712130.966638", "responder_bytes": 470, "first_seen_epoch": "1548712130.965836" }, { "bytes": 2501, "stream": 38, "flow_id": "flow-02709f82df8c53ba6a7e469f", "packets": 10, "transport": "tcp", "last_frame": 618, "first_frame": 609, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49195, "responder_port": 88, "initiator_bytes": 597, "last_seen_epoch": "1548712130.974182", "responder_bytes": 1904, "first_seen_epoch": "1548712130.973115" }, { "bytes": 3718, "stream": 39, "flow_id": "flow-0598005ed5cadf46172c96d1", "packets": 12, "transport": "tcp", "last_frame": 630, "first_frame": 619, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49196, "responder_port": 88, "initiator_bytes": 1844, "last_seen_epoch": "1548712130.974814", "responder_bytes": 1874, "first_seen_epoch": "1548712130.974182" }, { "bytes": 1280, "stream": 40, "flow_id": "flow-56808bfce1a79f2e9f02f20c", "packets": 12, "transport": "tcp", "last_frame": 790, "first_frame": 631, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49197, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1548712144.488935", "responder_bytes": 562, "first_seen_epoch": "1548712131.320326" }, { "bytes": 5735, "stream": 41, "flow_id": "flow-06aaffef5d6b8422199c9c1f", "packets": 22, "transport": "tcp", "last_frame": 989, "first_frame": 638, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49198, "responder_port": 49155, "initiator_bytes": 3706, "last_seen_epoch": "1548712164.535044", "responder_bytes": 2029, "first_seen_epoch": "1548712131.336442" }, { "bytes": 4010, "stream": 42, "flow_id": "flow-173699bc7461a534ee1889f4", "packets": 12, "transport": "tcp", "last_frame": 652, "first_frame": 641, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49199, "responder_port": 88, "initiator_bytes": 2016, "last_seen_epoch": "1548712131.336998", "responder_bytes": 1994, "first_seen_epoch": "1548712131.336443" }, { "bytes": 7622, "stream": 43, "flow_id": "flow-9be29f2b4ab85107a0393dc6", "packets": 34, "transport": "tcp", "last_frame": 1968, "first_frame": 667, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49200, "responder_port": 445, "initiator_bytes": 5616, "last_seen_epoch": "1548712514.532913", "responder_bytes": 2006, "first_seen_epoch": "1548712131.362961" }, { "bytes": 3976, "stream": 44, "flow_id": "flow-7c77ab4074bea27822f48927", "packets": 12, "transport": "tcp", "last_frame": 685, "first_frame": 674, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49201, "responder_port": 88, "initiator_bytes": 1998, "last_seen_epoch": "1548712131.367654", "responder_bytes": 1978, "first_seen_epoch": "1548712131.365288" }, { "bytes": 3675, "stream": 45, "flow_id": "flow-ee746e4f9b1846bf530305da", "packets": 12, "transport": "tcp", "last_frame": 697, "first_frame": 686, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49202, "responder_port": 88, "initiator_bytes": 1831, "last_seen_epoch": "1548712131.367691", "responder_bytes": 1844, "first_seen_epoch": "1548712131.367654" }, { "bytes": 344, "stream": 30, "flow_id": "flow-292ca80483a064e6d9d7e3b4", "packets": 2, "transport": "udp", "last_frame": 713, "first_frame": 712, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 61431, "responder_port": 53, "initiator_bytes": 133, "last_seen_epoch": "1548712131.87", "responder_bytes": 211, "first_seen_epoch": "1548712131.869757" }, { "bytes": 282, "stream": 31, "flow_id": "flow-19c97449a4e54b206d9f697c", "packets": 2, "transport": "udp", "last_frame": 715, "first_frame": 714, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 53898, "responder_port": 53, "initiator_bytes": 102, "last_seen_epoch": "1548712131.871674", "responder_bytes": 180, "first_seen_epoch": "1548712131.871383" }, { "bytes": 5201, "stream": 46, "flow_id": "flow-ace21275e21c06cfd9fc697f", "packets": 14, "transport": "tcp", "last_frame": 774, "first_frame": 716, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49203, "responder_port": 389, "initiator_bytes": 2921, "last_seen_epoch": "1548712132.428276", "responder_bytes": 2280, "first_seen_epoch": "1548712131.872658" }, { "bytes": 3976, "stream": 47, "flow_id": "flow-7fd2f2d150f118c65f964de7", "packets": 12, "transport": "tcp", "last_frame": 730, "first_frame": 719, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49204, "responder_port": 88, "initiator_bytes": 1998, "last_seen_epoch": "1548712131.874769", "responder_bytes": 1978, "first_seen_epoch": "1548712131.873412" }, { "bytes": 3432, "stream": 48, "flow_id": "flow-0d043cfc56a766b88cf7044e", "packets": 13, "transport": "tcp", "last_frame": 769, "first_frame": 737, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49205, "responder_port": 389, "initiator_bytes": 2576, "last_seen_epoch": "1548712131.889046", "responder_bytes": 856, "first_seen_epoch": "1548712131.879229" }, { "bytes": 7501, "stream": 49, "flow_id": "flow-218add669dbdfebc6a1e1966", "packets": 27, "transport": "tcp", "last_frame": 796, "first_frame": 750, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49206, "responder_port": 445, "initiator_bytes": 5337, "last_seen_epoch": "1548712153.626499", "responder_bytes": 2164, "first_seen_epoch": "1548712131.884206" }, { "bytes": 168, "stream": 32, "flow_id": "flow-168729e243d6ed117cf3c5c7", "packets": 2, "transport": "udp", "last_frame": 775, "first_frame": 772, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 52079, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1548712132.439772", "responder_bytes": 92, "first_seen_epoch": "1548712132.410638" }, { "bytes": 180, "stream": 33, "flow_id": "flow-7af9d0de47e2d0d7a51de407", "packets": 2, "transport": "udp", "last_frame": 777, "first_frame": 776, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 53025, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1548712132.464588", "responder_bytes": 104, "first_seen_epoch": "1548712132.440858" }, { "bytes": 166106, "stream": 50, "flow_id": "flow-af701ecc1ec08d0c4f56df31", "packets": 187, "transport": "tcp", "last_frame": 985, "first_frame": 799, "initiator_ip": "172.17.8.109", "responder_ip": "91.121.30.169", "initiator_port": 49207, "responder_port": 8000, "initiator_bytes": 3500, "last_seen_epoch": "1548712158.564252", "responder_bytes": 162606, "first_seen_epoch": "1548712157.670214" }, { "bytes": 1118, "stream": 51, "flow_id": "flow-86ae511488ac21a6e5530cf2", "packets": 9, "transport": "tcp", "last_frame": 1018, "first_frame": 990, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49208, "responder_port": 135, "initiator_bytes": 664, "last_seen_epoch": "1548712222.668066", "responder_bytes": 454, "first_seen_epoch": "1548712211.377035" }, { "bytes": 6329, "stream": 52, "flow_id": "flow-15983ca5d04423f225f361c1", "packets": 21, "transport": "tcp", "last_frame": 1019, "first_frame": 997, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49209, "responder_port": 49155, "initiator_bytes": 4070, "last_seen_epoch": "1548712222.668154", "responder_bytes": 2259, "first_seen_epoch": "1548712211.38172" }, { "bytes": 1280, "stream": 53, "flow_id": "flow-f5f82f7da6411068224ed5cc", "packets": 12, "transport": "tcp", "last_frame": 1284, "first_frame": 1022, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49210, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1548712326.238658", "responder_bytes": 562, "first_seen_epoch": "1548712316.20831" }, { "bytes": 1631, "stream": 54, "flow_id": "flow-5d6fe021c5765ffe54656b8b", "packets": 12, "transport": "tcp", "last_frame": 1282, "first_frame": 1029, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49211, "responder_port": 49155, "initiator_bytes": 877, "last_seen_epoch": "1548712326.238491", "responder_bytes": 754, "first_seen_epoch": "1548712316.209487" }, { "bytes": 168, "stream": 34, "flow_id": "flow-c4e15f3eec99e57b309ddb39", "packets": 2, "transport": "udp", "last_frame": 1037, "first_frame": 1036, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 53026, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1548712316.27496", "responder_bytes": 84, "first_seen_epoch": "1548712316.253847" }, { "bytes": 264, "stream": 35, "flow_id": "flow-e06c817afd0db36ffe2d6eb8", "packets": 2, "transport": "udp", "last_frame": 1039, "first_frame": 1038, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 53027, "responder_port": 53, "initiator_bytes": 93, "last_seen_epoch": "1548712316.275327", "responder_bytes": 171, "first_seen_epoch": "1548712316.275196" }, { "bytes": 260, "stream": 36, "flow_id": "flow-3d2fc8953e15cc1c89171f91", "packets": 2, "transport": "udp", "last_frame": 1041, "first_frame": 1040, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 53028, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1548712316.275521", "responder_bytes": 184, "first_seen_epoch": "1548712316.275423" }, { "bytes": 648, "stream": 37, "flow_id": "flow-2146fa3795a537ac03e6982e", "packets": 3, "transport": "udp", "last_frame": 1050, "first_frame": 1042, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.255", "initiator_port": 138, "responder_port": 138, "initiator_bytes": 648, "last_seen_epoch": "1548712318.330145", "responder_bytes": 0, "first_seen_epoch": "1548712316.300413" }, { "bytes": 104, "stream": 38, "flow_id": "flow-952dc9d2833e004d2c629482", "packets": 1, "transport": "udp", "last_frame": 1044, "first_frame": 1044, "initiator_ip": "172.17.8.2", "responder_ip": "172.17.8.109", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 104, "last_seen_epoch": "1548712316.300655", "responder_bytes": 0, "first_seen_epoch": "1548712316.300655" }, { "bytes": 648, "stream": 39, "flow_id": "flow-78c3bb274a0c421939185da7", "packets": 3, "transport": "udp", "last_frame": 1051, "first_frame": 1045, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 138, "responder_port": 138, "initiator_bytes": 648, "last_seen_epoch": "1548712318.330353", "responder_bytes": 0, "first_seen_epoch": "1548712316.300721" }, { "bytes": 240, "stream": 40, "flow_id": "flow-a70b05ae826d72b3915ac292", "packets": 2, "transport": "udp", "last_frame": 1056, "first_frame": 1055, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 54725, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1548712322.736626", "responder_bytes": 159, "first_seen_epoch": "1548712322.736303" }, { "bytes": 227, "stream": 41, "flow_id": "flow-3269217e50bb94361d79bd38", "packets": 2, "transport": "udp", "last_frame": 1061, "first_frame": 1057, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 64362, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1548712322.770794", "responder_bytes": 151, "first_seen_epoch": "1548712322.737246" }, { "bytes": 12208, "stream": 55, "flow_id": "flow-a3eac27ae31537c29af8011a", "packets": 29, "transport": "tcp", "last_frame": 1102, "first_frame": 1060, "initiator_ip": "172.17.8.109", "responder_ip": "192.241.220.183", "initiator_port": 49212, "responder_port": 3389, "initiator_bytes": 9883, "last_seen_epoch": "1548712323.764394", "responder_bytes": 2325, "first_seen_epoch": "1548712322.7564" }, { "bytes": 128, "stream": 42, "flow_id": "flow-2444c7bec20f2fef02839b83", "packets": 2, "transport": "udp", "last_frame": 1067, "first_frame": 1062, "initiator_ip": "172.17.8.109", "responder_ip": "224.0.0.252", "initiator_port": 60648, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1548712322.877789", "responder_bytes": 0, "first_seen_epoch": "1548712322.77114" }, { "bytes": 340, "stream": 43, "flow_id": "flow-f334a4d5472b994d24a46bac", "packets": 2, "transport": "udp", "last_frame": 1075, "first_frame": 1074, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 54412, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1548712323.075168", "responder_bytes": 250, "first_seen_epoch": "1548712323.021554" }, { "bytes": 1330, "stream": 56, "flow_id": "flow-c71aaf052202dd8b2431a498", "packets": 9, "transport": "tcp", "last_frame": 1930, "first_frame": 1076, "initiator_ip": "172.17.8.109", "responder_ip": "204.2.193.184", "initiator_port": 49213, "responder_port": 80, "initiator_bytes": 584, "last_seen_epoch": "1548712334.264278", "responder_bytes": 746, "first_seen_epoch": "1548712323.076815" }, { "bytes": 620390, "stream": 57, "flow_id": "flow-1e92d75a09619949e4711a39", "packets": 783, "transport": "tcp", "last_frame": 1895, "first_frame": 1105, "initiator_ip": "172.17.8.109", "responder_ip": "192.241.220.183", "initiator_port": 49214, "responder_port": 3389, "initiator_bytes": 18130, "last_seen_epoch": "1548712327.093855", "responder_bytes": 602260, "first_seen_epoch": "1548712324.769968" }, { "bytes": 3043, "stream": 58, "flow_id": "flow-902a2fab6ea7d49b22156b56", "packets": 17, "transport": "tcp", "last_frame": 1912, "first_frame": 1896, "initiator_ip": "172.17.8.109", "responder_ip": "192.241.220.183", "initiator_port": 49215, "responder_port": 3389, "initiator_bytes": 1282, "last_seen_epoch": "1548712328.791519", "responder_bytes": 1761, "first_seen_epoch": "1548712328.114309" }, { "bytes": 3043, "stream": 59, "flow_id": "flow-4e74cbac670109bfe4b488c8", "packets": 17, "transport": "tcp", "last_frame": 1929, "first_frame": 1913, "initiator_ip": "172.17.8.109", "responder_ip": "192.241.220.183", "initiator_port": 49216, "responder_port": 3389, "initiator_bytes": 1282, "last_seen_epoch": "1548712334.259716", "responder_bytes": 1761, "first_seen_epoch": "1548712333.568777" }, { "bytes": 1280, "stream": 60, "flow_id": "flow-89154a8b80055cf748481be2", "packets": 12, "transport": "tcp", "last_frame": 1960, "first_frame": 1931, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49220, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1548712382.956516", "responder_bytes": 562, "first_seen_epoch": "1548712367.937788" }, { "bytes": 5783, "stream": 61, "flow_id": "flow-0106ab76f32e43062662516a", "packets": 22, "transport": "tcp", "last_frame": 1966, "first_frame": 1938, "initiator_ip": "172.17.8.109", "responder_ip": "172.17.8.2", "initiator_port": 49221, "responder_port": 49155, "initiator_bytes": 3754, "last_seen_epoch": "1548712403.02151", "responder_bytes": 2029, "first_seen_epoch": "1548712367.938887" }, { "bytes": 1611, "stream": 62, "flow_id": "flow-dc310d71d4e5bd4da03fdc62", "packets": 10, "transport": "tcp", "last_frame": 1978, "first_frame": 1969, "initiator_ip": "172.17.8.109", "responder_ip": "216.239.94.252", "initiator_port": 49223, "responder_port": 443, "initiator_bytes": 787, "last_seen_epoch": "1548712551.265204", "responder_bytes": 824, "first_seen_epoch": "1548712551.074374" }, { "bytes": 4816, "stream": 63, "flow_id": "flow-07e047c646c1009eede9c75a", "packets": 21, "transport": "tcp", "last_frame": 2003, "first_frame": 1982, "initiator_ip": "172.17.8.109", "responder_ip": "216.239.94.252", "initiator_port": 49224, "responder_port": 443, "initiator_bytes": 2643, "last_seen_epoch": "1548712552.529306", "responder_bytes": 2173, "first_seen_epoch": "1548712551.33327" }, { "bytes": 1592, "stream": 64, "flow_id": "flow-4b5518155dcd4353940b6008", "packets": 10, "transport": "tcp", "last_frame": 2014, "first_frame": 2004, "initiator_ip": "172.17.8.109", "responder_ip": "216.239.94.252", "initiator_port": 49225, "responder_port": 443, "initiator_bytes": 709, "last_seen_epoch": "1548712552.874517", "responder_bytes": 883, "first_seen_epoch": "1548712552.53308" }, { "bytes": 507137, "stream": 65, "flow_id": "flow-8a936202b5a7a001872f5660", "packets": 562, "transport": "tcp", "last_frame": 2576, "first_frame": 2015, "initiator_ip": "172.17.8.109", "responder_ip": "216.239.94.252", "initiator_port": 49226, "responder_port": 443, "initiator_bytes": 10923, "last_seen_epoch": "1548712561.487636", "responder_bytes": 496214, "first_seen_epoch": "1548712554.895619" }, { "bytes": 297286, "stream": 66, "flow_id": "flow-49b9f25bc157f94474ea424d", "packets": 333, "transport": "tcp", "last_frame": 2909, "first_frame": 2577, "initiator_ip": "172.17.8.109", "responder_ip": "216.239.94.252", "initiator_port": 49227, "responder_port": 443, "initiator_bytes": 6519, "last_seen_epoch": "1548712568.071161", "responder_bytes": 290767, "first_seen_epoch": "1548712563.583904" }, { "bytes": 251134, "stream": 67, "flow_id": "flow-46ef3bcfa787e74f73e0190a", "packets": 282, "transport": "tcp", "last_frame": 3191, "first_frame": 2910, "initiator_ip": "172.17.8.109", "responder_ip": "216.239.94.252", "initiator_port": 49228, "responder_port": 443, "initiator_bytes": 5733, "last_seen_epoch": "1548712574.146175", "responder_bytes": 245401, "first_seen_epoch": "1548712570.116276" }, { "bytes": 54021, "stream": 68, "flow_id": "flow-8a3e5124254f2ce0567dc872", "packets": 66, "transport": "tcp", "last_frame": 3257, "first_frame": 3192, "initiator_ip": "172.17.8.109", "responder_ip": "216.239.94.252", "initiator_port": 49229, "responder_port": 443, "initiator_bytes": 1795, "last_seen_epoch": "1548712577.577102", "responder_bytes": 52226, "first_seen_epoch": "1548712576.195152" }, { "bytes": 233232, "stream": 69, "flow_id": "flow-4ac06c61bd7b14df7c22a717", "packets": 371, "transport": "tcp", "last_frame": 3628, "first_frame": 3258, "initiator_ip": "172.17.8.109", "responder_ip": "216.239.94.252", "initiator_port": 49230, "responder_port": 443, "initiator_bytes": 13565, "last_seen_epoch": "1548712583.216623", "responder_bytes": 219667, "first_seen_epoch": "1548712577.585135" }, { "bytes": 1810, "stream": 70, "flow_id": "flow-07df9729c426ba93bfd2e380", "packets": 10, "transport": "tcp", "last_frame": 3638, "first_frame": 3629, "initiator_ip": "172.17.8.109", "responder_ip": "216.239.94.252", "initiator_port": 49231, "responder_port": 443, "initiator_bytes": 927, "last_seen_epoch": "1548712585.631297", "responder_bytes": 883, "first_seen_epoch": "1548712585.353091" }, { "bytes": 4608, "stream": 71, "flow_id": "flow-1e51ca81ade6fc65137385f3", "packets": 21, "transport": "tcp", "last_frame": 3659, "first_frame": 3639, "initiator_ip": "172.17.8.109", "responder_ip": "216.239.94.252", "initiator_port": 49232, "responder_port": 443, "initiator_bytes": 2435, "last_seen_epoch": "1548712586.914064", "responder_bytes": 2173, "first_seen_epoch": "1548712585.63571" }, { "bytes": 1546, "stream": 72, "flow_id": "flow-d029b015b4d008e61e6436d7", "packets": 10, "transport": "tcp", "last_frame": 3669, "first_frame": 3660, "initiator_ip": "172.17.8.109", "responder_ip": "216.239.94.252", "initiator_port": 49233, "responder_port": 443, "initiator_bytes": 663, "last_seen_epoch": "1548712597.192753", "responder_bytes": 883, "first_seen_epoch": "1548712596.307963" }, { "bytes": 4800, "stream": 73, "flow_id": "flow-fc593eb3e30280dbd93729c1", "packets": 21, "transport": "tcp", "last_frame": 3690, "first_frame": 3670, "initiator_ip": "172.17.8.109", "responder_ip": "216.239.94.252", "initiator_port": 49234, "responder_port": 443, "initiator_bytes": 2627, "last_seen_epoch": "1548712601.043274", "responder_bytes": 2173, "first_seen_epoch": "1548712597.197245" } ], "events": { "dns": [ { "kind": "dns", "dst_ip": "172.17.8.2", "fields": { "dns.qry.name": "_ldap._tcp.dc._msdcs.timbershade.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": 53, "event_id": "evt-96964efc8cce3ac3614077bf", "src_port": 50112, "tcp_stream": null, "udp_stream": 1, "frame_number": 3, "timestamp_epoch": "1548711854.061892000" }, { "kind": "dns", "dst_ip": "172.17.8.109", "fields": { "dns.a": "172.17.8.2", "dns.qry.name": "_ldap._tcp.dc._msdcs.timbershade.info", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.2", "dst_port": 50112, "event_id": "evt-1b6d3cd672cb94d2d6f7bb5c", "src_port": 53, "tcp_stream": null, "udp_stream": 1, "frame_number": 4, "timestamp_epoch": "1548711854.062853000" }, { "kind": "dns", "dst_ip": "172.17.8.2", "fields": { "dns.qry.name": "timbershade-dc.timbershade.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": 53, "event_id": "evt-ff2fb5b43f81f9e6833d6270", "src_port": 57492, "tcp_stream": null, "udp_stream": 2, "frame_number": 5, "timestamp_epoch": "1548711854.065444000" }, { "kind": "dns", "dst_ip": "172.17.8.109", "fields": { "dns.a": "172.17.8.2", "dns.qry.name": "timbershade-dc.timbershade.info", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.2", "dst_port": 57492, "event_id": "evt-f8a86d4532ad4b9475b87922", "src_port": 53, "tcp_stream": null, "udp_stream": 2, "frame_number": 6, "timestamp_epoch": "1548711854.065534000" }, { "kind": "dns", "dst_ip": "172.17.8.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.timbershade.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": 53, "event_id": "evt-77cf53d8270e3b024436e4e1", "src_port": 55475, "tcp_stream": null, "udp_stream": 5, "frame_number": 117, "timestamp_epoch": "1548711854.297327000" }, { "kind": "dns", "dst_ip": "172.17.8.109", "fields": { "dns.a": "172.17.8.2", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.timbershade.info", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.2", "dst_port": 55475, "event_id": "evt-4191eceb3e468c38e35a3c84", "src_port": 53, "tcp_stream": null, "udp_stream": 5, "frame_number": 118, "timestamp_epoch": "1548711854.297327000" }, { "kind": "dns", "dst_ip": "172.17.8.2", "fields": { "dns.qry.name": "_ldap._tcp.dc._msdcs.timbershade.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": 53, "event_id": "evt-4109eda51f725fc8df9f1186", "src_port": 53728, "tcp_stream": null, "udp_stream": 7, "frame_number": 179, "timestamp_epoch": "1548711855.058824000" }, { "kind": "dns", "dst_ip": "172.17.8.109", "fields": { "dns.a": "172.17.8.2", "dns.qry.name": "_ldap._tcp.dc._msdcs.timbershade.info", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.2", "dst_port": 53728, "event_id": "evt-2a5b16c627c27c7408d7bd18", "src_port": 53, "tcp_stream": null, "udp_stream": 7, "frame_number": 180, "timestamp_epoch": "1548711855.058966000" }, { "kind": "dns", "dst_ip": "172.17.8.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.timbershade.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": 53, "event_id": "evt-2787908787d8ee09145517f1", "src_port": 51649, "tcp_stream": null, "udp_stream": 9, "frame_number": 227, "timestamp_epoch": "1548711855.172197000" }, { "kind": "dns", "dst_ip": "172.17.8.109", "fields": { "dns.a": "172.17.8.2", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.timbershade.info", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.2", "dst_port": 51649, "event_id": "evt-078e131f7792f8f19d2f5a8d", "src_port": 53, "tcp_stream": null, "udp_stream": 9, "frame_number": 228, "timestamp_epoch": "1548711855.172355000" }, { "kind": "dns", "dst_ip": "172.17.8.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.timbershade.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": 53, "event_id": "evt-bcdded395232a08470b7dc3a", "src_port": 62964, "tcp_stream": null, "udp_stream": 11, "frame_number": 240, "timestamp_epoch": "1548711855.271153000" }, { "kind": "dns", "dst_ip": "172.17.8.109", "fields": { "dns.a": "172.17.8.2", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.timbershade.info", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.2", "dst_port": 62964, "event_id": "evt-fb6cfd402f185cdf1a845536", "src_port": 53, "tcp_stream": null, "udp_stream": 11, "frame_number": 241, "timestamp_epoch": "1548711855.271285000" }, { "kind": "dns", "dst_ip": "172.17.8.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Timbershade-DC.timbershade.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": 53, "event_id": "evt-a34253dd6fc40d570f9c3368", "src_port": 54441, "tcp_stream": null, "udp_stream": 13, "frame_number": 275, "timestamp_epoch": "1548711855.401511000" }, { "kind": "dns", "dst_ip": "172.17.8.109", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Timbershade-DC.timbershade.info", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.17.8.2", "dst_port": 54441, "event_id": "evt-e61b1347deb67b6376a25744", "src_port": 53, "tcp_stream": null, "udp_stream": 13, "frame_number": 276, "timestamp_epoch": "1548711855.401703000" }, { "kind": "dns", "dst_ip": "172.17.8.2", "fields": { "dns.qry.name": "_ldap._tcp.Timbershade-DC.timbershade.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": 53, "event_id": "evt-8f56f131348d274742b42676", "src_port": 51404, "tcp_stream": null, "udp_stream": 14, "frame_number": 277, "timestamp_epoch": "1548711855.402134000" }, { "kind": "dns", "dst_ip": "172.17.8.109", "fields": { "dns.qry.name": "_ldap._tcp.Timbershade-DC.timbershade.info", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.17.8.2", "dst_port": 51404, "event_id": "evt-336795148bc5f8cf770b708b", "src_port": 53, "tcp_stream": null, "udp_stream": 14, "frame_number": 278, "timestamp_epoch": "1548711855.402227000" }, { "kind": "dns", "dst_ip": "172.17.8.2", "fields": { "dns.qry.name": "wpad.timbershade.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": 53, "event_id": "evt-c91ce9362c53d8adbb08f65f", "src_port": 53764, "tcp_stream": null, "udp_stream": 18, "frame_number": 411, "timestamp_epoch": "1548711856.926984000" }, { "kind": "dns", "dst_ip": "172.17.8.109", "fields": { "dns.qry.name": "wpad.timbershade.info", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.17.8.2", "dst_port": 53764, "event_id": "evt-eab5aaa5e4e0f2a58b5e9dcd", "src_port": 53, "tcp_stream": null, "udp_stream": 18, "frame_number": 412, "timestamp_epoch": "1548711856.927211000" }, { "kind": "dns", "dst_ip": "172.17.8.2", "fields": { "dns.qry.name": "Timbershade-DC.timbershade.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": 53, "event_id": "evt-adbde9f08f2e47ebb2449bb1", "src_port": 51145, "tcp_stream": null, "udp_stream": 20, "frame_number": 422, "timestamp_epoch": "1548711857.450893000" }, { "kind": "dns", "dst_ip": "172.17.8.109", "fields": { "dns.a": "172.17.8.2", "dns.qry.name": "Timbershade-DC.timbershade.info", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.2", "dst_port": 51145, "event_id": "evt-c313878b54881b20e399f6ed", "src_port": 53, "tcp_stream": null, "udp_stream": 20, "frame_number": 423, "timestamp_epoch": "1548711857.450982000" }, { "kind": "dns", "dst_ip": "172.17.8.2", "fields": { "dns.qry.name": "isatap.timbershade.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": 53, "event_id": "evt-92a5178a66fb6e35b3b4820f", "src_port": 61929, "tcp_stream": null, "udp_stream": 21, "frame_number": 426, "timestamp_epoch": "1548711857.457724000" }, { "kind": "dns", "dst_ip": "172.17.8.109", "fields": { "dns.qry.name": "isatap.timbershade.info", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.17.8.2", "dst_port": 61929, "event_id": "evt-7beda9820a2a16eecef189b1", "src_port": 53, "tcp_stream": null, "udp_stream": 21, "frame_number": 428, "timestamp_epoch": "1548711857.457941000" }, { "kind": "dns", "dst_ip": "172.17.8.2", "fields": { "dns.qry.name": "isatap.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": 53, "event_id": "evt-b68e40998d34369aef3ca0e1", "src_port": 52343, "tcp_stream": null, "udp_stream": 23, "frame_number": 430, "timestamp_epoch": "1548711857.573963000" }, { "kind": "dns", "dst_ip": "172.17.8.109", "fields": { "dns.qry.name": "isatap.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.17.8.2", "dst_port": 52343, "event_id": "evt-a3f16f0c58410d35c8ebd436", "src_port": 53, "tcp_stream": null, "udp_stream": 23, "frame_number": 431, "timestamp_epoch": "1548711857.601268000" }, { "kind": "dns", "dst_ip": "172.17.8.2", "fields": { "dns.qry.name": "Timbershade-DC.timbershade.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": 53, "event_id": "evt-fee4655c5593a6b56a4bd161", "src_port": 51080, "tcp_stream": null, "udp_stream": 24, "frame_number": 436, "timestamp_epoch": "1548711858.950153000" }, { "kind": "dns", "dst_ip": "172.17.8.109", "fields": { "dns.a": "172.17.8.2", "dns.qry.name": "Timbershade-DC.timbershade.info", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.2", "dst_port": 51080, "event_id": "evt-7a1a4eb676ed893fab60e57b", "src_port": 53, "tcp_stream": null, "udp_stream": 24, "frame_number": 437, "timestamp_epoch": "1548711858.950439000" }, { "kind": "dns", "dst_ip": "172.17.8.2", "fields": { "dns.qry.name": "www.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": 53, "event_id": "evt-495c31f2ae32ff4d6bdfa632", "src_port": 52143, "tcp_stream": null, "udp_stream": 26, "frame_number": 440, "timestamp_epoch": "1548711859.498695000" }, { "kind": "dns", "dst_ip": "172.17.8.109", "fields": { "dns.a": "23.50.224.8,23.50.224.56", "dns.cname": "www.msftncsi.com.edgesuite.net,a1961.g2.akamai.net", "dns.qry.name": "www.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.2", "dst_port": 52143, "event_id": "evt-ae6ecb8d5f1a5e60530781bb", "src_port": 53, "tcp_stream": null, "udp_stream": 26, "frame_number": 441, "timestamp_epoch": "1548711859.547107000" }, { "kind": "dns", "dst_ip": "172.17.8.2", "fields": { "dns.qry.name": "Dunn-Windows-PC.timbershade.info", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": 53, "event_id": "evt-2a4a8e00312ccb5927924c6c", "src_port": 64053, "tcp_stream": null, "udp_stream": 27, "frame_number": 451, "timestamp_epoch": "1548711861.934670000" }, { "kind": "dns", "dst_ip": "172.17.8.109", "fields": { "dns.a": "172.17.8.2", "dns.qry.name": "Dunn-Windows-PC.timbershade.info", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.2", "dst_port": 64053, "event_id": "evt-f86d5d3b88f8c639450e9dc9", "src_port": 53, "tcp_stream": null, "udp_stream": 27, "frame_number": 452, "timestamp_epoch": "1548711861.934873000" }, { "kind": "dns", "dst_ip": "172.17.8.2", "fields": { "dns.a": "172.17.8.109", "dns.qry.name": "timbershade.info", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": 53, "event_id": "evt-20884629d095f39825cc2cf5", "src_port": 52192, "tcp_stream": null, "udp_stream": 28, "frame_number": 453, "timestamp_epoch": "1548711861.936065000" }, { "kind": "dns", "dst_ip": "172.17.8.109", "fields": { "dns.a": "172.17.8.109", "dns.qry.name": "timbershade.info", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.2", "dst_port": 52192, "event_id": "evt-ed91083ed9deff72c77b08e5", "src_port": 53, "tcp_stream": null, "udp_stream": 28, "frame_number": 454, "timestamp_epoch": "1548711861.936735000" }, { "kind": "dns", "dst_ip": "172.17.8.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Timbershade-DC.timbershade.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": 53, "event_id": "evt-81e471b28f1afe70da28d31c", "src_port": 61431, "tcp_stream": null, "udp_stream": 30, "frame_number": 712, "timestamp_epoch": "1548712131.869757000" }, { "kind": "dns", "dst_ip": "172.17.8.109", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.Timbershade-DC.timbershade.info", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.17.8.2", "dst_port": 61431, "event_id": "evt-cecc4774978dc5d6613539a1", "src_port": 53, "tcp_stream": null, "udp_stream": 30, "frame_number": 713, "timestamp_epoch": "1548712131.870000000" }, { "kind": "dns", "dst_ip": "172.17.8.2", "fields": { "dns.qry.name": "_ldap._tcp.Timbershade-DC.timbershade.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": 53, "event_id": "evt-feda07d4f751d6e2caa7a916", "src_port": 53898, "tcp_stream": null, "udp_stream": 31, "frame_number": 714, "timestamp_epoch": "1548712131.871383000" }, { "kind": "dns", "dst_ip": "172.17.8.109", "fields": { "dns.qry.name": "_ldap._tcp.Timbershade-DC.timbershade.info", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.17.8.2", "dst_port": 53898, "event_id": "evt-234af6106a4ea26362e0d8d9", "src_port": 53, "tcp_stream": null, "udp_stream": 31, "frame_number": 715, "timestamp_epoch": "1548712131.871674000" }, { "kind": "dns", "dst_ip": "172.17.8.2", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": 53, "event_id": "evt-c51e5da6eafae17cc8c56711", "src_port": 52079, "tcp_stream": null, "udp_stream": 32, "frame_number": 772, "timestamp_epoch": "1548712132.410638000" }, { "kind": "dns", "dst_ip": "172.17.8.109", "fields": { "dns.a": "131.107.255.255", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.2", "dst_port": 52079, "event_id": "evt-11a0461cddf423c1b28648d9", "src_port": 53, "tcp_stream": null, "udp_stream": 32, "frame_number": 775, "timestamp_epoch": "1548712132.439772000" }, { "kind": "dns", "dst_ip": "172.17.8.2", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": 53, "event_id": "evt-8b373ed3be7826ae2095455e", "src_port": 53025, "tcp_stream": null, "udp_stream": 33, "frame_number": 776, "timestamp_epoch": "1548712132.440858000" }, { "kind": "dns", "dst_ip": "172.17.8.109", "fields": { "dns.aaaa": "fd3e:4f5a:5b81::1", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.2", "dst_port": 53025, "event_id": "evt-ca46a4a42b96d18b56db3c49", "src_port": 53, "tcp_stream": null, "udp_stream": 33, "frame_number": 777, "timestamp_epoch": "1548712132.464588000" }, { "kind": "dns", "dst_ip": "172.17.8.2", "fields": { "dns.qry.name": "3.10.214.10.in-addr.arpa", "dns.qry.type": "12", "dns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": 53, "event_id": "evt-c17d57ed371a376d264d3d06", "src_port": 53026, "tcp_stream": null, "udp_stream": 34, "frame_number": 1036, "timestamp_epoch": "1548712316.253847000" }, { "kind": "dns", "dst_ip": "172.17.8.109", "fields": { "dns.qry.name": "3.10.214.10.in-addr.arpa", "dns.qry.type": "12", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.17.8.2", "dst_port": 53026, "event_id": "evt-452e7b6f6125e2e90862552d", "src_port": 53, "tcp_stream": null, "udp_stream": 34, "frame_number": 1037, "timestamp_epoch": "1548712316.274960000" }, { "kind": "dns", "dst_ip": "172.17.8.2", "fields": { "dns.qry.name": "TIMBERSHADE.INFO.timbershade.info", "dns.qry.type": "255", "dns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": 53, "event_id": "evt-f402ab6a79ba605bce577168", "src_port": 53027, "tcp_stream": null, "udp_stream": 35, "frame_number": 1038, "timestamp_epoch": "1548712316.275196000" }, { "kind": "dns", "dst_ip": "172.17.8.109", "fields": { "dns.qry.name": "TIMBERSHADE.INFO.timbershade.info", "dns.qry.type": "255", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.17.8.2", "dst_port": 53027, "event_id": "evt-584ea86996ed204266f935dd", "src_port": 53, "tcp_stream": null, "udp_stream": 35, "frame_number": 1039, "timestamp_epoch": "1548712316.275327000" }, { "kind": "dns", "dst_ip": "172.17.8.2", "fields": { "dns.qry.name": "TIMBERSHADE.INFO", "dns.qry.type": "255", "dns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": 53, "event_id": "evt-e6fbd1a0064a852e8528d5c1", "src_port": 53028, "tcp_stream": null, "udp_stream": 36, "frame_number": 1040, "timestamp_epoch": "1548712316.275423000" }, { "kind": "dns", "dst_ip": "172.17.8.109", "fields": { "dns.a": "172.17.8.2,172.17.8.2", "dns.qry.name": "TIMBERSHADE.INFO", "dns.qry.type": "255", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.2", "dst_port": 53028, "event_id": "evt-acf20f316dbdf28b34b212b0", "src_port": 53, "tcp_stream": null, "udp_stream": 36, "frame_number": 1041, "timestamp_epoch": "1548712316.275521000" }, { "kind": "dns", "dst_ip": "172.17.8.2", "fields": { "dns.qry.name": "wpad.timbershade.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": 53, "event_id": "evt-42477acd2d7d8d0e9f2b2e27", "src_port": 54725, "tcp_stream": null, "udp_stream": 40, "frame_number": 1055, "timestamp_epoch": "1548712322.736303000" }, { "kind": "dns", "dst_ip": "172.17.8.109", "fields": { "dns.qry.name": "wpad.timbershade.info", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.17.8.2", "dst_port": 54725, "event_id": "evt-ded68dd2a580deae9cd8abe8", "src_port": 53, "tcp_stream": null, "udp_stream": 40, "frame_number": 1056, "timestamp_epoch": "1548712322.736626000" }, { "kind": "dns", "dst_ip": "172.17.8.2", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": 53, "event_id": "evt-0d08cdd4227261f39a7323d0", "src_port": 64362, "tcp_stream": null, "udp_stream": 41, "frame_number": 1057, "timestamp_epoch": "1548712322.737246000" }, { "kind": "dns", "dst_ip": "172.17.8.109", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.17.8.2", "dst_port": 64362, "event_id": "evt-0bea4704cb504c0f30a0bd68", "src_port": 53, "tcp_stream": null, "udp_stream": 41, "frame_number": 1061, "timestamp_epoch": "1548712322.770794000" }, { "kind": "dns", "dst_ip": "172.17.8.2", "fields": { "dns.qry.name": "www.download.windowsupdate.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": 53, "event_id": "evt-5d55798afdb16aba6d9ec741", "src_port": 54412, "tcp_stream": null, "udp_stream": 43, "frame_number": 1074, "timestamp_epoch": "1548712323.021554000" }, { "kind": "dns", "dst_ip": "172.17.8.109", "fields": { "dns.a": "204.2.193.184,204.2.193.162", "dns.cname": "2-01-3cf7-0009.cdx.cedexis.net,download.windowsupdate.com.edgesuite.net,a767.dspw65.akamai.net", "dns.qry.name": "www.download.windowsupdate.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.2", "dst_port": 54412, "event_id": "evt-e12f86f0caaef2c53e1cb559", "src_port": 53, "tcp_stream": null, "udp_stream": 43, "frame_number": 1075, "timestamp_epoch": "1548712323.075168000" } ], "dhcp": [ { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "14:fe:b5:d4:15:ca", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "14:fe:b5:d4:15:ca,14:fe:b5:d4:15:ca", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Dunn-Windows-PC" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-1d8afe80b184cc34f22e591a", "src_port": null, "tcp_stream": null, "udp_stream": 16, "frame_number": 409, "timestamp_epoch": "1548711856.923768000" }, { "kind": "dhcp", "dst_ip": "172.17.8.109", "fields": { "eth.src": "00:21:5e:72:9e:b4", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "14:fe:b5:d4:15:ca", "dhcp.option.dhcp": "5" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-0d183c1ab6746d106ce1d68f", "src_port": null, "tcp_stream": null, "udp_stream": 17, "frame_number": 410, "timestamp_epoch": "1548711856.923987000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "14:fe:b5:d4:15:ca", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "14:fe:b5:d4:15:ca,14:fe:b5:d4:15:ca", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Dunn-Windows-PC" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-d649a6c8de84057951d20d59", "src_port": null, "tcp_stream": null, "udp_stream": 16, "frame_number": 1058, "timestamp_epoch": "1548712322.737620000" }, { "kind": "dhcp", "dst_ip": "172.17.8.109", "fields": { "eth.src": "00:21:5e:72:9e:b4", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "14:fe:b5:d4:15:ca", "dhcp.option.dhcp": "5" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-7db28cae6a73d0a66f024404", "src_port": null, "tcp_stream": null, "udp_stream": 17, "frame_number": 1059, "timestamp_epoch": "1548712322.737863000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "14:fe:b5:d4:15:ca", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "14:fe:b5:d4:15:ca,14:fe:b5:d4:15:ca", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Dunn-Windows-PC" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-6b43d162c8d3399ec18b61e0", "src_port": null, "tcp_stream": null, "udp_stream": 16, "frame_number": 1980, "timestamp_epoch": "1548712551.309633000" }, { "kind": "dhcp", "dst_ip": "172.17.8.109", "fields": { "eth.src": "00:21:5e:72:9e:b4", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "14:fe:b5:d4:15:ca", "dhcp.option.dhcp": "5" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-90f80a41e984bae6ce9fc872", "src_port": null, "tcp_stream": null, "udp_stream": 17, "frame_number": 1981, "timestamp_epoch": "1548712551.310063000" } ], "smtp": [], "identity": [ { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca", "nbns.name": "DUNN-WINDOWS-PC<00>,DUNN-WINDOWS-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-20bd00ef77d02220f61cf69b", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1, "timestamp_epoch": "1548711854.050143000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca", "nbns.name": "TIMBERSHADE<00>,TIMBERSHADE<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-f3539dda94bedb5cd1bbcbdc", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2, "timestamp_epoch": "1548711854.050145000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "10", "kerberos.CNameString": "dunn-windows-pc$" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-05f15946ce57308adaa43de9", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 24, "timestamp_epoch": "1548711854.190529000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "30" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-e9807a7d4ee4abefa7827f1c", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 25, "timestamp_epoch": "1548711854.191128000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "10", "kerberos.CNameString": "dunn-windows-pc$" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-febcf8909cd0d59292d34d6b", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 32, "timestamp_epoch": "1548711854.203558000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "11", "kerberos.CNameString": "DUNN-WINDOWS-PC$" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-76432de3b6a69ff01ef1bfde", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 34, "timestamp_epoch": "1548711854.204010000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-3741eddb6aab842b23063b86", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 43, "timestamp_epoch": "1548711854.207157000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "13", "kerberos.CNameString": "DUNN-WINDOWS-PC$" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-aac5610eac00c29c6d878804", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 46, "timestamp_epoch": "1548711854.207489000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-8be55f5b9836548eda70ef67", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 52, "timestamp_epoch": "1548711854.208830000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-469396ef104e0e0e44833057", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 54, "timestamp_epoch": "1548711854.209165000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-3fcdb78c1cc93bb9fab802ad", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 55, "timestamp_epoch": "1548711854.210452000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-ca94918aed57536e29848dae", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 69, "timestamp_epoch": "1548711854.244073000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-70861c5cecd5b21399264f84", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 70, "timestamp_epoch": "1548711854.261119000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-fd90d9f910f9f8a1a2791bfc", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 71, "timestamp_epoch": "1548711854.261122000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "10", "kerberos.CNameString": "dunn-windows-pc$" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-685e1ac7c6d831d6d092e704", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 75, "timestamp_epoch": "1548711854.275033000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "30" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-fa8556af3ee8a44702533a98", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 76, "timestamp_epoch": "1548711854.275034000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "10", "kerberos.CNameString": "dunn-windows-pc$" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-734a7829ac6186c5663bf87b", "src_port": null, "tcp_stream": 7, "udp_stream": null, "frame_number": 83, "timestamp_epoch": "1548711854.287663000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "11", "kerberos.CNameString": "DUNN-WINDOWS-PC$" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-99532618f59af51486cf7ef6", "src_port": null, "tcp_stream": 7, "udp_stream": null, "frame_number": 85, "timestamp_epoch": "1548711854.288289000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-b487a95c9f7b4796ddc84815", "src_port": null, "tcp_stream": 8, "udp_stream": null, "frame_number": 94, "timestamp_epoch": "1548711854.291859000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "13", "kerberos.CNameString": "DUNN-WINDOWS-PC$" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-94d17f00d21fa9997117c10a", "src_port": null, "tcp_stream": 8, "udp_stream": null, "frame_number": 97, "timestamp_epoch": "1548711854.292696000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-6bed5f39a5b5029ef7957f5a", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 106, "timestamp_epoch": "1548711854.294818000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "13", "kerberos.CNameString": "DUNN-WINDOWS-PC$" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-95d2c2280b5e9fefa528cc49", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 109, "timestamp_epoch": "1548711854.295179000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-2e013d6762b8ec3bd508994a", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 119, "timestamp_epoch": "1548711854.297946000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-bea2456d275a6a9bafca51e3", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 120, "timestamp_epoch": "1548711854.298090000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-3e7994389b9a7ba0ed33a4a6", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 123, "timestamp_epoch": "1548711854.300643000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-e9aac27c0d4b0026c29093d0", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 124, "timestamp_epoch": "1548711854.300644000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-e7b1e2ea7cce77752241609a", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 125, "timestamp_epoch": "1548711854.306372000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-145ae6c16c7b424f261bd31a", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 126, "timestamp_epoch": "1548711854.306603000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-6d7b81ff17960e8e5dab72ad", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 138, "timestamp_epoch": "1548711854.414889000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "13", "kerberos.CNameString": "DUNN-WINDOWS-PC$" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-29cc061458a38d01fea2450d", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 141, "timestamp_epoch": "1548711854.415638000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-832bb6ef036c42a3a0cb2510", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 148, "timestamp_epoch": "1548711854.417351000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-091c4e77826f18597998f9bc", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 150, "timestamp_epoch": "1548711854.417558000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca", "nbns.name": "DUNN-WINDOWS-PC<20>,DUNN-WINDOWS-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-eb1d3c84eddde222011e0f96", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 154, "timestamp_epoch": "1548711854.436008000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-ebfc8be63b1126ebffdf8721", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 156, "timestamp_epoch": "1548711854.485537000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-2b4e15d6ba03523ed0bebecc", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 157, "timestamp_epoch": "1548711854.485782000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-0656ca0285b765c0b6c2748e", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 162, "timestamp_epoch": "1548711854.726813000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-ecc2647a16fe9283679363af", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 164, "timestamp_epoch": "1548711854.727470000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-fa5a9545d7a7fb0c8e9ff7a3", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 165, "timestamp_epoch": "1548711854.727858000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca", "nbns.name": "DUNN-WINDOWS-PC<00>,DUNN-WINDOWS-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-4a3aa6f33165f502de7b05b3", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 175, "timestamp_epoch": "1548711854.797794000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca", "nbns.name": "TIMBERSHADE<00>,TIMBERSHADE<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-fe8852334314fee058eeaba8", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 176, "timestamp_epoch": "1548711854.797794000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-ec6ed075714e742b27abdce9", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 211, "timestamp_epoch": "1548711855.168195000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "13", "kerberos.CNameString": "DUNN-WINDOWS-PC$" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-6cb8ea4a2570037aca2e8d60", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 214, "timestamp_epoch": "1548711855.168844000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-005620ecd51372f802f905da", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 220, "timestamp_epoch": "1548711855.169319000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-7ea163d950b0867966c62d57", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 222, "timestamp_epoch": "1548711855.169855000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca", "nbns.name": "DUNN-WINDOWS-PC<20>,DUNN-WINDOWS-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-e5e7508b4c247f92b31904b3", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 231, "timestamp_epoch": "1548711855.188456000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-a02934265fef17bdce8b83d6", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 287, "timestamp_epoch": "1548711855.405248000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-76dc332faa0fde17ba2613fb", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 289, "timestamp_epoch": "1548711855.406633000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-36f53db41a9b57dc98e6aadf", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 294, "timestamp_epoch": "1548711855.415674000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "13", "kerberos.CNameString": "DUNN-WINDOWS-PC$" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-421a80c436fd0761bbb9d9e2", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 297, "timestamp_epoch": "1548711855.416459000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-b8a1172ee1cd62cab81f8d4d", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 308, "timestamp_epoch": "1548711855.419750000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "13", "kerberos.CNameString": "DUNN-WINDOWS-PC$" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-fde993101753c4d21d19f810", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 311, "timestamp_epoch": "1548711855.420247000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-c3ede61dbb49dc12876641c6", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 323, "timestamp_epoch": "1548711855.421595000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "30" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-66f8d25775547615e05c4fa5", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 325, "timestamp_epoch": "1548711855.421805000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-cf9ae14c2f89fcd4e131aa97", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 330, "timestamp_epoch": "1548711855.422217000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-5f21893b7aa50881fec4dc3d", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 332, "timestamp_epoch": "1548711855.422880000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-f873d599b00d551a07c908c9", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 342, "timestamp_epoch": "1548711855.427961000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-72ea7a1b5d6f0758c67a5dff", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 343, "timestamp_epoch": "1548711855.428182000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-e000af74a0fd7877c89ef073", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 348, "timestamp_epoch": "1548711855.429035000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "13", "kerberos.CNameString": "DUNN-WINDOWS-PC$" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-a0e31627ebbdd116abf4b144", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 351, "timestamp_epoch": "1548711855.429740000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-3d7f7bdd94b4a9bb40c32b70", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 360, "timestamp_epoch": "1548711855.430310000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "13", "kerberos.CNameString": "DUNN-WINDOWS-PC$" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-245689b90daf8d8e9d60209a", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 363, "timestamp_epoch": "1548711855.430630000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-edef0be62428f79de3993569", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 371, "timestamp_epoch": "1548711855.431133000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-561ccc4b2267f926ef5ad631", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 372, "timestamp_epoch": "1548711855.431679000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-3d3c7c935e1cb61351d5e025", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 373, "timestamp_epoch": "1548711855.432014000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-6f8c4d0d1456ab6b17fddfb1", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 374, "timestamp_epoch": "1548711855.432085000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-f8f1d4e1cbce7e224b14a759", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 375, "timestamp_epoch": "1548711855.432299000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-105a0142fa6bde54c5370ca4", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 376, "timestamp_epoch": "1548711855.434835000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-7f5c14bfc2bf648ac6733dcd", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 377, "timestamp_epoch": "1548711855.435066000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-46bfb86b7bed8881e0f2856a", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 378, "timestamp_epoch": "1548711855.435229000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-24b5ba95a1a4732255f64b87", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 379, "timestamp_epoch": "1548711855.435492000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-9d4f14f23a1e3029ef12a4de", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 380, "timestamp_epoch": "1548711855.435555000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-e47588f6530efd37bb472c47", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 381, "timestamp_epoch": "1548711855.435913000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-a98c1ec1a196fcab0ec7298f", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 382, "timestamp_epoch": "1548711855.436185000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-348bce274a57f5f3f955aacb", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 383, "timestamp_epoch": "1548711855.436463000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-f064101b16726476973c59f8", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 384, "timestamp_epoch": "1548711855.436546000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca", "nbns.name": "TIMBERSHADE<00>,TIMBERSHADE<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-8bccc68a323c4e926e94f4ee", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 387, "timestamp_epoch": "1548711855.549788000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca", "nbns.name": "DUNN-WINDOWS-PC<00>,DUNN-WINDOWS-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-ca1f6a7fda9c912eb76ed632", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 388, "timestamp_epoch": "1548711855.549789000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-6bb9cec4e5c13982bef86a76", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 391, "timestamp_epoch": "1548711855.722752000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-dc417fbcb4366129d5b2de94", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 392, "timestamp_epoch": "1548711855.723070000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-4e94d47b7be954ec4335faab", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 393, "timestamp_epoch": "1548711855.723446000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-3c0e2be046207b69a4652934", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 394, "timestamp_epoch": "1548711855.723547000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-941b2174003bde9e31cc0b5a", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 395, "timestamp_epoch": "1548711855.724380000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-88159d3dc40d8e78bea036a9", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 396, "timestamp_epoch": "1548711855.724393000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-a4c42dc5ade91cb8df131bb7", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 397, "timestamp_epoch": "1548711855.724785000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-c5b652d0d722b7631d0ddc77", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 398, "timestamp_epoch": "1548711855.724857000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca", "nbns.name": "DUNN-WINDOWS-PC<20>,DUNN-WINDOWS-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-a57375f8858b9edb1c18bb42", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 402, "timestamp_epoch": "1548711855.940495000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca", "nbns.name": "DUNN-WINDOWS-PC<00>,DUNN-WINDOWS-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-2a7e970c5745bc08a1d03db0", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 403, "timestamp_epoch": "1548711856.301324000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca", "nbns.name": "TIMBERSHADE<00>,TIMBERSHADE<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-3d7970df433953bb597ad9da", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 404, "timestamp_epoch": "1548711856.301324000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca", "nbns.name": "DUNN-WINDOWS-PC<20>,DUNN-WINDOWS-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-950e295f7b710340e6309652", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 405, "timestamp_epoch": "1548711856.691859000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "14:fe:b5:d4:15:ca", "dns.qry.name": "Dunn-Windows-PC" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-dd7518916a00c8e3e1966003", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 408, "timestamp_epoch": "1548711856.917465000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "14:fe:b5:d4:15:ca", "dns.qry.name": "wpad" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-4c0a874f640ed899cde5b654", "src_port": null, "tcp_stream": null, "udp_stream": 19, "frame_number": 413, "timestamp_epoch": "1548711856.927754000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "14:fe:b5:d4:15:ca", "dns.qry.name": "Dunn-Windows-PC" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-d4bc50ed817f1614ec95168d", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 414, "timestamp_epoch": "1548711857.011958000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "14:fe:b5:d4:15:ca", "dns.qry.name": "wpad" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-85643c2ee20382d5c08ab100", "src_port": null, "tcp_stream": null, "udp_stream": 19, "frame_number": 415, "timestamp_epoch": "1548711857.021670000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-1fbc24e305bef9cde5a11fa7", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 416, "timestamp_epoch": "1548711857.222112000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-106d558e4bb8a27374ecddf8", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 418, "timestamp_epoch": "1548711857.443749000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-788422e6ac4f63deb083e8a2", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 419, "timestamp_epoch": "1548711857.443906000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-603e945778596bc0ab107331", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 420, "timestamp_epoch": "1548711857.444235000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-d7277ac98760d02bcdcd58c0", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 421, "timestamp_epoch": "1548711857.444235000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "14:fe:b5:d4:15:ca", "dns.qry.name": "Dunn-Windows-PC" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-c05f46c0b7bad7b2b426e733", "src_port": null, "tcp_stream": null, "udp_stream": 22, "frame_number": 427, "timestamp_epoch": "1548711857.457725000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "14:fe:b5:d4:15:ca", "dns.qry.name": "Dunn-Windows-PC" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-731d1bd1b62dc0bc48aa1ca4", "src_port": null, "tcp_stream": null, "udp_stream": 22, "frame_number": 429, "timestamp_epoch": "1548711857.552916000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-fdc0469b05a47b17bbe774be", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 434, "timestamp_epoch": "1548711857.975748000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-69949d8ac229faadb5f2b32c", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 435, "timestamp_epoch": "1548711858.729635000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-33eb977102ba9e442a326936", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 463, "timestamp_epoch": "1548711865.023357000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-d3a50ff31a1a82dc881ab4e2", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 465, "timestamp_epoch": "1548711865.024062000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-54730a309f87749593af6e7a", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 478, "timestamp_epoch": "1548711865.032047000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-522285373dfd0afc34755539", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 480, "timestamp_epoch": "1548711865.032606000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "10", "kerberos.CNameString": "DUNN-WINDOWS-PC$" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-1067fda34469bf72a10797e3", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 486, "timestamp_epoch": "1548711865.033861000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "30" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-5380766fb2d92b598f06e8f7", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 487, "timestamp_epoch": "1548711865.034228000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "10", "kerberos.CNameString": "DUNN-WINDOWS-PC$" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-dad889039617777172207014", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 494, "timestamp_epoch": "1548711865.044459000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "11", "kerberos.CNameString": "DUNN-WINDOWS-PC$" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-8376eb2621fe6a4ea1875fc5", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 496, "timestamp_epoch": "1548711865.045013000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-02c7d4fe8803cfb3404b059c", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 505, "timestamp_epoch": "1548711865.045705000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "13", "kerberos.CNameString": "DUNN-WINDOWS-PC$" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-95601ae20b43423edf54145f", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 508, "timestamp_epoch": "1548711865.046364000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-a2a7e261ac6a24be09d2745c", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 521, "timestamp_epoch": "1548711871.106478000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-b14330e009436e8185ab46eb", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 522, "timestamp_epoch": "1548711871.106644000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-d4988aeb24bfea48b0ff714b", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 523, "timestamp_epoch": "1548711871.106792000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-22fd5c9e3bd273121dcb2992", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 524, "timestamp_epoch": "1548711871.106874000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-086f9fd1a3c0e97e1e18b8f9", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 526, "timestamp_epoch": "1548711871.107054000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-aadc500e48845740d144f7b4", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 527, "timestamp_epoch": "1548711871.107339000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-3af72a1395f5e914994fe11b", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 528, "timestamp_epoch": "1548711871.107454000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-f0a67574a4ea69d5c91abd14", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 529, "timestamp_epoch": "1548711871.107524000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-16248003f539f4ecffcb69f9", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 530, "timestamp_epoch": "1548711871.107619000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-e8ceae82e5f4a1c2999cffde", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 531, "timestamp_epoch": "1548711871.107685000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "10", "kerberos.CNameString": "margaret.dunn" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-537eb0e6dac1e95737e4b191", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 604, "timestamp_epoch": "1548712130.966146000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "30" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-732a35e1cc375c88c45f2eda", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 605, "timestamp_epoch": "1548712130.966456000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "10", "kerberos.CNameString": "margaret.dunn" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-cf83a3f6647fb6008435f216", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 612, "timestamp_epoch": "1548712130.973355000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "11", "kerberos.CNameString": "margaret.dunn" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-a2a09580daff5a954df7b0a4", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 614, "timestamp_epoch": "1548712130.973911000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-7693156756fbca13c19dd2a7", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 623, "timestamp_epoch": "1548712130.974295000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "13", "kerberos.CNameString": "margaret.dunn" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-8a23c6dc01f7b426aef81d38", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 626, "timestamp_epoch": "1548712130.974660000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-2ce902719a9da446798a779b", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 645, "timestamp_epoch": "1548712131.336445000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "13", "kerberos.CNameString": "margaret.dunn" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-c5d581baf730a7585d1cc9bf", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 648, "timestamp_epoch": "1548712131.336476000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-aaf4c325b0aa431d13a1d930", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 654, "timestamp_epoch": "1548712131.337001000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-0fd43fa82bb81afec7c03a03", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 656, "timestamp_epoch": "1548712131.337592000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-f3c3506be203431e8363f032", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 657, "timestamp_epoch": "1548712131.338414000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-c01a5d4635700b460be577bb", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 671, "timestamp_epoch": "1548712131.363394000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-c9ce3c6fc2daa4076f544e61", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 672, "timestamp_epoch": "1548712131.363871000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-39e8bde3fdbc7fbc882ad5f6", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 673, "timestamp_epoch": "1548712131.363872000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-8a2364b6898cf9823d2d966f", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 678, "timestamp_epoch": "1548712131.365291000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "13", "kerberos.CNameString": "margaret.dunn" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-1ce3a11099127b3b2e52a933", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 681, "timestamp_epoch": "1548712131.367652000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-ec3d58cacdfa5ff2485a40d4", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 690, "timestamp_epoch": "1548712131.367687000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "13", "kerberos.CNameString": "margaret.dunn" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-ff6c2f4d954a2723e61dfd89", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 693, "timestamp_epoch": "1548712131.367689000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-b929ed6b03f2d2b1acf4351d", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 701, "timestamp_epoch": "1548712131.367711000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-10e8974802ce19b051f562da", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 702, "timestamp_epoch": "1548712131.367711000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-05cedaf48a2c6e7c3ed0571e", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 703, "timestamp_epoch": "1548712131.368020000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-fc97183d6dc40fa723b691bb", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 704, "timestamp_epoch": "1548712131.368021000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-8655d8f4713f0e5c97a473c9", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 705, "timestamp_epoch": "1548712131.368699000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-b35c4bd46c781bbe62220df5", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 706, "timestamp_epoch": "1548712131.485816000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-ea44570d1831fa4159222fdc", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 707, "timestamp_epoch": "1548712131.488127000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-45c8f5d54f8d5186e6f0587d", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 708, "timestamp_epoch": "1548712131.488128000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-1de73f4b6974cf09b2eece70", "src_port": null, "tcp_stream": 47, "udp_stream": null, "frame_number": 723, "timestamp_epoch": "1548712131.873664000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "13", "kerberos.CNameString": "margaret.dunn" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-bb3f33d2522792b943e80b6b", "src_port": null, "tcp_stream": 47, "udp_stream": null, "frame_number": 726, "timestamp_epoch": "1548712131.874499000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-5f0adbced01cd375f723df96", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 732, "timestamp_epoch": "1548712131.875067000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-7fd880dc5de648f4b738d9c9", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 734, "timestamp_epoch": "1548712131.875630000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-de8d6dc9ec68b468e5266a47", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 741, "timestamp_epoch": "1548712131.880430000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-e93094e060b71429324d415d", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 743, "timestamp_epoch": "1548712131.880949000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-e7ce2140c9ec9895594a71f2", "src_port": null, "tcp_stream": 49, "udp_stream": null, "frame_number": 754, "timestamp_epoch": "1548712131.884496000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-97630b07e7b5682d2125a0dd", "src_port": null, "tcp_stream": 49, "udp_stream": null, "frame_number": 755, "timestamp_epoch": "1548712131.884772000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-01a6a1ea18f6f03a96de81cc", "src_port": null, "tcp_stream": 49, "udp_stream": null, "frame_number": 756, "timestamp_epoch": "1548712131.885007000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-ca0265a78df6637b87b9329a", "src_port": null, "tcp_stream": 49, "udp_stream": null, "frame_number": 760, "timestamp_epoch": "1548712131.886009000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-c6d7de27a778a95e95b81f6e", "src_port": null, "tcp_stream": 49, "udp_stream": null, "frame_number": 761, "timestamp_epoch": "1548712131.886569000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-c081471c681b4a96b177e4a8", "src_port": null, "tcp_stream": 49, "udp_stream": null, "frame_number": 762, "timestamp_epoch": "1548712131.886860000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-a31a48b5f43d57dae85f5f6d", "src_port": null, "tcp_stream": 49, "udp_stream": null, "frame_number": 763, "timestamp_epoch": "1548712131.886999000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-07cc7ce3045577ca116e894a", "src_port": null, "tcp_stream": 49, "udp_stream": null, "frame_number": 764, "timestamp_epoch": "1548712131.887914000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-95f81b69a0816836202260eb", "src_port": null, "tcp_stream": 49, "udp_stream": null, "frame_number": 765, "timestamp_epoch": "1548712131.887915000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-34b431a19973b49ddfa477b0", "src_port": null, "tcp_stream": 49, "udp_stream": null, "frame_number": 766, "timestamp_epoch": "1548712131.887915000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-8a8c9ed4488bea658a88654d", "src_port": null, "tcp_stream": 49, "udp_stream": null, "frame_number": 767, "timestamp_epoch": "1548712131.887998000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-ea936cde5b269854bb08a2b0", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 778, "timestamp_epoch": "1548712137.512162000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-edb5f9183ae5e2650dabafef", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 779, "timestamp_epoch": "1548712137.617768000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-44ed249d6aea6d1a3df6c198", "src_port": null, "tcp_stream": 49, "udp_stream": null, "frame_number": 780, "timestamp_epoch": "1548712137.618037000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-4342da88c9fd321e14ad6872", "src_port": null, "tcp_stream": 49, "udp_stream": null, "frame_number": 781, "timestamp_epoch": "1548712137.618162000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-7288f9b7b7e6124ffdc61bc3", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 784, "timestamp_epoch": "1548712140.284941000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-e2cc5ffdb2bdc8a9d17be7d0", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 785, "timestamp_epoch": "1548712140.285911000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-25baa14e72060451d6aa2df3", "src_port": null, "tcp_stream": 49, "udp_stream": null, "frame_number": 791, "timestamp_epoch": "1548712153.625940000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-a41e9c49be99cc0c4af0b34f", "src_port": null, "tcp_stream": 49, "udp_stream": null, "frame_number": 792, "timestamp_epoch": "1548712153.626112000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-8d0d09c1c011893e0579326b", "src_port": null, "tcp_stream": 49, "udp_stream": null, "frame_number": 793, "timestamp_epoch": "1548712153.626289000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-7c4f7d7f48e174bdd7b63d39", "src_port": null, "tcp_stream": 49, "udp_stream": null, "frame_number": 794, "timestamp_epoch": "1548712153.626375000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-684ef96bca61e37a2be31921", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 795, "timestamp_epoch": "1548712153.626457000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-f83d93fd6abc5d163903cd41", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 797, "timestamp_epoch": "1548712153.626516000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-020fc443ead34ba3f67a67c4", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1001, "timestamp_epoch": "1548712211.382339000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-01066a8f673d6f0905b706bc", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1003, "timestamp_epoch": "1548712211.382911000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-954e7ecbd9cf79148c11fa93", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1004, "timestamp_epoch": "1548712211.383133000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-22e6d616d4d29063b8c7be64", "src_port": null, "tcp_stream": null, "udp_stream": 37, "frame_number": 1042, "timestamp_epoch": "1548712316.300413000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca", "nbns.name": "TIMBERSHADE<1b>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-c7892ae2fb0019c582978dec", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1043, "timestamp_epoch": "1548712316.300565000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "nbns.name": "TIMBERSHADE<1b> (Domain Master Browser)", "nbns.flags.opcode": "0", "nbns.flags.response": "True", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-7f1c853d8ef30303802040dd", "src_port": null, "tcp_stream": null, "udp_stream": 38, "frame_number": 1044, "timestamp_epoch": "1548712316.300655000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-6c5985d615b7195130c0c057", "src_port": null, "tcp_stream": null, "udp_stream": 39, "frame_number": 1045, "timestamp_epoch": "1548712316.300721000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-a3733af0719f7901b13a1da6", "src_port": null, "tcp_stream": null, "udp_stream": 37, "frame_number": 1048, "timestamp_epoch": "1548712317.314802000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-8cc8878a4bf4933440defe39", "src_port": null, "tcp_stream": null, "udp_stream": 39, "frame_number": 1049, "timestamp_epoch": "1548712317.314995000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-f82d74cab2ad677550705253", "src_port": null, "tcp_stream": null, "udp_stream": 37, "frame_number": 1050, "timestamp_epoch": "1548712318.330145000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-2a19b6c2546872f0c398c293", "src_port": null, "tcp_stream": null, "udp_stream": 39, "frame_number": 1051, "timestamp_epoch": "1548712318.330353000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca", "nbns.name": "TIMBERSHADE<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-f6ac413328b2360d2f6a416e", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1052, "timestamp_epoch": "1548712319.346280000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca", "nbns.name": "TIMBERSHADE<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-3c04b6335cf5384f8d89a110", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1053, "timestamp_epoch": "1548712320.111352000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca", "nbns.name": "TIMBERSHADE<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-35661a3ddeae0293ba59d96a", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1054, "timestamp_epoch": "1548712320.877455000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "14:fe:b5:d4:15:ca", "dns.qry.name": "wpad" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-97c4b129f57295f7d1430f6d", "src_port": null, "tcp_stream": null, "udp_stream": 42, "frame_number": 1062, "timestamp_epoch": "1548712322.771140000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "14:fe:b5:d4:15:ca", "dns.qry.name": "wpad" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-99334fad296b30d7257e32c7", "src_port": null, "tcp_stream": null, "udp_stream": 42, "frame_number": 1067, "timestamp_epoch": "1548712322.877789000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-d8b6050a0a508768f4794e20", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1077, "timestamp_epoch": "1548712323.081255000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-84e0993833bf68e8f94bb515", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1103, "timestamp_epoch": "1548712323.846626000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-6651d9f5a224a2ca90db3490", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1104, "timestamp_epoch": "1548712324.612727000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-6b606faf8fb9ccb8816b5723", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 1942, "timestamp_epoch": "1548712367.939802000" }, { "kind": "identity", "dst_ip": "172.17.8.109", "fields": { "eth.dst": "14:fe:b5:d4:15:ca", "eth.src": "00:21:5e:72:9e:b4", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-f8ea9347e6e10c849bb9c3af", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 1944, "timestamp_epoch": "1548712367.940089000" }, { "kind": "identity", "dst_ip": "172.17.8.2", "fields": { "eth.dst": "00:21:5e:72:9e:b4", "eth.src": "14:fe:b5:d4:15:ca", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-5540df9c59827ca00088146a", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 1945, "timestamp_epoch": "1548712367.940179000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-351a5eeb473d6827dffdf9df", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1979, "timestamp_epoch": "1548712551.304165000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-39eaefc0066768e6e336f3df", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1997, "timestamp_epoch": "1548712552.079674000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "14:fe:b5:d4:15:ca", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-879746173b6c0f0a32b02acd", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2009, "timestamp_epoch": "1548712552.845075000" } ], "http_request": [ { "kind": "http_request", "dst_ip": "23.50.224.8", "fields": { "http.host": "www.msftncsi.com", "http.user_agent": "Microsoft NCSI", "http.request.uri": "/ncsi.txt", "http.response_in": "447", "http.request.method": "GET", "http.request.full_uri": "http://www.msftncsi.com/ncsi.txt" }, "src_ip": "172.17.8.109", "dst_port": 80, "event_id": "evt-d7a90776b311ef02a3847a4e", "src_port": 49183, "tcp_stream": 27, "udp_stream": null, "frame_number": 445, "timestamp_epoch": "1548711859.724895000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-f4bcbfbfc1a7eda6d04862d4", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 562, "timestamp_epoch": "1548711974.925375000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-63a5fdcc422db5d005c8ef5c", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 564, "timestamp_epoch": "1548711975.282290000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-4baa18aef168474c26ddfe31", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 573, "timestamp_epoch": "1548711977.937888000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-6834255e90d0549820cf1cb0", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 574, "timestamp_epoch": "1548711978.305406000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-cd745b7be50ccf19bb41eb11", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 575, "timestamp_epoch": "1548711980.961861000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-d7a84e8ac2bbee4709c0e72c", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 576, "timestamp_epoch": "1548711981.315491000" }, { "kind": "http_request", "dst_ip": "91.121.30.169", "fields": { "http.host": "91.121.30.169:8000", "http.request.uri": "/91msE95B/actiV.bin", "http.response_in": "983", "http.request.method": "GET", "http.request.full_uri": "http://91.121.30.169:8000/91msE95B/actiV.bin" }, "src_ip": "172.17.8.109", "dst_port": 8000, "event_id": "evt-5923521a6d37a8d5f85b4ec9", "src_port": 49207, "tcp_stream": 50, "udp_stream": null, "frame_number": 802, "timestamp_epoch": "1548712157.801380000" }, { "kind": "http_request", "dst_ip": "204.2.193.184", "fields": { "http.host": "www.download.windowsupdate.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab", "http.response_in": "1082", "http.request.method": "GET", "http.request.full_uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab" }, "src_ip": "172.17.8.109", "dst_port": 80, "event_id": "evt-fac82133eed7a411fa018d7e", "src_port": 49213, "tcp_stream": 56, "udp_stream": null, "frame_number": 1080, "timestamp_epoch": "1548712323.104433000" } ], "http_response": [ { "kind": "http_response", "dst_ip": "172.17.8.109", "fields": { "http.request_in": "445", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "14" }, "src_ip": "23.50.224.8", "dst_port": 49183, "event_id": "evt-9622f7a7922a0c870a4aee57", "src_port": 80, "tcp_stream": 27, "udp_stream": null, "body_sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "frame_number": 447, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 14, "timestamp_epoch": "1548711859.895513000" }, { "kind": "http_response", "dst_ip": "172.17.8.109", "fields": { "http.request_in": "802", "http.content_type": "application/octet-stream", "http.response.code": "200", "http.content_length": "155648" }, "src_ip": "91.121.30.169", "dst_port": 49207, "event_id": "evt-749d5455eb9c02e9f948da79", "src_port": 8000, "tcp_stream": 50, "udp_stream": null, "body_sha256": "9f6e3e65aedca997c6445329663bd1d279392a34cfda7d1b56461eb41641fa08", "frame_number": 983, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 155648, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 155648, "timestamp_epoch": "1548712158.527451000" }, { "kind": "http_response", "dst_ip": "172.17.8.109", "fields": { "http.request_in": "1080", "http.content_type": "application/vnd.ms-cab-compressed", "http.response.code": "304" }, "src_ip": "204.2.193.184", "dst_port": 49213, "event_id": "evt-d68673c11de4084f01b9e7bf", "src_port": 80, "tcp_stream": 56, "udp_stream": null, "frame_number": 1082, "timestamp_epoch": "1548712323.136399000" } ], "tls_client_hello": [ { "kind": "tls_client_hello", "dst_ip": "192.241.220.183", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "172.17.8.109", "dst_port": 3389, "event_id": "evt-fb3a2b7808483b0154adae90", "src_port": 49212, "tcp_stream": 55, "udp_stream": null, "frame_number": 1065, "timestamp_epoch": "1548712322.833020000" }, { "kind": "tls_client_hello", "dst_ip": "192.241.220.183", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "172.17.8.109", "dst_port": 3389, "event_id": "evt-e92f5469490ee6bc065cec38", "src_port": 49214, "tcp_stream": 57, "udp_stream": null, "frame_number": 1108, "timestamp_epoch": "1548712324.832679000" }, { "kind": "tls_client_hello", "dst_ip": "192.241.220.183", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "172.17.8.109", "dst_port": 3389, "event_id": "evt-3f5eda83723114a68eed3671", "src_port": 49215, "tcp_stream": 58, "udp_stream": null, "frame_number": 1899, "timestamp_epoch": "1548712328.178366000" }, { "kind": "tls_client_hello", "dst_ip": "192.241.220.183", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "172.17.8.109", "dst_port": 3389, "event_id": "evt-e8a0e2d50efefa49faa07d2f", "src_port": 49216, "tcp_stream": 59, "udp_stream": null, "frame_number": 1916, "timestamp_epoch": "1548712333.632459000" }, { "kind": "tls_client_hello", "dst_ip": "216.239.94.252", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "172.17.8.109", "dst_port": 443, "event_id": "evt-fbae74a1b819195eb8e10f9a", "src_port": 49224, "tcp_stream": 63, "udp_stream": null, "frame_number": 1985, "timestamp_epoch": "1548712551.420293000" }, { "kind": "tls_client_hello", "dst_ip": "216.239.94.252", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "172.17.8.109", "dst_port": 443, "event_id": "evt-1362436b75f120bf15122722", "src_port": 49230, "tcp_stream": 69, "udp_stream": null, "frame_number": 3261, "timestamp_epoch": "1548712577.784487000" }, { "kind": "tls_client_hello", "dst_ip": "216.239.94.252", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "172.17.8.109", "dst_port": 443, "event_id": "evt-5fa7297d70b63db6c7daedab", "src_port": 49232, "tcp_stream": 71, "udp_stream": null, "frame_number": 3642, "timestamp_epoch": "1548712585.768471000" }, { "kind": "tls_client_hello", "dst_ip": "216.239.94.252", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "172.17.8.109", "dst_port": 443, "event_id": "evt-7a4d2d0e92d25cd8405123bf", "src_port": 49234, "tcp_stream": 73, "udp_stream": null, "frame_number": 3673, "timestamp_epoch": "1548712597.583605000" } ], "unclassified_tcp": [ { "kind": "unclassified_tcp", "dst_ip": "172.17.8.109", "fields": { "tcp.payload": "00" }, "src_ip": "172.17.8.2", "dst_port": 49200, "event_id": "evt-d875a463406d9dfed77a2b4a", "src_port": 445, "tcp_stream": 43, "udp_stream": null, "frame_number": 1020, "timestamp_epoch": "1548712274.069626000" }, { "kind": "unclassified_tcp", "dst_ip": "172.17.8.109", "fields": { "tcp.payload": "00" }, "src_ip": "172.17.8.2", "dst_port": 49200, "event_id": "evt-492c7c219b1071397f8a917c", "src_port": 445, "tcp_stream": 43, "udp_stream": null, "frame_number": 1961, "timestamp_epoch": "1548712394.295270000" }, { "kind": "unclassified_tcp", "dst_ip": "172.17.8.109", "fields": { "tcp.payload": "00" }, "src_ip": "172.17.8.2", "dst_port": 49200, "event_id": "evt-4b02e8bfa0db52ab01dc09bf", "src_port": 445, "tcp_stream": 43, "udp_stream": null, "frame_number": 1967, "timestamp_epoch": "1548712514.532729000" }, { "kind": "unclassified_tcp", "dst_ip": "172.17.8.109", "fields": { "tcp.payload": "757a595bc27fc05b25c25ca323ba55ad2507d3cea9a4e84babd41b45b7fe9c3c3fde5d763dce6f071a491727679e9beb6f6b273f5cbdfb7b911e26d1ab3fb3968bc992a2534b541c56a631ca55d3b78d84bd7a798489340dfb3ec5a9af44826bbde0d4af04b7665bea8c98d5d4ce88525a7a91f7e5f15a220ec318adbb8577f7921a62224cc51fb785450bbd462f81c81fa0d9729a0f447d652f3d3501021e74035a4ae0f51ac4ef69187c0a1efecb17a05749aaa1818eff86dd8c4ffe314be08a00db1c5d30d4987fd6c5889205e857896ec182af67b998340b7831575f9359bb4fc54605d010b8fe6b4db14806916b2bae5f83327871753d834ef1c02a86c93a0798276a0b934da00a0fe8ad6be1039bc383ede0c20388b6ec69ee17879716efa9b23a7cc0726ff735877ba5b591a2354804257deed30c757329643db9ef5da55404776fe5bacb5978d82d184a02f51fb52c408ef2499d7c53b162465ab09182148f9e68cefd8576e80ea7add4ee1a6cab9b5518902c146b865c91082e72070ad1dc5685955e9a6110972f336325a9e2d0653ab47f7a99f2ce46d0864da7c433084ad8839680f4c59aabb6768cd3f69f154b03538c70c1a2706504b038e30dad4f2c8eb8bf76de1d79b251ddbfd6455cbfc5c85d99427a04a99624b30171c8b20c0d3dddf794a367e40ebae0d8757577f17e43357e4467de91e3abf95e6dc5724d2822a2e71a1f7c7142be69581e640ac124ba0632a9e325c8b91d8ae2ce0a4b79eb4bcae4bfd0a632503e26daec4375c821787bfc6a35c37000146d6ca0baaaaecbea40ba037473490b93e4dcdd1ef6c5cb18d044fa7055081a5449cc93dfaf8e5cff92e3768a5494ba963a16cf0c57e5c797429267a4ed9291c126df25d9ba903e2406c81d9f30331cc18170babfd315eb0041e185e3046173af8049ba31d111ffc1ff6fd0424cb91a4d8f89e1a0fa3ef3304664ac7c258a3859121362a5ea31beffe938fd643d8745cd55fd610467d8ae3a92b210fb450d54c650a2f7049e83f7caceb72de58fae1a9be96586fca7a7780288b1168a95c330b813ba27f96cd904f733b75375d861e63545d34141f4e6cbae0b93dbb6cc81775524160dc7704d88576fb411c4985d5edb1d10ab3e326e85c661b86cf90bad7421fca5ef284ab4d2c19ac24205a5f4caae45177ada2023ea57b0f7e2dca04c937737463ae7f10cc0fe16ee7df093c0aa0adcd7588e1e4cc1387e12ca3e9a7f5055b1cd696462a68e95ac8f32d9f38cdf0541174f1587b41d5781cb9efa0b0f8a29f03f402a5bd4392f960b06311e7fa8708ff441024f94633ed9f21e9fcf8df63070d4a44a0a762401a799df7920b11694ba74d84a51846b025dbce0975b024b76084bf1095d094e525ce8edcba4b322861f05d2ffa922cc83df9cb434901c8ab1510ed2c32488117cd793c6b18b98efaecbe3220c2ead2b0ab5bc0813ac5efdd8517cfea3794a6989b12d66bfa85df753fba64b26b45bac8c91539f0f7f94ff2c77d313c691f7004bf9162fa05dbae05b10519ac986d2bca2ad1a6931a12a49ce40e5b37d5a1b8993ceb05a837f2a58171894f9ddf7ae51602c99a6c9be1a77aaf0d2c7cc0a97e56b572c257582ac774349e422bcca26d08c992212a5e66a5d336e475227a598569e35526867493edb271f4bb7f728ab65bac425d372257c37e89432cb3dc50784af99197fdc077f23034c4d69f649acfb53a22f3816d58895e183e0c88d2567d82a73029e8292edaf6d0145feaac8ff7a715b3e8bf66d2c2d93e3cc7b80bea2fa79f8a44858" }, "src_ip": "216.239.94.252", "dst_port": 49228, "event_id": "evt-00b8aa1419ce8104cdf72ad6", "src_port": 443, "tcp_stream": 67, "udp_stream": null, "frame_number": 2991, "timestamp_epoch": "1548712571.466506000" } ], "directory_service": [ { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-93297967e5ecbca443efcc97", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 57, "timestamp_epoch": "1548711854.211347000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-388ebce0a5360a24ac9e2393", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 58, "timestamp_epoch": "1548711854.211489000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-89dd70ba5d2741d6dbcf7795", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 59, "timestamp_epoch": "1548711854.212471000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-2a8385d40a0d5e444281cc92", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 60, "timestamp_epoch": "1548711854.212725000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-fbc48cd3cd191cbdf6242016", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 61, "timestamp_epoch": "1548711854.213374000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-fa0269f42cd591cff1dca91a", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 62, "timestamp_epoch": "1548711854.213375000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-20b8a4e4d960c750b26bcb89", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 63, "timestamp_epoch": "1548711854.214600000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-b4d6ec0361419a8b72ba9a99", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 64, "timestamp_epoch": "1548711854.214672000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-e597b0ae63882d95f5f7ad88", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 130, "timestamp_epoch": "1548711854.412240000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-f45c98a21e4d1556a32bf040", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 132, "timestamp_epoch": "1548711854.412352000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-d864fa2d788d41c23d313d65", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 148, "timestamp_epoch": "1548711854.417351000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-ab3ec263d0680b92fc829849", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 150, "timestamp_epoch": "1548711854.417558000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-e5375f87a4a901c1332b93c8", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 151, "timestamp_epoch": "1548711854.419344000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-61fca2d501d1b89b633fd365", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 167, "timestamp_epoch": "1548711854.728336000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-8b90de632f7e29ce7a76d027", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 168, "timestamp_epoch": "1548711854.728434000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-3ac527b267ff344138af2149", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 169, "timestamp_epoch": "1548711854.728738000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-d85596c4c9b47fc6dce3845e", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 170, "timestamp_epoch": "1548711854.728975000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-ec1bb08098cffaec138b972b", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 171, "timestamp_epoch": "1548711854.729333000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-49340aad7847fc4c9a6a8cc0", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 172, "timestamp_epoch": "1548711854.729503000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-7e592657488f07f228c9d16f", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 173, "timestamp_epoch": "1548711854.729718000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-f827622974bfe382852146d4", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 174, "timestamp_epoch": "1548711854.729801000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-5de369d1153f020c607be699", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 203, "timestamp_epoch": "1548711855.166219000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-201efd27b071ea8e6ff69d30", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 205, "timestamp_epoch": "1548711855.166398000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-0c333a632694aa4e322f4e45", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 220, "timestamp_epoch": "1548711855.169319000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-8c8173a7f8d804ee68c360a2", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 222, "timestamp_epoch": "1548711855.169855000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": {}, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-d319c0355898f8778dcb2deb", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 223, "timestamp_epoch": "1548711855.170175000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": {}, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-0fde53fadd71ecc1c277724e", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 224, "timestamp_epoch": "1548711855.170283000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": {}, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-a07fd20462bd7c19c85f2d4a", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 225, "timestamp_epoch": "1548711855.170540000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": {}, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-7cf878c2190b1da396991495", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 226, "timestamp_epoch": "1548711855.170779000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": {}, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-3cc7a7816e8804a22297a64a", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 238, "timestamp_epoch": "1548711855.270319000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": {}, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-2df7caaff8cc0fccb008d198", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 239, "timestamp_epoch": "1548711855.270575000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": {}, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-9c720db9c7cc5819a5455de7", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 251, "timestamp_epoch": "1548711855.370420000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": {}, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-2e317f073112a5eab57db14f", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 253, "timestamp_epoch": "1548711855.370674000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": {}, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-4ff7eca80191ce8b1672f1b0", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 259, "timestamp_epoch": "1548711855.371912000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": {}, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-4bb5f4a74452dc201f94ffe0", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 261, "timestamp_epoch": "1548711855.372261000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": {}, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-b354470cb497b07e9b7cfff1", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 267, "timestamp_epoch": "1548711855.373813000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": {}, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-8465c93a18a30016fde06393", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 269, "timestamp_epoch": "1548711855.374070000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": {}, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-7bc4a0a5cbe363b39451feaa", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 270, "timestamp_epoch": "1548711855.374276000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": {}, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-a26fb70d7b2a2bad8550a459", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 271, "timestamp_epoch": "1548711855.374465000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": {}, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-57b7b2e50441089fcff23ae5", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 272, "timestamp_epoch": "1548711855.374876000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-4a4059e441decfbe4ce8fcf0", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 282, "timestamp_epoch": "1548711855.404145000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-dab2022b21c1a76a9a85a04f", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 284, "timestamp_epoch": "1548711855.404327000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-de83771e5c6431d3e0e95ee3", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 287, "timestamp_epoch": "1548711855.405248000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-b36d33087177df8f7daf4e9c", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 289, "timestamp_epoch": "1548711855.406633000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=timbershade,DC=info", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-cdc90c4765eec1a0d8681a9f", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 302, "timestamp_epoch": "1548711855.418931000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-712810f81f586d8c4f21acc0", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 303, "timestamp_epoch": "1548711855.419316000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-1b163f7735bb7cb021b0f18a", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 330, "timestamp_epoch": "1548711855.422217000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-977ede0cc8667393461f7c19", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 332, "timestamp_epoch": "1548711855.422880000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-9ef3ed1de3990a0d3249aea6", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 333, "timestamp_epoch": "1548711855.423256000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-f719aeaeb010d91347b86ac5", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 334, "timestamp_epoch": "1548711855.423358000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=timbershade,DC=info", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-affe423b2f43ee2c021f2160", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 335, "timestamp_epoch": "1548711855.423621000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-26978fb1bff1941f860dc4d3", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 336, "timestamp_epoch": "1548711855.423759000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=timbershade,DC=info", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-97d1e56210d257230db928a5", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 337, "timestamp_epoch": "1548711855.424041000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-7d14ef5ba7b8840e50f7b500", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 338, "timestamp_epoch": "1548711855.424257000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-116471bdb78c5dd764e23727", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 385, "timestamp_epoch": "1548711855.437605000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-cb1748cb14e901a1ede30e70", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 399, "timestamp_epoch": "1548711855.909443000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-eca650a04d874682e01ff678", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 458, "timestamp_epoch": "1548711865.021579000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-e8b4341869171e88a908acf5", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 460, "timestamp_epoch": "1548711865.021793000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-74285d69e0ecad3335f9800e", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 463, "timestamp_epoch": "1548711865.023357000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-e182f7ccdba26a06978d8b01", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 465, "timestamp_epoch": "1548711865.024062000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-684af361f29be2477ee98abd", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 466, "timestamp_epoch": "1548711865.025324000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-22e0b7bca00f3400f10a5052", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 467, "timestamp_epoch": "1548711865.025493000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-c124a0f27452417e216b340e", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 468, "timestamp_epoch": "1548711865.025672000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-e0d1289b3099f65422113eac", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 469, "timestamp_epoch": "1548711865.025794000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=NTDS Settings,CN=TIMBERSHADE-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=timbershade,DC=info", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-1fdc94296fd1bc4fe491314c", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 470, "timestamp_epoch": "1548711865.025927000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-e032c7668542118ce0b7ae4e", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 471, "timestamp_epoch": "1548711865.026099000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Public Key Services,CN=Services,CN=Configuration,DC=timbershade,DC=info", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-136dcc6f4f41cc606c832d4f", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 472, "timestamp_epoch": "1548711865.026244000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "ldap.protocolOp": "5" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-b7502e251d3a8af9cab1fcfc", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 473, "timestamp_epoch": "1548711865.026681000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-bfdb953f0f4434e1d05391c0", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 478, "timestamp_epoch": "1548711865.032047000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-5137bddfc79607f12ec0c91f", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 480, "timestamp_epoch": "1548711865.032606000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-06a16253b06ff6f74fa89a2d", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 481, "timestamp_epoch": "1548711865.032827000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-7e9fd2d55d5897d9156844a4", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 482, "timestamp_epoch": "1548711865.033001000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=timbershade,DC=info", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-5a50a50150124901b28b628c", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 513, "timestamp_epoch": "1548711865.047416000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "ldap.protocolOp": "5" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-60ca052b29282f37490cb568", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 514, "timestamp_epoch": "1548711865.047905000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-64c8e0ff9447de0d7d0b2980", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 515, "timestamp_epoch": "1548711865.048042000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-cd762d407aa7495a4141ee4a", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 518, "timestamp_epoch": "1548711865.048240000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-1467b2481decc97293297c5e", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 659, "timestamp_epoch": "1548712131.338415000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-a18987f205ba01cac6fa8b98", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 660, "timestamp_epoch": "1548712131.338415000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-b43c9abd7d09e154116d9c77", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 661, "timestamp_epoch": "1548712131.338954000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-4a2c3d2a6ba8454dec20ab67", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 662, "timestamp_epoch": "1548712131.338954000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-2d33b1c484cc097257b2dda9", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 663, "timestamp_epoch": "1548712131.340882000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-f77a5df338cbc254aeccd8ef", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 664, "timestamp_epoch": "1548712131.340884000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-226b77114b73dea49e5fc88d", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 665, "timestamp_epoch": "1548712131.340884000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-ab9450428b6aec9c222b73ab", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 666, "timestamp_epoch": "1548712131.340885000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-5e71746feea2735c977901c1", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 732, "timestamp_epoch": "1548712131.875067000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-983664dc225025376d5b6876", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 734, "timestamp_epoch": "1548712131.875630000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=timbershade,DC=info", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-473dbc9456eb8313a34e6f95", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 735, "timestamp_epoch": "1548712131.877662000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-f79c88098e57ae2bb467a6db", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 736, "timestamp_epoch": "1548712131.877896000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-8646f12f175562609c41d6c7", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 741, "timestamp_epoch": "1548712131.880430000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-3167a3776c5aa10212e122d9", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 743, "timestamp_epoch": "1548712131.880949000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-7e9453b1309ce57cc0792be5", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 744, "timestamp_epoch": "1548712131.881220000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-575c72eac314f318740552a9", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 745, "timestamp_epoch": "1548712131.881338000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=timbershade,DC=info", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-8bfc50f8718a3209d0b7ff1d", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 746, "timestamp_epoch": "1548712131.881476000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-060e6a843a8d5762e3c32387", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 747, "timestamp_epoch": "1548712131.881622000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=timbershade,DC=info", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-d684b7061012695f5d7a2436", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 748, "timestamp_epoch": "1548712131.881774000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-cc2448a27ddceafedec24483", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 749, "timestamp_epoch": "1548712131.882002000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-ea24d2eba158fd2e17f20dd9", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 768, "timestamp_epoch": "1548712131.889045000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-382f5fca8fa8f362142e5799", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 773, "timestamp_epoch": "1548712132.427831000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-6c267e2ab7d53a8bb6e44418", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1006, "timestamp_epoch": "1548712211.385714000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-9fca4003044940b1ce2c0cbd", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1007, "timestamp_epoch": "1548712211.386014000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-6096b3232556c33076226fbc", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1008, "timestamp_epoch": "1548712211.386394000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-0fd3f8f6dbd67fd1dee4afd8", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1009, "timestamp_epoch": "1548712211.386695000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-31c2a30433605f9a10933ca6", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1010, "timestamp_epoch": "1548712211.387037000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-91910c9ae058c25e152a0860", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1011, "timestamp_epoch": "1548712211.387278000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-d24be6759929aeb5271ac739", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1012, "timestamp_epoch": "1548712211.387404000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-7b48046ea649a2bf7f66b723", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1013, "timestamp_epoch": "1548712211.387639000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-1bf0fc7fde652cba25807cbb", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1014, "timestamp_epoch": "1548712211.389517000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-de9845e2cde8e73bb55e97a7", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1015, "timestamp_epoch": "1548712211.389703000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-8520bf11770280fa37d032b5", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 1947, "timestamp_epoch": "1548712367.940358000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-eb7911784db1e75f9e1853ac", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 1948, "timestamp_epoch": "1548712367.940464000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-d286f8aee479201e3ff15894", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 1949, "timestamp_epoch": "1548712367.940562000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-fc792535d7045ba97de1689c", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 1950, "timestamp_epoch": "1548712367.940699000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-19b2621cfc08cb093aa6fbcd", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 1951, "timestamp_epoch": "1548712367.940772000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-b5634ad567b97775dca153a9", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 1952, "timestamp_epoch": "1548712367.940889000" }, { "kind": "directory_service", "dst_ip": "172.17.8.2", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.109", "dst_port": null, "event_id": "evt-1f283c087e2b2867b01e53a9", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 1953, "timestamp_epoch": "1548712367.940959000" }, { "kind": "directory_service", "dst_ip": "172.17.8.109", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.2", "dst_port": null, "event_id": "evt-0e89a47c154dcbe24dd5e585", "src_port": null, "tcp_stream": 61, "udp_stream": null, "frame_number": 1954, "timestamp_epoch": "1548712367.941021000" } ] }, "capture": { "format": "pcap-le-microsecond", "packet_count": 3690, "interface_ids": [], "source_sha256": "2fc08b2bcdd1be009dab7cea877464e6ce9f93c65bc3e45b1583266e164408db", "captured_bytes": 2393510, "protocol_counts": { "ip": 3690, "dns": 52, "eth": 3690, "ntp": 2, "smb": 9, "tcp": 3564, "tls": 371, "udp": 118, "data": 11, "dhcp": 6, "http": 6, "igmp": 16, "ldap": 78, "nbns": 26, "nbss": 86, "smb2": 83, "ssdp": 6, "cldap": 12, "llmnr": 8, "nbdgm": 6, "dcerpc": 118, "spnego": 51, "x509ce": 24, "browser": 6, "gss-api": 73, "x509sat": 64, "kerberos": 48, "ethertype": 3690, "spnego-krb5": 183, "data-text-lines": 1 }, "duration_seconds": 746.993131, "last_packet_epoch": "1548712601.043274", "source_size_bytes": 2452574, "first_packet_epoch": "1548711854.050143", "encapsulation_types": [ 1 ] }, "summary": "Decoded 3690 packets across 12 IP endpoints and 118 transport flows. Observed 52 DNS events, 9 HTTP requests, 8 TLS ClientHello events, and 2 recovered file/message object(s). Deterministic rules produced 4 finding(s): 0 high, 0 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "coverage": { "warnings": [], "limitations": [ "Encrypted application contents are not decrypted", "Protocol decoding and heuristic findings do not establish malware family or attribution", "No endpoint execution, persistence, or credential-theft proof without corresponding evidence" ], "event_limits": { "dns": { "returned": 52, "truncated": false }, "dhcp": { "returned": 6, "truncated": false }, "smtp": { "returned": 0, "truncated": false }, "identity": { "returned": 202, "truncated": false }, "http_request": { "returned": 9, "truncated": false }, "http_response": { "returned": 3, "truncated": false }, "tls_client_hello": { "returned": 8, "truncated": false }, "unclassified_tcp": { "returned": 4, "truncated": false }, "directory_service": { "returned": 116, "truncated": false } }, "http_objects": { "complete": true, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "hashed_bytes": 155662, "export_status": "completed", "unique_hashes": 2, "hashed_objects": 2, "compact_objects": 0, "detailed_objects": 2, "exported_objects": 2, "unhashed_objects": 0, "compact_hash_index": [], "omitted_unique_hashes": 0, "returned_unique_hashes": 2 }, "name_resolution": false, "supplemental_objects": { "scope": "bounded IMF, inert embedded base64 and complete contiguous HTTP response recovery", "returned": 0 }, "complete_within_profile": true, "encrypted_payload_visibility": "metadata-only" }, "findings": [ { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "172.17.8.109", "protocol": "drsuapi", "destination": "172.17.8.2", "event_count": 21, "operation_numbers": [ "0", "1", "12" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 1, "frame_number": 57, "display_filter": "frame.number == 57", "timestamp_epoch": "1548711854.211347000" }, { "tcp_stream": 1, "frame_number": 59, "display_filter": "frame.number == 59", "timestamp_epoch": "1548711854.212471000" }, { "tcp_stream": 1, "frame_number": 61, "display_filter": "frame.number == 61", "timestamp_epoch": "1548711854.213374000" }, { "tcp_stream": 1, "frame_number": 63, "display_filter": "frame.number == 63", "timestamp_epoch": "1548711854.214600000" }, { "tcp_stream": 1, "frame_number": 167, "display_filter": "frame.number == 167", "timestamp_epoch": "1548711854.728336000" }, { "tcp_stream": 1, "frame_number": 169, "display_filter": "frame.number == 169", "timestamp_epoch": "1548711854.728738000" }, { "tcp_stream": 1, "frame_number": 171, "display_filter": "frame.number == 171", "timestamp_epoch": "1548711854.729333000" }, { "tcp_stream": 1, "frame_number": 173, "display_filter": "frame.number == 173", "timestamp_epoch": "1548711854.729718000" }, { "tcp_stream": 41, "frame_number": 659, "display_filter": "frame.number == 659", "timestamp_epoch": "1548712131.338415000" }, { "tcp_stream": 41, "frame_number": 661, "display_filter": "frame.number == 661", "timestamp_epoch": "1548712131.338954000" }, { "tcp_stream": 41, "frame_number": 663, "display_filter": "frame.number == 663", "timestamp_epoch": "1548712131.340882000" }, { "tcp_stream": 41, "frame_number": 665, "display_filter": "frame.number == 665", "timestamp_epoch": "1548712131.340884000" }, { "tcp_stream": 52, "frame_number": 1006, "display_filter": "frame.number == 1006", "timestamp_epoch": "1548712211.385714000" }, { "tcp_stream": 52, "frame_number": 1008, "display_filter": "frame.number == 1008", "timestamp_epoch": "1548712211.386394000" }, { "tcp_stream": 52, "frame_number": 1010, "display_filter": "frame.number == 1010", "timestamp_epoch": "1548712211.387037000" }, { "tcp_stream": 52, "frame_number": 1012, "display_filter": "frame.number == 1012", "timestamp_epoch": "1548712211.387404000" }, { "tcp_stream": 52, "frame_number": 1014, "display_filter": "frame.number == 1014", "timestamp_epoch": "1548712211.389517000" }, { "tcp_stream": 61, "frame_number": 1947, "display_filter": "frame.number == 1947", "timestamp_epoch": "1548712367.940358000" }, { "tcp_stream": 61, "frame_number": 1949, "display_filter": "frame.number == 1949", "timestamp_epoch": "1548712367.940562000" }, { "tcp_stream": 61, "frame_number": 1951, "display_filter": "frame.number == 1951", "timestamp_epoch": "1548712367.940772000" }, { "tcp_stream": 61, "frame_number": 1953, "display_filter": "frame.number == 1953", "timestamp_epoch": "1548712367.940959000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-06e49cc839ea55bf4c0d1e7d", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "172.17.8.109", "protocol": "ldap", "destination": "172.17.8.2", "event_count": 41, "operation_numbers": [ "", "0", "2", "3" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 10, "frame_number": 130, "display_filter": "frame.number == 130", "timestamp_epoch": "1548711854.412240000" }, { "tcp_stream": 10, "frame_number": 148, "display_filter": "frame.number == 148", "timestamp_epoch": "1548711854.417351000" }, { "tcp_stream": 10, "frame_number": 151, "display_filter": "frame.number == 151", "timestamp_epoch": "1548711854.419344000" }, { "tcp_stream": 13, "frame_number": 203, "display_filter": "frame.number == 203", "timestamp_epoch": "1548711855.166219000" }, { "tcp_stream": 13, "frame_number": 220, "display_filter": "frame.number == 220", "timestamp_epoch": "1548711855.169319000" }, { "tcp_stream": 13, "frame_number": 223, "display_filter": "frame.number == 223", "timestamp_epoch": "1548711855.170175000" }, { "tcp_stream": 13, "frame_number": 225, "display_filter": "frame.number == 225", "timestamp_epoch": "1548711855.170540000" }, { "tcp_stream": 13, "frame_number": 238, "display_filter": "frame.number == 238", "timestamp_epoch": "1548711855.270319000" }, { "tcp_stream": 13, "frame_number": 251, "display_filter": "frame.number == 251", "timestamp_epoch": "1548711855.370420000" }, { "tcp_stream": 13, "frame_number": 259, "display_filter": "frame.number == 259", "timestamp_epoch": "1548711855.371912000" }, { "tcp_stream": 13, "frame_number": 267, "display_filter": "frame.number == 267", "timestamp_epoch": "1548711855.373813000" }, { "tcp_stream": 13, "frame_number": 270, "display_filter": "frame.number == 270", "timestamp_epoch": "1548711855.374276000" }, { "tcp_stream": 13, "frame_number": 272, "display_filter": "frame.number == 272", "timestamp_epoch": "1548711855.374876000" }, { "tcp_stream": 19, "frame_number": 282, "display_filter": "frame.number == 282", "timestamp_epoch": "1548711855.404145000" }, { "tcp_stream": 19, "frame_number": 287, "display_filter": "frame.number == 287", "timestamp_epoch": "1548711855.405248000" }, { "tcp_stream": 19, "frame_number": 302, "display_filter": "frame.number == 302", "timestamp_epoch": "1548711855.418931000" }, { "tcp_stream": 22, "frame_number": 330, "display_filter": "frame.number == 330", "timestamp_epoch": "1548711855.422217000" }, { "tcp_stream": 22, "frame_number": 333, "display_filter": "frame.number == 333", "timestamp_epoch": "1548711855.423256000" }, { "tcp_stream": 22, "frame_number": 335, "display_filter": "frame.number == 335", "timestamp_epoch": "1548711855.423621000" }, { "tcp_stream": 19, "frame_number": 337, "display_filter": "frame.number == 337", "timestamp_epoch": "1548711855.424041000" }, { "tcp_stream": 22, "frame_number": 385, "display_filter": "frame.number == 385", "timestamp_epoch": "1548711855.437605000" }, { "tcp_stream": 19, "frame_number": 399, "display_filter": "frame.number == 399", "timestamp_epoch": "1548711855.909443000" }, { "tcp_stream": 28, "frame_number": 458, "display_filter": "frame.number == 458", "timestamp_epoch": "1548711865.021579000" }, { "tcp_stream": 28, "frame_number": 463, "display_filter": "frame.number == 463", "timestamp_epoch": "1548711865.023357000" }, { "tcp_stream": 28, "frame_number": 466, "display_filter": "frame.number == 466", "timestamp_epoch": "1548711865.025324000" }, { "tcp_stream": 28, "frame_number": 468, "display_filter": "frame.number == 468", "timestamp_epoch": "1548711865.025672000" }, { "tcp_stream": 28, "frame_number": 470, "display_filter": "frame.number == 470", "timestamp_epoch": "1548711865.025927000" }, { "tcp_stream": 28, "frame_number": 472, "display_filter": "frame.number == 472", "timestamp_epoch": "1548711865.026244000" }, { "tcp_stream": 29, "frame_number": 478, "display_filter": "frame.number == 478", "timestamp_epoch": "1548711865.032047000" }, { "tcp_stream": 29, "frame_number": 481, "display_filter": "frame.number == 481", "timestamp_epoch": "1548711865.032827000" }, { "tcp_stream": 29, "frame_number": 513, "display_filter": "frame.number == 513", "timestamp_epoch": "1548711865.047416000" }, { "tcp_stream": 29, "frame_number": 515, "display_filter": "frame.number == 515", "timestamp_epoch": "1548711865.048042000" }, { "tcp_stream": 28, "frame_number": 518, "display_filter": "frame.number == 518", "timestamp_epoch": "1548711865.048240000" }, { "tcp_stream": 46, "frame_number": 732, "display_filter": "frame.number == 732", "timestamp_epoch": "1548712131.875067000" }, { "tcp_stream": 46, "frame_number": 735, "display_filter": "frame.number == 735", "timestamp_epoch": "1548712131.877662000" }, { "tcp_stream": 48, "frame_number": 741, "display_filter": "frame.number == 741", "timestamp_epoch": "1548712131.880430000" }, { "tcp_stream": 48, "frame_number": 744, "display_filter": "frame.number == 744", "timestamp_epoch": "1548712131.881220000" }, { "tcp_stream": 48, "frame_number": 746, "display_filter": "frame.number == 746", "timestamp_epoch": "1548712131.881476000" }, { "tcp_stream": 46, "frame_number": 748, "display_filter": "frame.number == 748", "timestamp_epoch": "1548712131.881774000" }, { "tcp_stream": 48, "frame_number": 768, "display_filter": "frame.number == 768", "timestamp_epoch": "1548712131.889045000" }, { "tcp_stream": 46, "frame_number": 773, "display_filter": "frame.number == 773", "timestamp_epoch": "1548712132.427831000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-e76b4b0c704605334f3f52d4", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "172.17.8.2", "protocol": "drsuapi", "destination": "172.17.8.109", "event_count": 21, "operation_numbers": [ "0", "1", "12" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 1, "frame_number": 58, "display_filter": "frame.number == 58", "timestamp_epoch": "1548711854.211489000" }, { "tcp_stream": 1, "frame_number": 60, "display_filter": "frame.number == 60", "timestamp_epoch": "1548711854.212725000" }, { "tcp_stream": 1, "frame_number": 62, "display_filter": "frame.number == 62", "timestamp_epoch": "1548711854.213375000" }, { "tcp_stream": 1, "frame_number": 64, "display_filter": "frame.number == 64", "timestamp_epoch": "1548711854.214672000" }, { "tcp_stream": 1, "frame_number": 168, "display_filter": "frame.number == 168", "timestamp_epoch": "1548711854.728434000" }, { "tcp_stream": 1, "frame_number": 170, "display_filter": "frame.number == 170", "timestamp_epoch": "1548711854.728975000" }, { "tcp_stream": 1, "frame_number": 172, "display_filter": "frame.number == 172", "timestamp_epoch": "1548711854.729503000" }, { "tcp_stream": 1, "frame_number": 174, "display_filter": "frame.number == 174", "timestamp_epoch": "1548711854.729801000" }, { "tcp_stream": 41, "frame_number": 660, "display_filter": "frame.number == 660", "timestamp_epoch": "1548712131.338415000" }, { "tcp_stream": 41, "frame_number": 662, "display_filter": "frame.number == 662", "timestamp_epoch": "1548712131.338954000" }, { "tcp_stream": 41, "frame_number": 664, "display_filter": "frame.number == 664", "timestamp_epoch": "1548712131.340884000" }, { "tcp_stream": 41, "frame_number": 666, "display_filter": "frame.number == 666", "timestamp_epoch": "1548712131.340885000" }, { "tcp_stream": 52, "frame_number": 1007, "display_filter": "frame.number == 1007", "timestamp_epoch": "1548712211.386014000" }, { "tcp_stream": 52, "frame_number": 1009, "display_filter": "frame.number == 1009", "timestamp_epoch": "1548712211.386695000" }, { "tcp_stream": 52, "frame_number": 1011, "display_filter": "frame.number == 1011", "timestamp_epoch": "1548712211.387278000" }, { "tcp_stream": 52, "frame_number": 1013, "display_filter": "frame.number == 1013", "timestamp_epoch": "1548712211.387639000" }, { "tcp_stream": 52, "frame_number": 1015, "display_filter": "frame.number == 1015", "timestamp_epoch": "1548712211.389703000" }, { "tcp_stream": 61, "frame_number": 1948, "display_filter": "frame.number == 1948", "timestamp_epoch": "1548712367.940464000" }, { "tcp_stream": 61, "frame_number": 1950, "display_filter": "frame.number == 1950", "timestamp_epoch": "1548712367.940699000" }, { "tcp_stream": 61, "frame_number": 1952, "display_filter": "frame.number == 1952", "timestamp_epoch": "1548712367.940889000" }, { "tcp_stream": 61, "frame_number": 1954, "display_filter": "frame.number == 1954", "timestamp_epoch": "1548712367.941021000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-1bc0ce9cdbf77ef0a8924680", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "172.17.8.2", "protocol": "ldap", "destination": "172.17.8.109", "event_count": 33, "operation_numbers": [ "", "1", "4,19,19,19,5", "4,5", "5" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 10, "frame_number": 132, "display_filter": "frame.number == 132", "timestamp_epoch": "1548711854.412352000" }, { "tcp_stream": 10, "frame_number": 150, "display_filter": "frame.number == 150", "timestamp_epoch": "1548711854.417558000" }, { "tcp_stream": 13, "frame_number": 205, "display_filter": "frame.number == 205", "timestamp_epoch": "1548711855.166398000" }, { "tcp_stream": 13, "frame_number": 222, "display_filter": "frame.number == 222", "timestamp_epoch": "1548711855.169855000" }, { "tcp_stream": 13, "frame_number": 224, "display_filter": "frame.number == 224", "timestamp_epoch": "1548711855.170283000" }, { "tcp_stream": 13, "frame_number": 226, "display_filter": "frame.number == 226", "timestamp_epoch": "1548711855.170779000" }, { "tcp_stream": 13, "frame_number": 239, "display_filter": "frame.number == 239", "timestamp_epoch": "1548711855.270575000" }, { "tcp_stream": 13, "frame_number": 253, "display_filter": "frame.number == 253", "timestamp_epoch": "1548711855.370674000" }, { "tcp_stream": 13, "frame_number": 261, "display_filter": "frame.number == 261", "timestamp_epoch": "1548711855.372261000" }, { "tcp_stream": 13, "frame_number": 269, "display_filter": "frame.number == 269", "timestamp_epoch": "1548711855.374070000" }, { "tcp_stream": 13, "frame_number": 271, "display_filter": "frame.number == 271", "timestamp_epoch": "1548711855.374465000" }, { "tcp_stream": 19, "frame_number": 284, "display_filter": "frame.number == 284", "timestamp_epoch": "1548711855.404327000" }, { "tcp_stream": 19, "frame_number": 289, "display_filter": "frame.number == 289", "timestamp_epoch": "1548711855.406633000" }, { "tcp_stream": 19, "frame_number": 303, "display_filter": "frame.number == 303", "timestamp_epoch": "1548711855.419316000" }, { "tcp_stream": 22, "frame_number": 332, "display_filter": "frame.number == 332", "timestamp_epoch": "1548711855.422880000" }, { "tcp_stream": 22, "frame_number": 334, "display_filter": "frame.number == 334", "timestamp_epoch": "1548711855.423358000" }, { "tcp_stream": 22, "frame_number": 336, "display_filter": "frame.number == 336", "timestamp_epoch": "1548711855.423759000" }, { "tcp_stream": 19, "frame_number": 338, "display_filter": "frame.number == 338", "timestamp_epoch": "1548711855.424257000" }, { "tcp_stream": 28, "frame_number": 460, "display_filter": "frame.number == 460", "timestamp_epoch": "1548711865.021793000" }, { "tcp_stream": 28, "frame_number": 465, "display_filter": "frame.number == 465", "timestamp_epoch": "1548711865.024062000" }, { "tcp_stream": 28, "frame_number": 467, "display_filter": "frame.number == 467", "timestamp_epoch": "1548711865.025493000" }, { "tcp_stream": 28, "frame_number": 469, "display_filter": "frame.number == 469", "timestamp_epoch": "1548711865.025794000" }, { "tcp_stream": 28, "frame_number": 471, "display_filter": "frame.number == 471", "timestamp_epoch": "1548711865.026099000" }, { "tcp_stream": 28, "frame_number": 473, "display_filter": "frame.number == 473", "timestamp_epoch": "1548711865.026681000" }, { "tcp_stream": 29, "frame_number": 480, "display_filter": "frame.number == 480", "timestamp_epoch": "1548711865.032606000" }, { "tcp_stream": 29, "frame_number": 482, "display_filter": "frame.number == 482", "timestamp_epoch": "1548711865.033001000" }, { "tcp_stream": 29, "frame_number": 514, "display_filter": "frame.number == 514", "timestamp_epoch": "1548711865.047905000" }, { "tcp_stream": 46, "frame_number": 734, "display_filter": "frame.number == 734", "timestamp_epoch": "1548712131.875630000" }, { "tcp_stream": 46, "frame_number": 736, "display_filter": "frame.number == 736", "timestamp_epoch": "1548712131.877896000" }, { "tcp_stream": 48, "frame_number": 743, "display_filter": "frame.number == 743", "timestamp_epoch": "1548712131.880949000" }, { "tcp_stream": 48, "frame_number": 745, "display_filter": "frame.number == 745", "timestamp_epoch": "1548712131.881338000" }, { "tcp_stream": 48, "frame_number": 747, "display_filter": "frame.number == 747", "timestamp_epoch": "1548712131.881622000" }, { "tcp_stream": 46, "frame_number": 749, "display_filter": "frame.number == 749", "timestamp_epoch": "1548712131.882002000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-db5c9fa0c2bc21aebc6f39fc", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" } ], "artifacts": [ { "md5": "57a42e1b04fe508838ad375dd707c0b0", "sha1": "1be37077fb27bf26d83ceae3903c50e0b6b43874", "type": "http-exported-object", "sha256": "9f6e3e65aedca997c6445329663bd1d279392a34cfda7d1b56461eb41641fa08", "evidence": [ { "tcp_stream": 50, "frame_number": 983, "display_filter": "frame.number == 983", "timestamp_epoch": "1548712158.527451000" } ], "filename": "actiV.bin", "filenames": [ "actiV.bin" ], "transfers": [ { "url": "http://91.121.30.169:8000/91msE95B/actiV.bin", "client_ip": "172.17.8.109", "server_ip": "91.121.30.169", "tcp_stream": 50, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 802, "response_frame": 983 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 155648, "artifact_id": "artifact-1e590e8c147fc278865188d5", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 155648, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": "executable", "features": [], "content_kind": "pe", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 155648, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "cd5a4d3fdd5bffc16bf959ef75cf37bc", "sha1": "33bf88d5b82df3723d5863c7d23445e345828904", "type": "http-exported-object", "sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "evidence": [ { "tcp_stream": 27, "frame_number": 447, "display_filter": "frame.number == 447", "timestamp_epoch": "1548711859.895513000" } ], "filename": "ncsi.txt", "filenames": [ "ncsi.txt" ], "transfers": [ { "url": "http://www.msftncsi.com/ncsi.txt", "client_ip": "172.17.8.109", "server_ip": "23.50.224.8", "tcp_stream": 27, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 445, "response_frame": 447 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/plain", "size_bytes": 14, "artifact_id": "artifact-6960f7876f72435474ecf435", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 14, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false } ], "endpoints": [ { "ip": "172.17.8.109", "bytes_sent": 210231, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-dc9fc70d860afda2d7a9b3f2", "packets_sent": 1610, "mac_addresses": [ "14:fe:b5:d4:15:ca" ], "bytes_received": 2183279, "evidence_frames": [ 1, 2, 3, 4, 5 ], "last_seen_epoch": "1548712601.043274", "first_seen_epoch": "1548711854.050143", "packets_received": 2080 }, { "ip": "172.17.8.2", "bytes_sent": 97154, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-52b935d827878e30f7548cd5", "packets_sent": 400, "mac_addresses": [ "00:21:5e:72:9e:b4" ], "bytes_received": 119637, "evidence_frames": [ 3, 4, 5, 6, 7 ], "last_seen_epoch": "1548712551.310063", "first_seen_epoch": "1548711854.061892", "packets_received": 469 }, { "ip": "172.17.8.255", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-6043ab654962b1de730ae997", "packets_sent": 0, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "bytes_received": 3164, "evidence_frames": [ 1, 2, 154, 175, 176 ], "last_seen_epoch": "1548712552.845075", "first_seen_epoch": "1548711854.050143", "packets_received": 28 }, { "ip": "192.241.220.183", "bytes_sent": 608107, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5eec61b5549363fae9a1b96e", "packets_sent": 492, "mac_addresses": [ "00:04:9a:58:eb:0d" ], "bytes_received": 30577, "evidence_frames": [ 1060, 1063, 1064, 1065, 1066 ], "last_seen_epoch": "1548712334.259716", "first_seen_epoch": "1548712322.7564", "packets_received": 354 }, { "ip": "204.2.193.184", "bytes_sent": 746, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-436f07719d952ee305ce9e26", "packets_sent": 4, "mac_addresses": [ "00:04:9a:58:eb:0d" ], "bytes_received": 584, "evidence_frames": [ 1076, 1078, 1079, 1080, 1081 ], "last_seen_epoch": "1548712334.264278", "first_seen_epoch": "1548712323.076815", "packets_received": 5 }, { "ip": "216.239.94.252", "bytes_sent": 1314267, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-fa424c2b492d721d04778212", "packets_sent": 1056, "mac_addresses": [ "00:04:9a:58:eb:0d" ], "bytes_received": 49326, "evidence_frames": [ 1969, 1970, 1971, 1972, 1973 ], "last_seen_epoch": "1548712601.043274", "first_seen_epoch": "1548712551.074374", "packets_received": 661 }, { "ip": "224.0.0.22", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-73d090938989b3b57ea5b48e", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:16" ], "bytes_received": 432, "evidence_frames": [ 406, 407, 417, 424, 425 ], "last_seen_epoch": "1548711975.147903", "first_seen_epoch": "1548711856.915568", "packets_received": 8 }, { "ip": "224.0.0.252", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-7082f69e563f3a729523d8ff", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:fc" ], "bytes_received": 556, "evidence_frames": [ 408, 413, 414, 415, 427 ], "last_seen_epoch": "1548712322.877789", "first_seen_epoch": "1548711856.917465", "packets_received": 8 }, { "ip": "23.50.224.8", "bytes_sent": 399, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-fa3495b3b71250baf4134067", "packets_sent": 4, "mac_addresses": [ "00:04:9a:58:eb:0d" ], "bytes_received": 379, "evidence_frames": [ 442, 443, 444, 445, 446 ], "last_seen_epoch": "1548711859.895944", "first_seen_epoch": "1548711859.549622", "packets_received": 5 }, { "ip": "239.255.255.250", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-440390e6b04027d66e596fb1", "packets_sent": 0, "mac_addresses": [ "01:00:5e:7f:ff:fa" ], "bytes_received": 1050, "evidence_frames": [ 562, 564, 573, 574, 575 ], "last_seen_epoch": "1548711981.315491", "first_seen_epoch": "1548711974.925375", "packets_received": 6 }, { "ip": "255.255.255.255", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-f101c8a083f7b5b74d3b6b3a", "packets_sent": 0, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "bytes_received": 1026, "evidence_frames": [ 409, 1058, 1980 ], "last_seen_epoch": "1548712551.309633", "first_seen_epoch": "1548711856.923768", "packets_received": 3 }, { "ip": "91.121.30.169", "bytes_sent": 162606, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f7a0cd54eaf7666291a29e47", "packets_sent": 124, "mac_addresses": [ "00:04:9a:58:eb:0d" ], "bytes_received": 3500, "evidence_frames": [ 799, 800, 801, 802, 803 ], "last_seen_epoch": "1548712158.564252", "first_seen_epoch": "1548712157.670214", "packets_received": 63 } ], "identities": [ { "type": "account", "value": "dunn-windows-pc$", "bindings": [ { "account": "", "owner_ip": "172.17.8.109", "frame_number": 24, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.2", "conversation_src": "172.17.8.109" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 32, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.2", "conversation_src": "172.17.8.109" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 34, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.109", "conversation_src": "172.17.8.2" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 46, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.109", "conversation_src": "172.17.8.2" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 75, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.2", "conversation_src": "172.17.8.109" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 83, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.2", "conversation_src": "172.17.8.109" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 85, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.109", "conversation_src": "172.17.8.2" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 97, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.109", "conversation_src": "172.17.8.2" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 109, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.109", "conversation_src": "172.17.8.2" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 141, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.109", "conversation_src": "172.17.8.2" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 214, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.109", "conversation_src": "172.17.8.2" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 297, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.109", "conversation_src": "172.17.8.2" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 311, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.109", "conversation_src": "172.17.8.2" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 351, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.109", "conversation_src": "172.17.8.2" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 363, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.109", "conversation_src": "172.17.8.2" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 486, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.2", "conversation_src": "172.17.8.109" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 494, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.2", "conversation_src": "172.17.8.109" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 496, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.109", "conversation_src": "172.17.8.2" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 508, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.109", "conversation_src": "172.17.8.2" } ], "evidence": [ { "tcp_stream": 2, "frame_number": 24, "display_filter": "frame.number == 24", "timestamp_epoch": "1548711854.190529000" }, { "tcp_stream": 3, "frame_number": 32, "display_filter": "frame.number == 32", "timestamp_epoch": "1548711854.203558000" }, { "tcp_stream": 3, "frame_number": 34, "display_filter": "frame.number == 34", "timestamp_epoch": "1548711854.204010000" }, { "tcp_stream": 4, "frame_number": 46, "display_filter": "frame.number == 46", "timestamp_epoch": "1548711854.207489000" }, { "tcp_stream": 6, "frame_number": 75, "display_filter": "frame.number == 75", "timestamp_epoch": "1548711854.275033000" }, { "tcp_stream": 7, "frame_number": 83, "display_filter": "frame.number == 83", "timestamp_epoch": "1548711854.287663000" }, { "tcp_stream": 7, "frame_number": 85, "display_filter": "frame.number == 85", "timestamp_epoch": "1548711854.288289000" }, { "tcp_stream": 8, "frame_number": 97, "display_filter": "frame.number == 97", "timestamp_epoch": "1548711854.292696000" }, { "tcp_stream": 9, "frame_number": 109, "display_filter": "frame.number == 109", "timestamp_epoch": "1548711854.295179000" }, { "tcp_stream": 11, "frame_number": 141, "display_filter": "frame.number == 141", "timestamp_epoch": "1548711854.415638000" }, { "tcp_stream": 14, "frame_number": 214, "display_filter": "frame.number == 214", "timestamp_epoch": "1548711855.168844000" }, { "tcp_stream": 20, "frame_number": 297, "display_filter": "frame.number == 297", "timestamp_epoch": "1548711855.416459000" }, { "tcp_stream": 21, "frame_number": 311, "display_filter": "frame.number == 311", "timestamp_epoch": "1548711855.420247000" }, { "tcp_stream": 25, "frame_number": 351, "display_filter": "frame.number == 351", "timestamp_epoch": "1548711855.429740000" }, { "tcp_stream": 26, "frame_number": 363, "display_filter": "frame.number == 363", "timestamp_epoch": "1548711855.430630000" }, { "tcp_stream": 30, "frame_number": 486, "display_filter": "frame.number == 486", "timestamp_epoch": "1548711865.033861000" }, { "tcp_stream": 31, "frame_number": 494, "display_filter": "frame.number == 494", "timestamp_epoch": "1548711865.044459000" }, { "tcp_stream": 31, "frame_number": 496, "display_filter": "frame.number == 496", "timestamp_epoch": "1548711865.045013000" }, { "tcp_stream": 32, "frame_number": 508, "display_filter": "frame.number == 508", "timestamp_epoch": "1548711865.046364000" } ], "raw_values": [ "DUNN-WINDOWS-PC$", "dunn-windows-pc$" ], "identity_id": "identity-7f49315307e32d7bad01e5e7", "ip_addresses": [ "172.17.8.109" ], "mac_addresses": [ "14:fe:b5:d4:15:ca" ] }, { "type": "account", "value": "margaret.dunn", "bindings": [ { "account": "", "owner_ip": "172.17.8.109", "frame_number": 604, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.2", "conversation_src": "172.17.8.109" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 612, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.2", "conversation_src": "172.17.8.109" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 614, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.109", "conversation_src": "172.17.8.2" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 626, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.109", "conversation_src": "172.17.8.2" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 648, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.109", "conversation_src": "172.17.8.2" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 681, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.109", "conversation_src": "172.17.8.2" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 693, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.109", "conversation_src": "172.17.8.2" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 726, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.109", "conversation_src": "172.17.8.2" } ], "evidence": [ { "tcp_stream": 37, "frame_number": 604, "display_filter": "frame.number == 604", "timestamp_epoch": "1548712130.966146000" }, { "tcp_stream": 38, "frame_number": 612, "display_filter": "frame.number == 612", "timestamp_epoch": "1548712130.973355000" }, { "tcp_stream": 38, "frame_number": 614, "display_filter": "frame.number == 614", "timestamp_epoch": "1548712130.973911000" }, { "tcp_stream": 39, "frame_number": 626, "display_filter": "frame.number == 626", "timestamp_epoch": "1548712130.974660000" }, { "tcp_stream": 42, "frame_number": 648, "display_filter": "frame.number == 648", "timestamp_epoch": "1548712131.336476000" }, { "tcp_stream": 44, "frame_number": 681, "display_filter": "frame.number == 681", "timestamp_epoch": "1548712131.367652000" }, { "tcp_stream": 45, "frame_number": 693, "display_filter": "frame.number == 693", "timestamp_epoch": "1548712131.367689000" }, { "tcp_stream": 47, "frame_number": 726, "display_filter": "frame.number == 726", "timestamp_epoch": "1548712131.874499000" } ], "raw_values": [ "margaret.dunn" ], "identity_id": "identity-597ab227631a495ed4a21534", "ip_addresses": [ "172.17.8.109" ], "mac_addresses": [ "14:fe:b5:d4:15:ca" ] }, { "type": "hostname", "value": "Dunn-Windows-PC", "bindings": [ { "account": "", "owner_ip": "0.0.0.0", "frame_number": 409, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "172.17.8.109" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 1058, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "172.17.8.109" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 1980, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "172.17.8.109" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 1, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.109" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 154, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.109" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 175, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.109" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 231, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.109" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 388, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.109" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 402, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.109" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 403, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.109" }, { "account": "", "owner_ip": "172.17.8.109", "frame_number": 405, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.109" } ], "evidence": [ { "udp_stream": 16, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1548711856.923768000" }, { "udp_stream": 16, "frame_number": 1058, "display_filter": "frame.number == 1058", "timestamp_epoch": "1548712322.737620000" }, { "udp_stream": 16, "frame_number": 1980, "display_filter": "frame.number == 1980", "timestamp_epoch": "1548712551.309633000" }, { "udp_stream": 0, "frame_number": 1, "display_filter": "frame.number == 1", "timestamp_epoch": "1548711854.050143000" }, { "udp_stream": 0, "frame_number": 154, "display_filter": "frame.number == 154", "timestamp_epoch": "1548711854.436008000" }, { "udp_stream": 0, "frame_number": 175, "display_filter": "frame.number == 175", "timestamp_epoch": "1548711854.797794000" }, { "udp_stream": 0, "frame_number": 231, "display_filter": "frame.number == 231", "timestamp_epoch": "1548711855.188456000" }, { "udp_stream": 0, "frame_number": 388, "display_filter": "frame.number == 388", "timestamp_epoch": "1548711855.549789000" }, { "udp_stream": 0, "frame_number": 402, "display_filter": "frame.number == 402", "timestamp_epoch": "1548711855.940495000" }, { "udp_stream": 0, "frame_number": 403, "display_filter": "frame.number == 403", "timestamp_epoch": "1548711856.301324000" }, { "udp_stream": 0, "frame_number": 405, "display_filter": "frame.number == 405", "timestamp_epoch": "1548711856.691859000" } ], "raw_values": [ "DUNN-WINDOWS-PC<00>,DUNN-WINDOWS-PC<00> (Workstation/Redirector)", "DUNN-WINDOWS-PC<20>,DUNN-WINDOWS-PC<20> (Server service)", "Dunn-Windows-PC" ], "identity_id": "identity-675aea59cce673a367d74a49", "ip_addresses": [ "172.17.8.109" ], "mac_addresses": [ "14:fe:b5:d4:15:ca", "14:fe:b5:d4:15:ca,14:fe:b5:d4:15:ca" ] }, { "type": "netbios-group", "value": "TIMBERSHADE", "bindings": [ { "account": "", "owner_ip": null, "frame_number": 2, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.109" }, { "account": "", "owner_ip": null, "frame_number": 176, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.109" }, { "account": "", "owner_ip": null, "frame_number": 387, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.109" }, { "account": "", "owner_ip": null, "frame_number": 404, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.109" } ], "evidence": [ { "udp_stream": 0, "frame_number": 2, "display_filter": "frame.number == 2", "timestamp_epoch": "1548711854.050145000" }, { "udp_stream": 0, "frame_number": 176, "display_filter": "frame.number == 176", "timestamp_epoch": "1548711854.797794000" }, { "udp_stream": 0, "frame_number": 387, "display_filter": "frame.number == 387", "timestamp_epoch": "1548711855.549788000" }, { "udp_stream": 0, "frame_number": 404, "display_filter": "frame.number == 404", "timestamp_epoch": "1548711856.301324000" } ], "raw_values": [ "TIMBERSHADE<00>,TIMBERSHADE<00> (Workstation/Redirector)" ], "identity_id": "identity-313e09dde1e17011975d71b3", "ip_addresses": [], "mac_addresses": [] } ], "actor_leads": [], "observables": [ { "type": "domain", "roles": [ "dns-query" ], "value": "3.10.214.10.in-addr.arpa", "evidence": [ { "udp_stream": 34, "frame_number": 1036, "display_filter": "frame.number == 1036", "timestamp_epoch": "1548712316.253847000" }, { "udp_stream": 34, "frame_number": 1037, "display_filter": "frame.number == 1037", "timestamp_epoch": "1548712316.274960000" } ], "is_private": null, "observable_id": "observable-eedb2934ce13aa10bd14084c", "last_seen_epoch": "1548712316.274960000", "enrichment_state": "not_requested", "first_seen_epoch": "1548712316.253847000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "dns.msftncsi.com", "evidence": [ { "udp_stream": 32, "frame_number": 772, "display_filter": "frame.number == 772", "timestamp_epoch": "1548712132.410638000" }, { "udp_stream": 32, "frame_number": 775, "display_filter": "frame.number == 775", "timestamp_epoch": "1548712132.439772000" }, { "udp_stream": 33, "frame_number": 776, "display_filter": "frame.number == 776", "timestamp_epoch": "1548712132.440858000" }, { "udp_stream": 33, "frame_number": 777, "display_filter": "frame.number == 777", "timestamp_epoch": "1548712132.464588000" } ], "is_private": null, "observable_id": "observable-0dae196ceae27c37fa9f2392", "last_seen_epoch": "1548712132.464588000", "enrichment_state": "not_requested", "first_seen_epoch": "1548712132.410638000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "dunn-windows-pc.timbershade.info", "evidence": [ { "udp_stream": 27, "frame_number": 451, "display_filter": "frame.number == 451", "timestamp_epoch": "1548711861.934670000" }, { "udp_stream": 27, "frame_number": 452, "display_filter": "frame.number == 452", "timestamp_epoch": "1548711861.934873000" } ], "is_private": null, "observable_id": "observable-26f8801c082842d8e87e28e6", "last_seen_epoch": "1548711861.934873000", "enrichment_state": "not_requested", "first_seen_epoch": "1548711861.934670000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "isatap.localdomain", "evidence": [ { "udp_stream": 23, "frame_number": 430, "display_filter": "frame.number == 430", "timestamp_epoch": "1548711857.573963000" }, { "udp_stream": 23, "frame_number": 431, "display_filter": "frame.number == 431", "timestamp_epoch": "1548711857.601268000" } ], "is_private": null, "observable_id": "observable-28e7c689a7e90e25a84cde90", "last_seen_epoch": "1548711857.601268000", "enrichment_state": "not_requested", "first_seen_epoch": "1548711857.573963000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "isatap.timbershade.info", "evidence": [ { "udp_stream": 21, "frame_number": 426, "display_filter": "frame.number == 426", "timestamp_epoch": "1548711857.457724000" }, { "udp_stream": 21, "frame_number": 428, "display_filter": "frame.number == 428", "timestamp_epoch": "1548711857.457941000" } ], "is_private": null, "observable_id": "observable-53fe76eadc13c1c7816a46ee", "last_seen_epoch": "1548711857.457941000", "enrichment_state": "not_requested", "first_seen_epoch": "1548711857.457724000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "timbershade-dc.timbershade.info", "evidence": [ { "udp_stream": 2, "frame_number": 5, "display_filter": "frame.number == 5", "timestamp_epoch": "1548711854.065444000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1548711854.065534000" }, { "udp_stream": 20, "frame_number": 422, "display_filter": "frame.number == 422", "timestamp_epoch": "1548711857.450893000" }, { "udp_stream": 20, "frame_number": 423, "display_filter": "frame.number == 423", "timestamp_epoch": "1548711857.450982000" }, { "udp_stream": 24, "frame_number": 436, "display_filter": "frame.number == 436", "timestamp_epoch": "1548711858.950153000" }, { "udp_stream": 24, "frame_number": 437, "display_filter": "frame.number == 437", "timestamp_epoch": "1548711858.950439000" } ], "is_private": null, "observable_id": "observable-78ae2c42fac101dfe192a894", "last_seen_epoch": "1548711858.950439000", "enrichment_state": "not_requested", "first_seen_epoch": "1548711854.065444000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "timbershade.info", "evidence": [ { "udp_stream": 28, "frame_number": 453, "display_filter": "frame.number == 453", "timestamp_epoch": "1548711861.936065000" }, { "udp_stream": 28, "frame_number": 454, "display_filter": "frame.number == 454", "timestamp_epoch": "1548711861.936735000" }, { "udp_stream": 36, "frame_number": 1040, "display_filter": "frame.number == 1040", "timestamp_epoch": "1548712316.275423000" }, { "udp_stream": 36, "frame_number": 1041, "display_filter": "frame.number == 1041", "timestamp_epoch": "1548712316.275521000" } ], "is_private": null, "observable_id": "observable-8b191ef4cae9c04f8d0218e1", "last_seen_epoch": "1548712316.275521000", "enrichment_state": "not_requested", "first_seen_epoch": "1548711861.936065000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "timbershade.info.timbershade.info", "evidence": [ { "udp_stream": 35, "frame_number": 1038, "display_filter": "frame.number == 1038", "timestamp_epoch": "1548712316.275196000" }, { "udp_stream": 35, "frame_number": 1039, "display_filter": "frame.number == 1039", "timestamp_epoch": "1548712316.275327000" } ], "is_private": null, "observable_id": "observable-f17e325ee983d200bd314b10", "last_seen_epoch": "1548712316.275327000", "enrichment_state": "not_requested", "first_seen_epoch": "1548712316.275196000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "wpad.localdomain", "evidence": [ { "udp_stream": 41, "frame_number": 1057, "display_filter": "frame.number == 1057", "timestamp_epoch": "1548712322.737246000" }, { "udp_stream": 41, "frame_number": 1061, "display_filter": "frame.number == 1061", "timestamp_epoch": "1548712322.770794000" } ], "is_private": null, "observable_id": "observable-22a75da27436f83d4b776786", "last_seen_epoch": "1548712322.770794000", "enrichment_state": "not_requested", "first_seen_epoch": "1548712322.737246000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "wpad.timbershade.info", "evidence": [ { "udp_stream": 18, "frame_number": 411, "display_filter": "frame.number == 411", "timestamp_epoch": "1548711856.926984000" }, { "udp_stream": 18, "frame_number": 412, "display_filter": "frame.number == 412", "timestamp_epoch": "1548711856.927211000" }, { "udp_stream": 40, "frame_number": 1055, "display_filter": "frame.number == 1055", "timestamp_epoch": "1548712322.736303000" }, { "udp_stream": 40, "frame_number": 1056, "display_filter": "frame.number == 1056", "timestamp_epoch": "1548712322.736626000" } ], "is_private": null, "observable_id": "observable-dd255a28b5f680cc86f66817", "last_seen_epoch": "1548712322.736626000", "enrichment_state": "not_requested", "first_seen_epoch": "1548711856.926984000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "www.download.windowsupdate.com", "evidence": [ { "udp_stream": 43, "frame_number": 1074, "display_filter": "frame.number == 1074", "timestamp_epoch": "1548712323.021554000" }, { "udp_stream": 43, "frame_number": 1075, "display_filter": "frame.number == 1075", "timestamp_epoch": "1548712323.075168000" }, { "tcp_stream": 56, "frame_number": 1080, "display_filter": "frame.number == 1080", "timestamp_epoch": "1548712323.104433000" } ], "is_private": null, "observable_id": "observable-9a2cd2bc3b2f76e8408c862c", "last_seen_epoch": "1548712323.104433000", "enrichment_state": "not_requested", "first_seen_epoch": "1548712323.021554000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "www.msftncsi.com", "evidence": [ { "udp_stream": 26, "frame_number": 440, "display_filter": "frame.number == 440", "timestamp_epoch": "1548711859.498695000" }, { "udp_stream": 26, "frame_number": 441, "display_filter": "frame.number == 441", "timestamp_epoch": "1548711859.547107000" }, { "tcp_stream": 27, "frame_number": 445, "display_filter": "frame.number == 445", "timestamp_epoch": "1548711859.724895000" } ], "is_private": null, "observable_id": "observable-6a9ff88c455d811b7d53942f", "last_seen_epoch": "1548711859.724895000", "enrichment_state": "not_requested", "first_seen_epoch": "1548711859.498695000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "131.107.255.255", "evidence": [ { "udp_stream": 32, "frame_number": 775, "display_filter": "frame.number == 775", "timestamp_epoch": "1548712132.439772000" } ], "is_private": false, "observable_id": "observable-b161b0e703ec9dffb7e22f8f", "last_seen_epoch": "1548712132.439772000", "enrichment_state": "not_requested", "first_seen_epoch": "1548712132.439772000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.17.8.109", "evidence": [ { "udp_stream": 28, "frame_number": 453, "display_filter": "frame.number == 453", "timestamp_epoch": "1548711861.936065000" }, { "udp_stream": 28, "frame_number": 454, "display_filter": "frame.number == 454", "timestamp_epoch": "1548711861.936735000" } ], "is_private": true, "observable_id": "observable-95640124e35de206ae1d5cc5", "last_seen_epoch": "1548711861.936735000", "enrichment_state": "not_requested", "first_seen_epoch": "1548711861.936065000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.17.8.2", "evidence": [ { "udp_stream": 1, "frame_number": 4, "display_filter": "frame.number == 4", "timestamp_epoch": "1548711854.062853000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1548711854.065534000" }, { "udp_stream": 5, "frame_number": 118, "display_filter": "frame.number == 118", "timestamp_epoch": "1548711854.297327000" }, { "udp_stream": 7, "frame_number": 180, "display_filter": "frame.number == 180", "timestamp_epoch": "1548711855.058966000" }, { "udp_stream": 9, "frame_number": 228, "display_filter": "frame.number == 228", "timestamp_epoch": "1548711855.172355000" }, { "udp_stream": 11, "frame_number": 241, "display_filter": "frame.number == 241", "timestamp_epoch": "1548711855.271285000" }, { "udp_stream": 20, "frame_number": 423, "display_filter": "frame.number == 423", "timestamp_epoch": "1548711857.450982000" }, { "udp_stream": 24, "frame_number": 437, "display_filter": "frame.number == 437", "timestamp_epoch": "1548711858.950439000" }, { "udp_stream": 27, "frame_number": 452, "display_filter": "frame.number == 452", "timestamp_epoch": "1548711861.934873000" }, { "udp_stream": 36, "frame_number": 1041, "display_filter": "frame.number == 1041", "timestamp_epoch": "1548712316.275521000" }, { "udp_stream": 36, "frame_number": 1041, "display_filter": "frame.number == 1041", "timestamp_epoch": "1548712316.275521000" } ], "is_private": true, "observable_id": "observable-524ab5fc2c98ad0b96511f6f", "last_seen_epoch": "1548712316.275521000", "enrichment_state": "not_requested", "first_seen_epoch": "1548711854.062853000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "172.17.8.255", "evidence": [], "is_private": true, "observable_id": "observable-c9757416eaaf9fc94bfdf596", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "192.241.220.183", "evidence": [], "is_private": false, "observable_id": "observable-e21f0df9c13e13f73281c663", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "204.2.193.162", "evidence": [ { "udp_stream": 43, "frame_number": 1075, "display_filter": "frame.number == 1075", "timestamp_epoch": "1548712323.075168000" } ], "is_private": false, "observable_id": "observable-a7b28339a73d762498f4d5a9", "last_seen_epoch": "1548712323.075168000", "enrichment_state": "not_requested", "first_seen_epoch": "1548712323.075168000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "204.2.193.184", "evidence": [ { "udp_stream": 43, "frame_number": 1075, "display_filter": "frame.number == 1075", "timestamp_epoch": "1548712323.075168000" } ], "is_private": false, "observable_id": "observable-726306ad9812a3ff71922882", "last_seen_epoch": "1548712323.075168000", "enrichment_state": "not_requested", "first_seen_epoch": "1548712323.075168000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "216.239.94.252", "evidence": [], "is_private": false, "observable_id": "observable-d5027687531e22e31fdb7a06", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.22", "evidence": [], "is_private": false, "observable_id": "observable-a7d5f2bdc892e824fee3c32d", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.252", "evidence": [], "is_private": false, "observable_id": "observable-5369287450645e0821788539", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.50.224.56", "evidence": [ { "udp_stream": 26, "frame_number": 441, "display_filter": "frame.number == 441", "timestamp_epoch": "1548711859.547107000" } ], "is_private": false, "observable_id": "observable-5ee40d3267f680403d8407dd", "last_seen_epoch": "1548711859.547107000", "enrichment_state": "not_requested", "first_seen_epoch": "1548711859.547107000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.50.224.8", "evidence": [ { "udp_stream": 26, "frame_number": 441, "display_filter": "frame.number == 441", "timestamp_epoch": "1548711859.547107000" } ], "is_private": false, "observable_id": "observable-fff825e4111b97ccf1d4275e", "last_seen_epoch": "1548711859.547107000", "enrichment_state": "not_requested", "first_seen_epoch": "1548711859.547107000" }, { "type": "ipv4", "roles": [ "http-host", "network-endpoint" ], "value": "239.255.255.250", "evidence": [ { "frame_number": 562, "display_filter": "frame.number == 562", "timestamp_epoch": "1548711974.925375000" }, { "frame_number": 564, "display_filter": "frame.number == 564", "timestamp_epoch": "1548711975.282290000" }, { "frame_number": 573, "display_filter": "frame.number == 573", "timestamp_epoch": "1548711977.937888000" }, { "frame_number": 574, "display_filter": "frame.number == 574", "timestamp_epoch": "1548711978.305406000" }, { "frame_number": 575, "display_filter": "frame.number == 575", "timestamp_epoch": "1548711980.961861000" }, { "frame_number": 576, "display_filter": "frame.number == 576", "timestamp_epoch": "1548711981.315491000" } ], "is_private": false, "observable_id": "observable-7dde8d94b87606db049154f1", "last_seen_epoch": "1548711981.315491000", "enrichment_state": "not_requested", "first_seen_epoch": "1548711974.925375000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "255.255.255.255", "evidence": [], "is_private": true, "observable_id": "observable-be476d8d98001c035449d109", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "http-host", "network-endpoint" ], "value": "91.121.30.169", "evidence": [ { "tcp_stream": 50, "frame_number": 802, "display_filter": "frame.number == 802", "timestamp_epoch": "1548712157.801380000" } ], "is_private": false, "observable_id": "observable-8216a9f2219dc041c4980a99", "last_seen_epoch": "1548712157.801380000", "enrichment_state": "not_requested", "first_seen_epoch": "1548712157.801380000" }, { "type": "ipv6", "roles": [ "dns-answer" ], "value": "fd3e:4f5a:5b81::1", "evidence": [ { "udp_stream": 33, "frame_number": 777, "display_filter": "frame.number == 777", "timestamp_epoch": "1548712132.464588000" } ], "is_private": true, "observable_id": "observable-add3ad33c3e2a5556779a2cd", "last_seen_epoch": "1548712132.464588000", "enrichment_state": "not_requested", "first_seen_epoch": "1548712132.464588000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "74927e242d6c3febf8cb9cab10a7f889", "evidence": [ { "tcp_stream": 55, "frame_number": 1065, "display_filter": "frame.number == 1065", "timestamp_epoch": "1548712322.833020000" }, { "tcp_stream": 57, "frame_number": 1108, "display_filter": "frame.number == 1108", "timestamp_epoch": "1548712324.832679000" }, { "tcp_stream": 58, "frame_number": 1899, "display_filter": "frame.number == 1899", "timestamp_epoch": "1548712328.178366000" }, { "tcp_stream": 59, "frame_number": 1916, "display_filter": "frame.number == 1916", "timestamp_epoch": "1548712333.632459000" }, { "tcp_stream": 63, "frame_number": 1985, "display_filter": "frame.number == 1985", "timestamp_epoch": "1548712551.420293000" }, { "tcp_stream": 69, "frame_number": 3261, "display_filter": "frame.number == 3261", "timestamp_epoch": "1548712577.784487000" }, { "tcp_stream": 71, "frame_number": 3642, "display_filter": "frame.number == 3642", "timestamp_epoch": "1548712585.768471000" }, { "tcp_stream": 73, "frame_number": 3673, "display_filter": "frame.number == 3673", "timestamp_epoch": "1548712597.583605000" } ], "is_private": null, "observable_id": "observable-6669d0a6b8afda4cb1e79dc1", "last_seen_epoch": "1548712597.583605000", "enrichment_state": "not_requested", "first_seen_epoch": "1548712322.833020000" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "evidence": [], "is_private": null, "observable_id": "observable-5450f6035f17a1f4d69e1433", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "9f6e3e65aedca997c6445329663bd1d279392a34cfda7d1b56461eb41641fa08", "evidence": [], "is_private": null, "observable_id": "observable-f330cdd19e50e5e0296cfe73", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "url", "roles": [ "http-request" ], "value": "http://239.255.255.250:1900*", "evidence": [ { "frame_number": 562, "display_filter": "frame.number == 562", "timestamp_epoch": "1548711974.925375000" }, { "frame_number": 564, "display_filter": "frame.number == 564", "timestamp_epoch": "1548711975.282290000" }, { "frame_number": 573, "display_filter": "frame.number == 573", "timestamp_epoch": "1548711977.937888000" }, { "frame_number": 574, "display_filter": "frame.number == 574", "timestamp_epoch": "1548711978.305406000" }, { "frame_number": 575, "display_filter": "frame.number == 575", "timestamp_epoch": "1548711980.961861000" }, { "frame_number": 576, "display_filter": "frame.number == 576", "timestamp_epoch": "1548711981.315491000" } ], "is_private": null, "observable_id": "observable-0cff078f3525c30034ebc401", "last_seen_epoch": "1548711981.315491000", "enrichment_state": "not_requested", "first_seen_epoch": "1548711974.925375000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://91.121.30.169:8000/91msE95B/actiV.bin", "evidence": [ { "tcp_stream": 50, "frame_number": 802, "display_filter": "frame.number == 802", "timestamp_epoch": "1548712157.801380000" } ], "is_private": null, "observable_id": "observable-dc631e8476bc74620f3ceaac", "last_seen_epoch": "1548712157.801380000", "enrichment_state": "not_requested", "first_seen_epoch": "1548712157.801380000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab", "evidence": [ { "tcp_stream": 56, "frame_number": 1080, "display_filter": "frame.number == 1080", "timestamp_epoch": "1548712323.104433000" } ], "is_private": null, "observable_id": "observable-c16657ee4169696fc87c511c", "last_seen_epoch": "1548712323.104433000", "enrichment_state": "not_requested", "first_seen_epoch": "1548712323.104433000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.msftncsi.com/ncsi.txt", "evidence": [ { "tcp_stream": 27, "frame_number": 445, "display_filter": "frame.number == 445", "timestamp_epoch": "1548711859.724895000" } ], "is_private": null, "observable_id": "observable-3bc035ba50e9e34071d50ad7", "last_seen_epoch": "1548711859.724895000", "enrichment_state": "not_requested", "first_seen_epoch": "1548711859.724895000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Microsoft NCSI", "evidence": [ { "tcp_stream": 27, "frame_number": 445, "display_filter": "frame.number == 445", "timestamp_epoch": "1548711859.724895000" } ], "is_private": null, "observable_id": "observable-968a8d0d1dbf5343a493cf49", "last_seen_epoch": "1548711859.724895000", "enrichment_state": "not_requested", "first_seen_epoch": "1548711859.724895000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Microsoft-CryptoAPI/6.1", "evidence": [ { "tcp_stream": 56, "frame_number": 1080, "display_filter": "frame.number == 1080", "timestamp_epoch": "1548712323.104433000" } ], "is_private": null, "observable_id": "observable-c5628e8cead47a6623c3d640", "last_seen_epoch": "1548712323.104433000", "enrichment_state": "not_requested", "first_seen_epoch": "1548712323.104433000" } ], "schema_version": "pcap-analysis-v1", "semantic_sha256": "ab7a82d96e9823701e95f900ce1b3e1865a929208fd4c7742f02dbedcc5a2b69", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "attack_candidates": [], "analysis_key_material": { "source_sha256": "2fc08b2bcdd1be009dab7cea877464e6ce9f93c65bc3e45b1583266e164408db", "rulepack_version": "pcap-rules-v5", "analyzer_manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0" } }, "context": { "mode": "local-only", "matches": [], "coverage": { "truncated": false, "no_exact_match": 37, "observable_limit": 5000, "observables_total": 37, "matched_observables": 0, "observables_checked": 37, "prior_cases_checked": 50, "prior_case_limit_reached": true }, "created_at": "2026-09-22T16:08:49.520398+00:00", "session_id": "8ebc3993-dc06-42b5-b19b-dfde2feb75a3", "techniques": [], "interpretation": "No match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.", "schema_version": "pcap-context-v1", "snapshot_sha256": "f5e8f9f7b35c4de65ced40a8c75691fb8f84ac7827a01e79f2fd3fa14e44dfde", "source_actor_links": [], "external_enrichment": { "reason": "Requires explicit provider consent and privacy review", "status": "not-requested", "requests": 0 }, "source_semantic_sha256": "ab7a82d96e9823701e95f900ce1b3e1865a929208fd4c7742f02dbedcc5a2b69", "cross_case_correlations": [ { "shared_count": 9, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 9, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 9, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 8, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 9, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 10, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 7, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 3, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 3, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." } ] }, "assessment": { "policy_version": "pcap-assessment-v3", "source_semantic_sha256": "ab7a82d96e9823701e95f900ce1b3e1865a929208fd4c7742f02dbedcc5a2b69", "items": [ { "observable_id": "observable-eedb2934ce13aa10bd14084c", "type": "domain", "value": "3.10.214.10.in-addr.arpa", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 34, "frame_number": 1036, "display_filter": "frame.number == 1036", "timestamp_epoch": "1548712316.253847000" }, { "udp_stream": 34, "frame_number": 1037, "display_filter": "frame.number == 1037", "timestamp_epoch": "1548712316.274960000" } ], "roles": [ "dns-query" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0dae196ceae27c37fa9f2392", "type": "domain", "value": "dns.msftncsi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 772, "display_filter": "frame.number == 772", "timestamp_epoch": "1548712132.410638000" }, { "udp_stream": 32, "frame_number": 775, "display_filter": "frame.number == 775", "timestamp_epoch": "1548712132.439772000" }, { "udp_stream": 33, "frame_number": 776, "display_filter": "frame.number == 776", "timestamp_epoch": "1548712132.440858000" }, { "udp_stream": 33, "frame_number": 777, "display_filter": "frame.number == 777", "timestamp_epoch": "1548712132.464588000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-26f8801c082842d8e87e28e6", "type": "domain", "value": "dunn-windows-pc.timbershade.info", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:26.554603+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:26.387170+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:26.385155+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 27, "frame_number": 451, "display_filter": "frame.number == 451", "timestamp_epoch": "1548711861.934670000" }, { "udp_stream": 27, "frame_number": 452, "display_filter": "frame.number == 452", "timestamp_epoch": "1548711861.934873000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:26.382925+00:00" }, { "observable_id": "observable-28e7c689a7e90e25a84cde90", "type": "domain", "value": "isatap.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 23, "frame_number": 430, "display_filter": "frame.number == 430", "timestamp_epoch": "1548711857.573963000" }, { "udp_stream": 23, "frame_number": 431, "display_filter": "frame.number == 431", "timestamp_epoch": "1548711857.601268000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-53fe76eadc13c1c7816a46ee", "type": "domain", "value": "isatap.timbershade.info", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 21, "frame_number": 426, "display_filter": "frame.number == 426", "timestamp_epoch": "1548711857.457724000" }, { "udp_stream": 21, "frame_number": 428, "display_filter": "frame.number == 428", "timestamp_epoch": "1548711857.457941000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-78ae2c42fac101dfe192a894", "type": "domain", "value": "timbershade-dc.timbershade.info", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:26.725999+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:26.563261+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:26.559089+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 2, "frame_number": 5, "display_filter": "frame.number == 5", "timestamp_epoch": "1548711854.065444000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1548711854.065534000" }, { "udp_stream": 20, "frame_number": 422, "display_filter": "frame.number == 422", "timestamp_epoch": "1548711857.450893000" }, { "udp_stream": 20, "frame_number": 423, "display_filter": "frame.number == 423", "timestamp_epoch": "1548711857.450982000" }, { "udp_stream": 24, "frame_number": 436, "display_filter": "frame.number == 436", "timestamp_epoch": "1548711858.950153000" }, { "udp_stream": 24, "frame_number": 437, "display_filter": "frame.number == 437", "timestamp_epoch": "1548711858.950439000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:26.554663+00:00" }, { "observable_id": "observable-8b191ef4cae9c04f8d0218e1", "type": "domain", "value": "timbershade.info", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:26.906559+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:26.735451+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:26.731281+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 28, "frame_number": 453, "display_filter": "frame.number == 453", "timestamp_epoch": "1548711861.936065000" }, { "udp_stream": 28, "frame_number": 454, "display_filter": "frame.number == 454", "timestamp_epoch": "1548711861.936735000" }, { "udp_stream": 36, "frame_number": 1040, "display_filter": "frame.number == 1040", "timestamp_epoch": "1548712316.275423000" }, { "udp_stream": 36, "frame_number": 1041, "display_filter": "frame.number == 1041", "timestamp_epoch": "1548712316.275521000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:26.726063+00:00" }, { "observable_id": "observable-f17e325ee983d200bd314b10", "type": "domain", "value": "timbershade.info.timbershade.info", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 35, "frame_number": 1038, "display_filter": "frame.number == 1038", "timestamp_epoch": "1548712316.275196000" }, { "udp_stream": 35, "frame_number": 1039, "display_filter": "frame.number == 1039", "timestamp_epoch": "1548712316.275327000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-22a75da27436f83d4b776786", "type": "domain", "value": "wpad.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 41, "frame_number": 1057, "display_filter": "frame.number == 1057", "timestamp_epoch": "1548712322.737246000" }, { "udp_stream": 41, "frame_number": 1061, "display_filter": "frame.number == 1061", "timestamp_epoch": "1548712322.770794000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dd255a28b5f680cc86f66817", "type": "domain", "value": "wpad.timbershade.info", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 18, "frame_number": 411, "display_filter": "frame.number == 411", "timestamp_epoch": "1548711856.926984000" }, { "udp_stream": 18, "frame_number": 412, "display_filter": "frame.number == 412", "timestamp_epoch": "1548711856.927211000" }, { "udp_stream": 40, "frame_number": 1055, "display_filter": "frame.number == 1055", "timestamp_epoch": "1548712322.736303000" }, { "udp_stream": 40, "frame_number": 1056, "display_filter": "frame.number == 1056", "timestamp_epoch": "1548712322.736626000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9a2cd2bc3b2f76e8408c862c", "type": "domain", "value": "www.download.windowsupdate.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:26.376183+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:46:30.124643+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:26.372587+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 43, "frame_number": 1074, "display_filter": "frame.number == 1074", "timestamp_epoch": "1548712323.021554000" }, { "udp_stream": 43, "frame_number": 1075, "display_filter": "frame.number == 1075", "timestamp_epoch": "1548712323.075168000" }, { "tcp_stream": 56, "frame_number": 1080, "display_filter": "frame.number == 1080", "timestamp_epoch": "1548712323.104433000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:26.370705+00:00" }, { "observable_id": "observable-6a9ff88c455d811b7d53942f", "type": "domain", "value": "www.msftncsi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:26.382893+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:46:30.477224+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:26.378066+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 440, "display_filter": "frame.number == 440", "timestamp_epoch": "1548711859.498695000" }, { "udp_stream": 26, "frame_number": 441, "display_filter": "frame.number == 441", "timestamp_epoch": "1548711859.547107000" }, { "tcp_stream": 27, "frame_number": 445, "display_filter": "frame.number == 445", "timestamp_epoch": "1548711859.724895000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:26.376208+00:00" }, { "observable_id": "observable-b161b0e703ec9dffb7e22f8f", "type": "ipv4", "value": "131.107.255.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 775, "display_filter": "frame.number == 775", "timestamp_epoch": "1548712132.439772000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-95640124e35de206ae1d5cc5", "type": "ipv4", "value": "172.17.8.109", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 28, "frame_number": 453, "display_filter": "frame.number == 453", "timestamp_epoch": "1548711861.936065000" }, { "udp_stream": 28, "frame_number": 454, "display_filter": "frame.number == 454", "timestamp_epoch": "1548711861.936735000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-524ab5fc2c98ad0b96511f6f", "type": "ipv4", "value": "172.17.8.2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 1, "frame_number": 4, "display_filter": "frame.number == 4", "timestamp_epoch": "1548711854.062853000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1548711854.065534000" }, { "udp_stream": 5, "frame_number": 118, "display_filter": "frame.number == 118", "timestamp_epoch": "1548711854.297327000" }, { "udp_stream": 7, "frame_number": 180, "display_filter": "frame.number == 180", "timestamp_epoch": "1548711855.058966000" }, { "udp_stream": 9, "frame_number": 228, "display_filter": "frame.number == 228", "timestamp_epoch": "1548711855.172355000" }, { "udp_stream": 11, "frame_number": 241, "display_filter": "frame.number == 241", "timestamp_epoch": "1548711855.271285000" }, { "udp_stream": 20, "frame_number": 423, "display_filter": "frame.number == 423", "timestamp_epoch": "1548711857.450982000" }, { "udp_stream": 24, "frame_number": 437, "display_filter": "frame.number == 437", "timestamp_epoch": "1548711858.950439000" }, { "udp_stream": 27, "frame_number": 452, "display_filter": "frame.number == 452", "timestamp_epoch": "1548711861.934873000" }, { "udp_stream": 36, "frame_number": 1041, "display_filter": "frame.number == 1041", "timestamp_epoch": "1548712316.275521000" }, { "udp_stream": 36, "frame_number": 1041, "display_filter": "frame.number == 1041", "timestamp_epoch": "1548712316.275521000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c9757416eaaf9fc94bfdf596", "type": "ipv4", "value": "172.17.8.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e21f0df9c13e13f73281c663", "type": "ipv4", "value": "192.241.220.183", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:27.099676+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:26.915432+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:26.910630+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:26.906626+00:00" }, { "observable_id": "observable-a7b28339a73d762498f4d5a9", "type": "ipv4", "value": "204.2.193.162", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 43, "frame_number": 1075, "display_filter": "frame.number == 1075", "timestamp_epoch": "1548712323.075168000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-726306ad9812a3ff71922882", "type": "ipv4", "value": "204.2.193.184", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:27.292809+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:27.108651+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:27.104218+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 43, "frame_number": 1075, "display_filter": "frame.number == 1075", "timestamp_epoch": "1548712323.075168000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:27.099746+00:00" }, { "observable_id": "observable-d5027687531e22e31fdb7a06", "type": "ipv4", "value": "216.239.94.252", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:27.496086+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:27.301276+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:27.297269+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:27.292885+00:00" }, { "observable_id": "observable-a7d5f2bdc892e824fee3c32d", "type": "ipv4", "value": "224.0.0.22", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5369287450645e0821788539", "type": "ipv4", "value": "224.0.0.252", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5ee40d3267f680403d8407dd", "type": "ipv4", "value": "23.50.224.56", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 441, "display_filter": "frame.number == 441", "timestamp_epoch": "1548711859.547107000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fff825e4111b97ccf1d4275e", "type": "ipv4", "value": "23.50.224.8", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:27.591125+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:27.586875+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 441, "display_filter": "frame.number == 441", "timestamp_epoch": "1548711859.547107000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:27.581819+00:00" }, { "observable_id": "observable-7dde8d94b87606db049154f1", "type": "ipv4", "value": "239.255.255.250", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "frame_number": 562, "display_filter": "frame.number == 562", "timestamp_epoch": "1548711974.925375000" }, { "frame_number": 564, "display_filter": "frame.number == 564", "timestamp_epoch": "1548711975.282290000" }, { "frame_number": 573, "display_filter": "frame.number == 573", "timestamp_epoch": "1548711977.937888000" }, { "frame_number": 574, "display_filter": "frame.number == 574", "timestamp_epoch": "1548711978.305406000" }, { "frame_number": 575, "display_filter": "frame.number == 575", "timestamp_epoch": "1548711980.961861000" }, { "frame_number": 576, "display_filter": "frame.number == 576", "timestamp_epoch": "1548711981.315491000" } ], "roles": [ "http-host", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-be476d8d98001c035449d109", "type": "ipv4", "value": "255.255.255.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8216a9f2219dc041c4980a99", "type": "ipv4", "value": "91.121.30.169", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:26.370667+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:26.187194+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:26.183198+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 50, "frame_number": 802, "display_filter": "frame.number == 802", "timestamp_epoch": "1548712157.801380000" } ], "roles": [ "http-host", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:26.177972+00:00" }, { "observable_id": "observable-add3ad33c3e2a5556779a2cd", "type": "ipv6", "value": "fd3e:4f5a:5b81::1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 33, "frame_number": 777, "display_filter": "frame.number == 777", "timestamp_epoch": "1548712132.464588000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5450f6035f17a1f4d69e1433", "type": "sha256", "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f330cdd19e50e5e0296cfe73", "type": "sha256", "value": "9f6e3e65aedca997c6445329663bd1d279392a34cfda7d1b56461eb41641fa08", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:25.841997+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:25.648865+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:25.646981+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:25.644073+00:00" }, { "observable_id": "observable-0cff078f3525c30034ebc401", "type": "url", "value": "http://239.255.255.250:1900*", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "frame_number": 562, "display_filter": "frame.number == 562", "timestamp_epoch": "1548711974.925375000" }, { "frame_number": 564, "display_filter": "frame.number == 564", "timestamp_epoch": "1548711975.282290000" }, { "frame_number": 573, "display_filter": "frame.number == 573", "timestamp_epoch": "1548711977.937888000" }, { "frame_number": 574, "display_filter": "frame.number == 574", "timestamp_epoch": "1548711978.305406000" }, { "frame_number": 575, "display_filter": "frame.number == 575", "timestamp_epoch": "1548711980.961861000" }, { "frame_number": 576, "display_filter": "frame.number == 576", "timestamp_epoch": "1548711981.315491000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dc631e8476bc74620f3ceaac", "type": "url", "value": "http://91.121.30.169:8000/91msE95B/actiV.bin", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 50, "frame_number": 802, "display_filter": "frame.number == 802", "timestamp_epoch": "1548712157.801380000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c16657ee4169696fc87c511c", "type": "url", "value": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 56, "frame_number": 1080, "display_filter": "frame.number == 1080", "timestamp_epoch": "1548712323.104433000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3bc035ba50e9e34071d50ad7", "type": "url", "value": "http://www.msftncsi.com/ncsi.txt", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 27, "frame_number": 445, "display_filter": "frame.number == 445", "timestamp_epoch": "1548711859.724895000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null } ], "counts": { "observed": 34 }, "ioc_candidate_count": 0, "summary": "34 typed observations; 0 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.", "limitations": [ "No detections, no record, missing credentials and provider errors do not mean benign.", "Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.", "A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.", "Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure." ], "enrichment_plan": { "policy": "evidence-priority-v2", "items": [ { "observable_id": "observable-5450f6035f17a1f4d69e1433", "type": "sha256", "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0dae196ceae27c37fa9f2392", "type": "domain", "value": "dns.msftncsi.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-28e7c689a7e90e25a84cde90", "type": "domain", "value": "isatap.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-53fe76eadc13c1c7816a46ee", "type": "domain", "value": "isatap.timbershade.info", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f17e325ee983d200bd314b10", "type": "domain", "value": "timbershade.info.timbershade.info", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-22a75da27436f83d4b776786", "type": "domain", "value": "wpad.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dd255a28b5f680cc86f66817", "type": "domain", "value": "wpad.timbershade.info", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b161b0e703ec9dffb7e22f8f", "type": "ipv4", "value": "131.107.255.255", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a7b28339a73d762498f4d5a9", "type": "ipv4", "value": "204.2.193.162", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5ee40d3267f680403d8407dd", "type": "ipv4", "value": "23.50.224.56", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f330cdd19e50e5e0296cfe73", "type": "sha256", "value": "9f6e3e65aedca997c6445329663bd1d279392a34cfda7d1b56461eb41641fa08", "priority": 95, "reasons": [ "recovered-pe-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8216a9f2219dc041c4980a99", "type": "ipv4", "value": "91.121.30.169", "priority": 80, "reasons": [ "http_request-peer", "served-inspectable-file-not-transitive-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9a2cd2bc3b2f76e8408c862c", "type": "domain", "value": "www.download.windowsupdate.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6a9ff88c455d811b7d53942f", "type": "domain", "value": "www.msftncsi.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-26f8801c082842d8e87e28e6", "type": "domain", "value": "dunn-windows-pc.timbershade.info", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-78ae2c42fac101dfe192a894", "type": "domain", "value": "timbershade-dc.timbershade.info", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8b191ef4cae9c04f8d0218e1", "type": "domain", "value": "timbershade.info", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e21f0df9c13e13f73281c663", "type": "ipv4", "value": "192.241.220.183", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-726306ad9812a3ff71922882", "type": "ipv4", "value": "204.2.193.184", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d5027687531e22e31fdb7a06", "type": "ipv4", "value": "216.239.94.252", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fff825e4111b97ccf1d4275e", "type": "ipv4", "value": "23.50.224.8", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false } ], "eligible_count": 21, "next_batch": [ "observable-5450f6035f17a1f4d69e1433", "observable-0dae196ceae27c37fa9f2392", "observable-28e7c689a7e90e25a84cde90", "observable-53fe76eadc13c1c7816a46ee", "observable-f17e325ee983d200bd314b10", "observable-22a75da27436f83d4b776786", "observable-dd255a28b5f680cc86f66817", "observable-b161b0e703ec9dffb7e22f8f", "observable-a7b28339a73d762498f4d5a9", "observable-5ee40d3267f680403d8407dd" ], "scope": "Query recommendations, not IOC verdicts. Partial provider coverage stays pending; cooldowns/credential failures are not completed checks. Checked means completed attempted direct providers, not all available providers. Review before external disclosure." }, "assessment_sha256": "11e7180a9adf28038c2964e66a13d721736fb68d55b96aeaff6601db461a24c7" }, "enrichment": { "items": [ { "type": "ipv4", "value": "23.50.224.8", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:27.591125+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:27.586875+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:27.581819+00:00", "observable_id": "observable-fff825e4111b97ccf1d4275e" }, { "type": "ipv4", "value": "216.239.94.252", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:27.496086+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:27.301276+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:27.297269+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:27.292885+00:00", "observable_id": "observable-d5027687531e22e31fdb7a06" }, { "type": "ipv4", "value": "204.2.193.184", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:27.292809+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:27.108651+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:27.104218+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:27.099746+00:00", "observable_id": "observable-726306ad9812a3ff71922882" }, { "type": "ipv4", "value": "192.241.220.183", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:27.099676+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:26.915432+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:26.910630+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:26.906626+00:00", "observable_id": "observable-e21f0df9c13e13f73281c663" }, { "type": "domain", "value": "timbershade.info", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:26.906559+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:26.735451+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:26.731281+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:26.726063+00:00", "observable_id": "observable-8b191ef4cae9c04f8d0218e1" }, { "type": "domain", "value": "timbershade-dc.timbershade.info", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:26.725999+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:26.563261+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:26.559089+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:26.554663+00:00", "observable_id": "observable-78ae2c42fac101dfe192a894" }, { "type": "domain", "value": "dunn-windows-pc.timbershade.info", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:26.554603+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:26.387170+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:26.385155+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:26.382925+00:00", "observable_id": "observable-26f8801c082842d8e87e28e6" }, { "type": "domain", "value": "www.msftncsi.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:26.382893+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:46:30.477224+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:26.378066+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:26.376208+00:00", "observable_id": "observable-6a9ff88c455d811b7d53942f" }, { "type": "domain", "value": "www.download.windowsupdate.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:26.376183+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:46:30.124643+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:26.372587+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:26.370705+00:00", "observable_id": "observable-9a2cd2bc3b2f76e8408c862c" }, { "type": "ipv4", "value": "91.121.30.169", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:26.370667+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:26.187194+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:26.183198+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:26.177972+00:00", "observable_id": "observable-8216a9f2219dc041c4980a99" }, { "type": "sha256", "value": "9f6e3e65aedca997c6445329663bd1d279392a34cfda7d1b56461eb41641fa08", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:25.841997+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:25.648865+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:25.646981+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:25.644073+00:00", "observable_id": "observable-f330cdd19e50e5e0296cfe73" } ], "coverage": { "cache_hits": 0, "active_scans": 0, "batch_results": [ { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-fff825e4111b97ccf1d4275e" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-fff825e4111b97ccf1d4275e" } ], "batch_targets": 1, "payload_uploads": 0, "targets_omitted": 0, "retained_targets": 11, "full_urls_disclosed": 0, "provider_lookups_started": 1 }, "updated_at": "2026-09-22T17:47:27.775449+00:00", "schema_version": "pcap-reputation-v1", "snapshot_sha256": "10df7878459e5f677df532f14d5db840559509e5c5b293b279433a9171e677c0", "source_semantic_sha256": "ab7a82d96e9823701e95f900ce1b3e1865a929208fd4c7742f02dbedcc5a2b69", "previous_snapshot_sha256": "90999697aa387ab871ddcb68485708ad5bbb6379d3d3a3a0d1e78881893dc7cb" }, "artifact_download_available": true, "source_tlp": "TLP:CLEAR", "techniques": [], "apt_matches": [], "public_note": "Public derivative: full packet extraction retained; provider evidence bounded; other-session details omitted. Original snapshot hashes do not hash this serialized derivative." }