{ "analysis_id": "bd9602ed-341a-4123-aae3-9fafa5731518", "session_id": "34e6e987-f88c-42f0-87de-920ae403aace", "status": "completed", "filename": "2019-03-19-traffic-analysis-exercise.pcap", "source_sha256": "257ba51a573232f7c2a8b43b55e127e793abe0bf067bd55f40dbee398fde6520", "source_size_bytes": 7774934, "schema_version": "pcap-analysis-v1", "semantic_sha256": "9a1a4d3498dd5afb35f8698f4b731d20e3366895114aea266e43304aad3d1bba", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "summary": "Decoded 13186 packets across 18 IP endpoints and 226 transport flows. Observed 82 DNS events, 10 HTTP requests, 26 TLS ClientHello events, and 4 recovered file/message object(s). Deterministic rules produced 7 finding(s): 0 high, 3 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2019-03-19-traffic-analysis-exercise.pcap\nCapture SHA-256: `257ba51a573232f7c2a8b43b55e127e793abe0bf067bd55f40dbee398fde6520`\nSemantic result SHA-256: `9a1a4d3498dd5afb35f8698f4b731d20e3366895114aea266e43304aad3d1bba`\nAnalyzer manifest SHA-256: `1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0`\n\n## Executive summary\n\nDecoded 13186 packets across 18 IP endpoints and 226 transport flows. Observed 82 DNS events, 10 HTTP requests, 26 TLS ClientHello events, and 4 recovered file/message object(s). Deterministic rules produced 7 finding(s): 0 high, 3 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 13186\n- Duration: 12421.620792 seconds\n- Captured bytes: 7563934\n- Endpoints: 18\n- Flows: 226\n\n## Deterministic findings\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 754 / TCP stream 48, frame 1523 / TCP stream 48.\n\nMetrics: `{\"content_type\":\"application/octet-stream\",\"declared_body_bytes\":811520,\"destination\":\"10.0.90.215\",\"response_count\":1,\"source\":\"209.141.34.8\",\"uri\":\"/test1.exe\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 1553 / TCP stream 50, frame 1713 / TCP stream 50.\n\nMetrics: `{\"content_type\":\"application/octet-stream\",\"declared_body_bytes\":176128,\"destination\":\"10.0.90.215\",\"response_count\":1,\"source\":\"217.23.14.81\",\"uri\":\"/f4.exe\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 245 / TCP stream 17, frame 247 / TCP stream 17, frame 249 / TCP stream 17, frame 251 / TCP stream 17, frame 579 / TCP stream 38.\n\nMetrics: `{\"destination\":\"10.0.90.9\",\"event_count\":28,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.0.90.215\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 44 / TCP stream 3, frame 99 / TCP stream 3, frame 114 / TCP stream 3, frame 120 / TCP stream 3, frame 150 / TCP stream 3.\n\nMetrics: `{\"destination\":\"10.0.90.9\",\"event_count\":75,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.0.90.215\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 246 / TCP stream 17, frame 248 / TCP stream 17, frame 250 / TCP stream 17, frame 252 / TCP stream 17, frame 580 / TCP stream 38.\n\nMetrics: `{\"destination\":\"10.0.90.215\",\"event_count\":28,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.0.90.9\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 46 / TCP stream 3, frame 107 / TCP stream 3, frame 115 / TCP stream 3, frame 123 / TCP stream 3, frame 152 / TCP stream 3.\n\nMetrics: `{\"destination\":\"10.0.90.215\",\"event_count\":59,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.0.90.9\"}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v5`; confidence: 0.7; evidence: frame 1537 / TCP stream 49.\n\nMetrics: `{\"destination\":\"103.1.184.108\",\"destination_port\":2404,\"duration_seconds\":12132.598,\"packets\":3886,\"source\":\"10.0.90.215\",\"wire_bytes\":536481}`\n\n## ATT&CK candidates\n\n- T1105 Ingress Tool Transfer (command-and-control), confidence=0.8, status=suggested; basis=versioned-deterministic-rule.\n\n## Identities\n\n- account: `bobby-tiger-pc$`; client IPs: 10.0.90.215; frames: 51, 59, 67, 69, 79\n- account: `bobby.tiger`; client IPs: 10.0.90.215; frames: 524, 532, 534, 546, 568\n- hostname: `Bobby-Tiger-PC`; client IPs: 10.0.90.215; frames: 384, 749, 1547, 1978, 2058\n- netbios-group: `LITTLETIGERS`; client IPs: unbound subject; frames: 2, 220, 370, 378\n\n## Observed network and file inventory — not an IOC verdict\n\n- domain: `9.90.0.10.in-addr.arpa`; roles: dns-query\n- domain: `bobby-tiger-pc.littletigers.info`; roles: dns-query\n- domain: `crl.microsoft.com`; roles: dns-query, http-host\n- domain: `dns.msftncsi.com`; roles: dns-query\n- domain: `isatap.littletigers.info`; roles: dns-query\n- domain: `isatap.localdomain`; roles: dns-query\n- domain: `littletigers-dc.littletigers.info`; roles: dns-query\n- domain: `littletigers.info`; roles: dns-query\n- domain: `littletigers.info.littletigers.info`; roles: dns-query\n- domain: `toptoptop1.online`; roles: dns-query\n- domain: `wpad.littletigers.info`; roles: dns-query\n- domain: `wpad.localdomain`; roles: dns-query\n- domain: `www.msftncsi.com`; roles: dns-query, http-host\n- ipv4: `10.0.90.215`; roles: dns-answer, network-endpoint\n- ipv4: `10.0.90.255`; roles: network-endpoint\n- ipv4: `10.0.90.9`; roles: dns-answer, network-endpoint\n- ipv4: `103.1.184.108`; roles: dns-answer, network-endpoint\n- ipv4: `109.230.231.176`; roles: network-endpoint\n- ipv4: `115.112.43.81`; roles: network-endpoint\n- ipv4: `131.107.255.255`; roles: dns-answer\n- ipv4: `173.205.6.155`; roles: dns-answer\n- ipv4: `173.205.6.202`; roles: dns-answer, network-endpoint\n- ipv4: `189.189.64.242`; roles: network-endpoint\n- ipv4: `203.45.1.75`; roles: network-endpoint\n- ipv4: `209.121.139.185`; roles: dns-answer, network-endpoint\n- ipv4: `209.121.139.187`; roles: dns-answer\n- ipv4: `209.141.34.8`; roles: http-host, network-endpoint\n- ipv4: `217.23.14.81`; roles: http-host, network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `239.255.255.250`; roles: http-host, network-endpoint\n- ipv4: `255.255.255.255`; roles: network-endpoint\n- ipv4: `31.22.4.176`; roles: network-endpoint\n- ipv4: `46.105.131.77`; roles: network-endpoint\n- ja3: `6734f37431670b3ab4292b8f60f29984`; roles: tls-client-fingerprint\n- ja3: `74927e242d6c3febf8cb9cab10a7f889`; roles: tls-client-fingerprint\n- sha256: `2a9b0ed40f1f0bc0c13ff35d304689e9cadd633781cbcad1c2d2b92ced3f1c85`; roles: exported-object\n- sha256: `3ceb4a8069b2b9e5fdf508ef67d5af5b9d3e6a7b417919953a89fa9773e16440`; roles: exported-object\n- sha256: `5865e801e6324166d6d05b39a14f2a8a798c6eb652831f78c2634f2b7a400eaf`; roles: exported-object\n- sha256: `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; roles: exported-object\n- url: `http://209.141.34.8/test1.exe`; roles: http-request\n- url: `http://217.23.14.81/f4.exe`; roles: http-request\n- url: `http://239.255.255.250:1900*`; roles: http-request\n- url: `http://crl.microsoft.com/pki/crl/products/CSPCA.crl`; roles: http-request\n- url: `http://www.msftncsi.com/ncsi.txt`; roles: http-request\n- user_agent: `Microsoft NCSI`; roles: http-client\n- user_agent: `Microsoft-CryptoAPI/6.1`; roles: http-client\n- user_agent: `Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)`; roles: http-client\n- exported object `test1.exe`; SHA-256 `2a9b0ed40f1f0bc0c13ff35d304689e9cadd633781cbcad1c2d2b92ced3f1c85`; size 811520 bytes\n SHA-1: `e1068da52875b055ec58d2c2b8110932e863f981`; MD5: `f0882b09aebf9b37f740d9a42e3fa4bb`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.90.215\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":754,\"response_frame\":1523,\"server_ip\":\"209.141.34.8\",\"status_code\":\"200\",\"tcp_stream\":48,\"url\":\"http://209.141.34.8/test1.exe\"}]`.\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":\"executable\"}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `f4.exe`; SHA-256 `5865e801e6324166d6d05b39a14f2a8a798c6eb652831f78c2634f2b7a400eaf`; size 176128 bytes\n SHA-1: `4bf599529acfaae6faa9190b6fcb0bd06af19984`; MD5: `4ce94bdaa8b396d5d3a7204b55c10987`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.90.215\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1553,\"response_frame\":1713,\"server_ip\":\"217.23.14.81\",\"status_code\":\"200\",\"tcp_stream\":50,\"url\":\"http://217.23.14.81/f4.exe\"}]`.\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":176128,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":\"executable\"}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":176128,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `CSPCA.crl`; SHA-256 `3ceb4a8069b2b9e5fdf508ef67d5af5b9d3e6a7b417919953a89fa9773e16440`; size 506 bytes\n SHA-1: `cfa529c048ec394a1203853c0c9a5e28ea23f035`; MD5: `a26dcbb948da05ec8af97885dbd149b0`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.90.215\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":2071,\"response_frame\":2073,\"server_ip\":\"173.205.6.202\",\"status_code\":\"200\",\"tcp_stream\":56,\"url\":\"http://crl.microsoft.com/pki/crl/products/CSPCA.crl\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":506,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ncsi.txt`; SHA-256 `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; size 14 bytes\n SHA-1: `33bf88d5b82df3723d5863c7d23445e345828904`; MD5: `cd5a4d3fdd5bffc16bf959ef75cf37bc`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.90.215\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":408,\"response_frame\":410,\"server_ip\":\"209.121.139.185\",\"status_code\":\"200\",\"tcp_stream\":27,\"url\":\"http://www.msftncsi.com/ncsi.txt\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":14,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n\n## Actor similarity leads\n\n- Volatile Cedar (G0123): 20% TTP overlap. This is an investigation lead, not attribution.\n- Winnti Group (G0044): 17% TTP overlap. This is an investigation lead, not attribution.\n- Ajax Security Team (G0130): 17% TTP overlap. This is an investigation lead, not attribution.\n- IndigoZebra (G0136): 14% TTP overlap. This is an investigation lead, not attribution.\n- Nomadic Octopus (G0133): 14% TTP overlap. This is an investigation lead, not attribution.\n- Metador (G1013): 11% TTP overlap. This is an investigation lead, not attribution.\n- Whitefly (G0107): 11% TTP overlap. This is an investigation lead, not attribution.\n- Elderwood (G0066): 11% TTP overlap. This is an investigation lead, not attribution.\n- Rancor (G0075): 11% TTP overlap. This is an investigation lead, not attribution.\n- Evilnum (G0120): 9% TTP overlap. This is an investigation lead, not attribution.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `7a94345ce0dbb444a54c8d78dbd93700806aaf04a6f21c90fdeab53782487de2`; recorded 2026-09-22T16:08:33.933892+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":48,\"observable_limit\":5000,\"observables_checked\":48,\"observables_total\":48,\"prior_case_limit_reached\":true,\"prior_cases_checked\":50,\"truncated\":false}`\n\n- Catalog T1105: https://attack.mitre.org/techniques/T1105; detection strategies: [{\"attack_id\":\"DET0060\",\"name\":\"Detect Ingress Tool Transfers via Behavioral Chain\",\"stix_id\":\"x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554\"}]\n- Prior analysis `0bb7a995-231c-4046-95ec-acea419eb7b4` shares 8 observations. This does not establish a common campaign.\n- Prior analysis `d4027bcf-0ef6-4e3c-a68a-68dfe35adb33` shares 8 observations. This does not establish a common campaign.\n- Prior analysis `8879e360-655c-4073-beb9-68018699a4d4` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `961bdc9a-7460-440f-a246-f55748149bcc` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `1c2e6d58-c62a-4009-939b-3aa82de281a2` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `76f521c2-4e4a-41d5-95ad-a44fd9887dd8` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `fa0da8be-03fb-404d-a526-6c99c6b4f000` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `05851801-c224-489b-b9da-9e5d035c60b4` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `d9aa0de8-e06d-40b7-bffc-2e1af3c53ea0` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `246dbce6-c561-4434-bedb-dd496ba758d2` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `c66676ab-7276-4989-8c27-65017a63c2ba` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `476c88cb-8e1a-42e4-a8bd-e2ad2e63b0cd` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `044c22d0-fd65-4c60-8644-c22ff5e1b31c` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `73129515-519f-4544-905f-145c9d2de3d8` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `5ddffc9a-7544-4749-b7bc-17ad98beaadb` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `fc2de8b3-a6ce-4024-9d9b-5602034db53d` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `b12014b8-9e64-4e70-bdb8-90620d23ac22` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `ada03a66-9d3d-4c08-b448-f9758ac8bac5` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `0b13588f-0835-4e15-9f97-8a9411ad7f7f` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `92de15ed-01f0-4a43-8105-a56b60130430` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `fdf1584a-1c2d-4a49-92b2-8dcb98436eb0` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `fab22e38-ca53-4105-924e-f5722b5f53fe` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `b60c4dbb-eb8f-46a7-89b9-24606fd43e46` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `8174eaa7-e189-467f-b05e-fb7397bfcf16` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `e37603cf-d241-45ee-95ec-bcf92a063147` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `7c54479c-cce3-4570-80c9-69d03571a645` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `21da2cda-3a07-4c03-b352-af8740c84bc0` shares 4 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":4,\"export_status\":\"completed\",\"exported_objects\":4,\"hashed_bytes\":988168,\"hashed_objects\":4,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":4,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":4}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 7/7, identities 4/4, observables 48/48, artifacts 4/4. Full returned inventory is in the JSON result.\n\n## Evidence-backed IOC assessment\n\n43 typed observations; 0 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.\n\nPolicy: `pcap-assessment-v3`; assessment SHA-256: `8e7e1f827e8c9c462260aa4ea3ab0bd4dd2e30311845b6615fad688090ff15a4`.\n\n\nOrdinary observations remain in the capture inventory; they are not declared malicious IOCs.\n\nReputation snapshot: `b702997fe3617c4d29f91f5befac71744967cfd248d392d7894135ced8131b25`; updated 2026-09-22T18:01:23.738084+00:00. Each target retains its query time. Coverage: `{\"active_scans\":0,\"batch_results\":[{\"observable_id\":\"observable-b905e5c9aab70fdbb0a669e4\",\"provider\":\"virustotal\",\"status\":\"error\"},{\"observable_id\":\"observable-b905e5c9aab70fdbb0a669e4\",\"provider\":\"otx\",\"status\":\"ok\"}],\"batch_targets\":1,\"cache_hits\":0,\"full_urls_disclosed\":0,\"payload_uploads\":0,\"provider_lookups_started\":2,\"retained_targets\":16,\"targets_omitted\":0}`.\n- No detections, no record, missing credentials and provider errors do not mean benign.\n- Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.\n- A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.\n- Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure.\n", "result": { "flows": [ { "bytes": 4540, "stream": 0, "flow_id": "flow-f9ff29fbb6b8a2334851e943", "packets": 47, "transport": "udp", "last_frame": 11006, "first_frame": 1, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.255", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 4540, "last_seen_epoch": "1552971246.8825", "responder_bytes": 0, "first_seen_epoch": "1552959895.636766" }, { "bytes": 327, "stream": 1, "flow_id": "flow-e062531114c49822f4d03aee", "packets": 2, "transport": "udp", "last_frame": 4, "first_frame": 3, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 63262, "responder_port": 53, "initiator_bytes": 129, "last_seen_epoch": "1552959895.65506", "responder_bytes": 198, "first_seen_epoch": "1552959895.654616" }, { "bytes": 202, "stream": 2, "flow_id": "flow-add4400c0f43b4dbed7ef6b8", "packets": 2, "transport": "udp", "last_frame": 6, "first_frame": 5, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 55332, "responder_port": 53, "initiator_bytes": 93, "last_seen_epoch": "1552959895.657459", "responder_bytes": 109, "first_seen_epoch": "1552959895.65729" }, { "bytes": 461, "stream": 3, "flow_id": "flow-77543f848eb629b2dcfb4a93", "packets": 2, "transport": "udp", "last_frame": 9, "first_frame": 7, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 55334, "responder_port": 389, "initiator_bytes": 216, "last_seen_epoch": "1552959895.664376", "responder_bytes": 245, "first_seen_epoch": "1552959895.664082" }, { "bytes": 504, "stream": 4, "flow_id": "flow-237f1d83c632b3f40bb3616d", "packets": 2, "transport": "udp", "last_frame": 10, "first_frame": 8, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 55335, "responder_port": 389, "initiator_bytes": 259, "last_seen_epoch": "1552959895.664506", "responder_bytes": 245, "first_seen_epoch": "1552959895.664312" }, { "bytes": 1878, "stream": 0, "flow_id": "flow-57ff95ea40af8134a5c5b01f", "packets": 15, "transport": "tcp", "last_frame": 497, "first_frame": 12, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49155, "responder_port": 135, "initiator_bytes": 994, "last_seen_epoch": "1552959924.278081", "responder_bytes": 884, "first_seen_epoch": "1552959895.761573" }, { "bytes": 4561, "stream": 1, "flow_id": "flow-20e01353b11aed50a11e8672", "packets": 20, "transport": "tcp", "last_frame": 495, "first_frame": 19, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49156, "responder_port": 49158, "initiator_bytes": 2647, "last_seen_epoch": "1552959924.277728", "responder_bytes": 1914, "first_seen_epoch": "1552959895.768125" }, { "bytes": 6933, "stream": 2, "flow_id": "flow-1024ff2990a3163c585e6417", "packets": 25, "transport": "tcp", "last_frame": 487, "first_frame": 28, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49157, "responder_port": 445, "initiator_bytes": 4937, "last_seen_epoch": "1552959912.73478", "responder_bytes": 1996, "first_seen_epoch": "1552959895.77283" }, { "bytes": 9181, "stream": 3, "flow_id": "flow-74f51217498e4c47f83c44cc", "packets": 29, "transport": "tcp", "last_frame": 215, "first_frame": 39, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49158, "responder_port": 389, "initiator_bytes": 4430, "last_seen_epoch": "1552959896.091843", "responder_bytes": 4751, "first_seen_epoch": "1552959895.785163" }, { "bytes": 1013, "stream": 4, "flow_id": "flow-98ae56ed82b120f920e239b9", "packets": 8, "transport": "tcp", "last_frame": 55, "first_frame": 48, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49159, "responder_port": 88, "initiator_bytes": 477, "last_seen_epoch": "1552959895.794506", "responder_bytes": 536, "first_seen_epoch": "1552959895.792584" }, { "bytes": 1013, "stream": 5, "flow_id": "flow-7de9e7d564f7bc92ceadd3ef", "packets": 8, "transport": "tcp", "last_frame": 66, "first_frame": 56, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49160, "responder_port": 88, "initiator_bytes": 477, "last_seen_epoch": "1552959895.81734", "responder_bytes": 536, "first_seen_epoch": "1552959895.801237" }, { "bytes": 2549, "stream": 6, "flow_id": "flow-0111eaa1681bbf94f6e78bc5", "packets": 10, "transport": "tcp", "last_frame": 73, "first_frame": 61, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49161, "responder_port": 88, "initiator_bytes": 611, "last_seen_epoch": "1552959895.838632", "responder_bytes": 1938, "first_seen_epoch": "1552959895.814039" }, { "bytes": 2549, "stream": 7, "flow_id": "flow-05e1d3d99ed5f5916353afa4", "packets": 10, "transport": "tcp", "last_frame": 91, "first_frame": 74, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49162, "responder_port": 88, "initiator_bytes": 611, "last_seen_epoch": "1552959895.842428", "responder_bytes": 1938, "first_seen_epoch": "1552959895.838967" }, { "bytes": 3999, "stream": 8, "flow_id": "flow-9de560fa00e994edb9842771", "packets": 12, "transport": "tcp", "last_frame": 97, "first_frame": 76, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49163, "responder_port": 88, "initiator_bytes": 2009, "last_seen_epoch": "1552959895.845705", "responder_bytes": 1990, "first_seen_epoch": "1552959895.84014" }, { "bytes": 3999, "stream": 9, "flow_id": "flow-4e80b68d1b8e8dbbfb6f0cd8", "packets": 12, "transport": "tcp", "last_frame": 111, "first_frame": 93, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49164, "responder_port": 88, "initiator_bytes": 2009, "last_seen_epoch": "1552959895.848737", "responder_bytes": 1990, "first_seen_epoch": "1552959895.845333" }, { "bytes": 3695, "stream": 10, "flow_id": "flow-4c19304a301613345d25d90f", "packets": 12, "transport": "tcp", "last_frame": 127, "first_frame": 112, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49165, "responder_port": 88, "initiator_bytes": 1841, "last_seen_epoch": "1552959895.851601", "responder_bytes": 1854, "first_seen_epoch": "1552959895.849109" }, { "bytes": 337, "stream": 5, "flow_id": "flow-274de899b15d1ff16cd2901e", "packets": 2, "transport": "udp", "last_frame": 134, "first_frame": 133, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 53248, "responder_port": 53, "initiator_bytes": 134, "last_seen_epoch": "1552959895.853768", "responder_bytes": 203, "first_seen_epoch": "1552959895.853591" }, { "bytes": 441, "stream": 6, "flow_id": "flow-057a098cdab032e97b3f1159", "packets": 2, "transport": "udp", "last_frame": 138, "first_frame": 137, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 53249, "responder_port": 389, "initiator_bytes": 194, "last_seen_epoch": "1552959895.85504", "responder_bytes": 247, "first_seen_epoch": "1552959895.85486" }, { "bytes": 307, "stream": 7, "flow_id": "flow-956af65a5e8e5f9011e37d30", "packets": 2, "transport": "udp", "last_frame": 142, "first_frame": 141, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 64687, "responder_port": 53, "initiator_bytes": 119, "last_seen_epoch": "1552959895.922616", "responder_bytes": 188, "first_seen_epoch": "1552959895.922339" }, { "bytes": 461, "stream": 8, "flow_id": "flow-28b22ddd3a013837b5bf1623", "packets": 2, "transport": "udp", "last_frame": 144, "first_frame": 143, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 64688, "responder_port": 389, "initiator_bytes": 216, "last_seen_epoch": "1552959895.928302", "responder_bytes": 245, "first_seen_epoch": "1552959895.927848" }, { "bytes": 348, "stream": 11, "flow_id": "flow-ccd04be9e019fd20f7e4929e", "packets": 6, "transport": "tcp", "last_frame": 151, "first_frame": 145, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49166, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1552959895.959413", "responder_bytes": 174, "first_seen_epoch": "1552959895.95462" }, { "bytes": 337, "stream": 9, "flow_id": "flow-84c5baffcff5a375771700b1", "packets": 2, "transport": "udp", "last_frame": 154, "first_frame": 153, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 59191, "responder_port": 53, "initiator_bytes": 134, "last_seen_epoch": "1552959895.962", "responder_bytes": 203, "first_seen_epoch": "1552959895.961795" }, { "bytes": 441, "stream": 10, "flow_id": "flow-bf360941530dbd7c375236c0", "packets": 2, "transport": "udp", "last_frame": 156, "first_frame": 155, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 59192, "responder_port": 389, "initiator_bytes": 194, "last_seen_epoch": "1552959895.96317", "responder_bytes": 247, "first_seen_epoch": "1552959895.962965" }, { "bytes": 5623, "stream": 12, "flow_id": "flow-61cac94c16f64b7410c378de", "packets": 15, "transport": "tcp", "last_frame": 184, "first_frame": 158, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49167, "responder_port": 389, "initiator_bytes": 2636, "last_seen_epoch": "1552959896.041115", "responder_bytes": 2987, "first_seen_epoch": "1552959896.031022" }, { "bytes": 4036, "stream": 13, "flow_id": "flow-2e69b0858a42e24bdfd70f61", "packets": 12, "transport": "tcp", "last_frame": 176, "first_frame": 165, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49168, "responder_port": 88, "initiator_bytes": 2028, "last_seen_epoch": "1552959896.038861", "responder_bytes": 2008, "first_seen_epoch": "1552959896.034281" }, { "bytes": 348, "stream": 14, "flow_id": "flow-09f6a84186e4a70ee8c76851", "packets": 6, "transport": "tcp", "last_frame": 192, "first_frame": 186, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49169, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1552959896.078031", "responder_bytes": 174, "first_seen_epoch": "1552959896.069849" }, { "bytes": 348, "stream": 15, "flow_id": "flow-a192fe9643ca29f3653e2e36", "packets": 6, "transport": "tcp", "last_frame": 199, "first_frame": 194, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49170, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1552959896.080349", "responder_bytes": 174, "first_seen_epoch": "1552959896.078668" }, { "bytes": 348, "stream": 16, "flow_id": "flow-71ddcf68c30b4bab8b0a38b9", "packets": 6, "transport": "tcp", "last_frame": 208, "first_frame": 202, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49171, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1552959896.08865", "responder_bytes": 174, "first_seen_epoch": "1552959896.087905" }, { "bytes": 5793, "stream": 17, "flow_id": "flow-3b36870db83d58f55415a1e6", "packets": 22, "transport": "tcp", "last_frame": 520, "first_frame": 224, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49173, "responder_port": 49155, "initiator_bytes": 3748, "last_seen_epoch": "1552959954.291193", "responder_bytes": 2045, "first_seen_epoch": "1552959896.400759" }, { "bytes": 4036, "stream": 18, "flow_id": "flow-88c7f12767ed2835028710aa", "packets": 12, "transport": "tcp", "last_frame": 238, "first_frame": 227, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49174, "responder_port": 88, "initiator_bytes": 2028, "last_seen_epoch": "1552959896.40304", "responder_bytes": 2008, "first_seen_epoch": "1552959896.401489" }, { "bytes": 350, "stream": 11, "flow_id": "flow-76ef8fde29d933031b235f93", "packets": 2, "transport": "udp", "last_frame": 258, "first_frame": 257, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 54918, "responder_port": 53, "initiator_bytes": 135, "last_seen_epoch": "1552959896.985217", "responder_bytes": 215, "first_seen_epoch": "1552959896.984928" }, { "bytes": 288, "stream": 12, "flow_id": "flow-0734eb7e4a6f79b8357e73ae", "packets": 2, "transport": "udp", "last_frame": 260, "first_frame": 259, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 50104, "responder_port": 53, "initiator_bytes": 104, "last_seen_epoch": "1552959896.985821", "responder_bytes": 184, "first_seen_epoch": "1552959896.985653" }, { "bytes": 8281, "stream": 19, "flow_id": "flow-48b5f9ab4e83c5e4a860d597", "packets": 20, "transport": "tcp", "last_frame": 376, "first_frame": 261, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49175, "responder_port": 389, "initiator_bytes": 3441, "last_seen_epoch": "1552959897.396713", "responder_bytes": 4840, "first_seen_epoch": "1552959896.987128" }, { "bytes": 3925, "stream": 20, "flow_id": "flow-a278b2502f20e679a4228145", "packets": 12, "transport": "tcp", "last_frame": 283, "first_frame": 272, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49176, "responder_port": 88, "initiator_bytes": 1985, "last_seen_epoch": "1552959897.000647", "responder_bytes": 1940, "first_seen_epoch": "1552959896.999025" }, { "bytes": 3421, "stream": 21, "flow_id": "flow-21f808be2b691c4a0448d2e7", "packets": 13, "transport": "tcp", "last_frame": 368, "first_frame": 286, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49177, "responder_port": 389, "initiator_bytes": 2563, "last_seen_epoch": "1552959897.023061", "responder_bytes": 858, "first_seen_epoch": "1552959897.005471" }, { "bytes": 3718, "stream": 22, "flow_id": "flow-13467f820c4535478eceec98", "packets": 12, "transport": "tcp", "last_frame": 315, "first_frame": 299, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49178, "responder_port": 88, "initiator_bytes": 1846, "last_seen_epoch": "1552959897.013444", "responder_bytes": 1872, "first_seen_epoch": "1552959897.011713" }, { "bytes": 8835, "stream": 23, "flow_id": "flow-21fc4641d88c13c0fe1c4389", "packets": 34, "transport": "tcp", "last_frame": 510, "first_frame": 304, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49179, "responder_port": 445, "initiator_bytes": 5993, "last_seen_epoch": "1552959936.742233", "responder_bytes": 2842, "first_seen_epoch": "1552959897.0122" }, { "bytes": 3378, "stream": 24, "flow_id": "flow-0be3137db2a653edfae7ac5e", "packets": 10, "transport": "tcp", "last_frame": 334, "first_frame": 316, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49180, "responder_port": 88, "initiator_bytes": 2949, "last_seen_epoch": "1552959897.015446", "responder_bytes": 429, "first_seen_epoch": "1552959897.013619" }, { "bytes": 3999, "stream": 25, "flow_id": "flow-36316ba04e35f911a2277c0d", "packets": 12, "transport": "tcp", "last_frame": 338, "first_frame": 318, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49181, "responder_port": 88, "initiator_bytes": 2009, "last_seen_epoch": "1552959897.01573", "responder_bytes": 1990, "first_seen_epoch": "1552959897.0139" }, { "bytes": 3695, "stream": 26, "flow_id": "flow-f064b8f037d3fed3bb19b351", "packets": 12, "transport": "tcp", "last_frame": 349, "first_frame": 337, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49182, "responder_port": 88, "initiator_bytes": 1841, "last_seen_epoch": "1552959897.016668", "responder_bytes": 1854, "first_seen_epoch": "1552959897.015709" }, { "bytes": 148, "stream": 13, "flow_id": "flow-e67c4ec78715add62a7534fa", "packets": 2, "transport": "udp", "last_frame": 389, "first_frame": 383, "initiator_ip": "10.0.90.215", "responder_ip": "224.0.0.252", "initiator_port": 62204, "responder_port": 5355, "initiator_bytes": 148, "last_seen_epoch": "1552959898.772738", "responder_bytes": 0, "first_seen_epoch": "1552959898.677281" }, { "bytes": 2736, "stream": 14, "flow_id": "flow-958aab27fe2efb94f471eb93", "packets": 8, "transport": "udp", "last_frame": 10975, "first_frame": 384, "initiator_ip": "10.0.90.215", "responder_ip": "255.255.255.255", "initiator_port": 68, "responder_port": 67, "initiator_bytes": 2736, "last_seen_epoch": "1552971245.360596", "responder_bytes": 0, "first_seen_epoch": "1552959898.681594" }, { "bytes": 2736, "stream": 15, "flow_id": "flow-3f3e946d67f6df0f54db754b", "packets": 8, "transport": "udp", "last_frame": 10976, "first_frame": 385, "initiator_ip": "10.0.90.9", "responder_ip": "10.0.90.215", "initiator_port": 67, "responder_port": 68, "initiator_bytes": 2736, "last_seen_epoch": "1552971245.361345", "responder_bytes": 0, "first_seen_epoch": "1552959898.681969" }, { "bytes": 244, "stream": 16, "flow_id": "flow-da646587ce89b3268291525d", "packets": 2, "transport": "udp", "last_frame": 387, "first_frame": 386, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 56860, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1552959898.685365", "responder_bytes": 162, "first_seen_epoch": "1552959898.685117" }, { "bytes": 128, "stream": 17, "flow_id": "flow-05ac3e7df94978bf85d0a711", "packets": 2, "transport": "udp", "last_frame": 390, "first_frame": 388, "initiator_ip": "10.0.90.215", "responder_ip": "224.0.0.252", "initiator_port": 60476, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1552959898.782554", "responder_bytes": 0, "first_seen_epoch": "1552959898.686023" }, { "bytes": 202, "stream": 18, "flow_id": "flow-788e47925531ac3fbc12ed57", "packets": 2, "transport": "udp", "last_frame": 394, "first_frame": 393, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 56185, "responder_port": 53, "initiator_bytes": 93, "last_seen_epoch": "1552959899.179202", "responder_bytes": 109, "first_seen_epoch": "1552959899.17894" }, { "bytes": 248, "stream": 19, "flow_id": "flow-93d4ef36676abc3ad390f4d1", "packets": 2, "transport": "udp", "last_frame": 396, "first_frame": 395, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 53832, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1552959899.185384", "responder_bytes": 164, "first_seen_epoch": "1552959899.185167" }, { "bytes": 231, "stream": 20, "flow_id": "flow-8d47bfe3cbe5a5668f7b9f18", "packets": 2, "transport": "udp", "last_frame": 398, "first_frame": 397, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 63108, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1552959899.319065", "responder_bytes": 153, "first_seen_epoch": "1552959899.318803" }, { "bytes": 2640, "stream": 21, "flow_id": "flow-9ae1683f4dd75c927ff1c81b", "packets": 24, "transport": "udp", "last_frame": 13145, "first_frame": 401, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 123, "responder_port": 123, "initiator_bytes": 1320, "last_seen_epoch": "1552972188.744665", "responder_bytes": 1320, "first_seen_epoch": "1552959900.676619" }, { "bytes": 258, "stream": 22, "flow_id": "flow-92bb26cdd72f9c8b30b0fa58", "packets": 2, "transport": "udp", "last_frame": 404, "first_frame": 403, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 61100, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1552959901.298914", "responder_bytes": 182, "first_seen_epoch": "1552959901.255609" }, { "bytes": 778, "stream": 27, "flow_id": "flow-d0a2b4b9607964c9a5cd8946", "packets": 9, "transport": "tcp", "last_frame": 413, "first_frame": 405, "initiator_ip": "10.0.90.215", "responder_ip": "209.121.139.185", "initiator_port": 49183, "responder_port": 80, "initiator_bytes": 379, "last_seen_epoch": "1552959901.31538", "responder_bytes": 399, "first_seen_epoch": "1552959901.303487" }, { "bytes": 263, "stream": 23, "flow_id": "flow-24f3fbf8bfae326f2b62d345", "packets": 2, "transport": "udp", "last_frame": 415, "first_frame": 414, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 58922, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1552959903.685091", "responder_bytes": 171, "first_seen_epoch": "1552959903.684782" }, { "bytes": 322, "stream": 24, "flow_id": "flow-0405b7406125e4c838bf81b3", "packets": 2, "transport": "udp", "last_frame": 417, "first_frame": 416, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 52609, "responder_port": 53, "initiator_bytes": 161, "last_seen_epoch": "1552959903.687704", "responder_bytes": 161, "first_seen_epoch": "1552959903.68709" }, { "bytes": 7279, "stream": 28, "flow_id": "flow-084ddca98a40925d7d840668", "packets": 21, "transport": "tcp", "last_frame": 481, "first_frame": 418, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49185, "responder_port": 389, "initiator_bytes": 3444, "last_seen_epoch": "1552959906.554669", "responder_bytes": 3835, "first_seen_epoch": "1552959906.512646" }, { "bytes": 4206, "stream": 29, "flow_id": "flow-d2d0f2a4351dda85da6c2899", "packets": 13, "transport": "tcp", "last_frame": 479, "first_frame": 437, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49186, "responder_port": 389, "initiator_bytes": 3388, "last_seen_epoch": "1552959906.554131", "responder_bytes": 818, "first_seen_epoch": "1552959906.5245" }, { "bytes": 1013, "stream": 30, "flow_id": "flow-9e5f2a51069a47c99be88a1a", "packets": 8, "transport": "tcp", "last_frame": 453, "first_frame": 446, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49187, "responder_port": 88, "initiator_bytes": 477, "last_seen_epoch": "1552959906.533042", "responder_bytes": 536, "first_seen_epoch": "1552959906.531889" }, { "bytes": 2549, "stream": 31, "flow_id": "flow-5371e2f88a6b509a8a0dcb2f", "packets": 10, "transport": "tcp", "last_frame": 463, "first_frame": 454, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49188, "responder_port": 88, "initiator_bytes": 611, "last_seen_epoch": "1552959906.548965", "responder_bytes": 1938, "first_seen_epoch": "1552959906.547733" }, { "bytes": 3863, "stream": 32, "flow_id": "flow-d835e64187dc772ebcd2d0b7", "packets": 12, "transport": "tcp", "last_frame": 475, "first_frame": 464, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49189, "responder_port": 88, "initiator_bytes": 1951, "last_seen_epoch": "1552959906.551146", "responder_bytes": 1912, "first_seen_epoch": "1552959906.549738" }, { "bytes": 604, "stream": 33, "flow_id": "flow-983cd005018390e50fb4192d", "packets": 11, "transport": "tcp", "last_frame": 516, "first_frame": 501, "initiator_ip": "10.0.90.9", "responder_ip": "10.0.90.215", "initiator_port": 445, "responder_port": 49196, "initiator_bytes": 604, "last_seen_epoch": "1552959948.049488", "responder_bytes": 0, "first_seen_epoch": "1552959927.97265" }, { "bytes": 933, "stream": 34, "flow_id": "flow-3ba25248b5acc7b3c3a2ee15", "packets": 8, "transport": "tcp", "last_frame": 528, "first_frame": 521, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49190, "responder_port": 88, "initiator_bytes": 463, "last_seen_epoch": "1552959980.213179", "responder_bytes": 470, "first_seen_epoch": "1552959980.211822" }, { "bytes": 2502, "stream": 35, "flow_id": "flow-b12e676cde17e962943af531", "packets": 10, "transport": "tcp", "last_frame": 538, "first_frame": 529, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49191, "responder_port": 88, "initiator_bytes": 597, "last_seen_epoch": "1552959980.223951", "responder_bytes": 1905, "first_seen_epoch": "1552959980.222614" }, { "bytes": 3719, "stream": 36, "flow_id": "flow-ae08bb0242a28c21cdb694c2", "packets": 12, "transport": "tcp", "last_frame": 550, "first_frame": 539, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49192, "responder_port": 88, "initiator_bytes": 1845, "last_seen_epoch": "1552959980.225607", "responder_bytes": 1874, "first_seen_epoch": "1552959980.224083" }, { "bytes": 1280, "stream": 37, "flow_id": "flow-7370c8a1e90331097f4cfc19", "packets": 12, "transport": "tcp", "last_frame": 703, "first_frame": 551, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49193, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1552959992.134499", "responder_bytes": 562, "first_seen_epoch": "1552959980.751704" }, { "bytes": 6734, "stream": 38, "flow_id": "flow-a1543cfbd5381a2e0c6515d4", "packets": 27, "transport": "tcp", "last_frame": 1530, "first_frame": 558, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49194, "responder_port": 49155, "initiator_bytes": 4313, "last_seen_epoch": "1552960027.126978", "responder_bytes": 2421, "first_seen_epoch": "1552959980.758238" }, { "bytes": 4020, "stream": 39, "flow_id": "flow-8316c4dd658dd0da299d144b", "packets": 12, "transport": "tcp", "last_frame": 572, "first_frame": 561, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49195, "responder_port": 88, "initiator_bytes": 2020, "last_seen_epoch": "1552959980.760577", "responder_bytes": 2000, "first_seen_epoch": "1552959980.759192" }, { "bytes": 7796, "stream": 40, "flow_id": "flow-f6b6edbaf4984303d7441a10", "packets": 38, "transport": "tcp", "last_frame": 2035, "first_frame": 587, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49196, "responder_port": 445, "initiator_bytes": 5383, "last_seen_epoch": "1552960931.833742", "responder_bytes": 2413, "first_seen_epoch": "1552959980.791596" }, { "bytes": 3983, "stream": 41, "flow_id": "flow-ef996f8002bca8b267023009", "packets": 12, "transport": "tcp", "last_frame": 605, "first_frame": 594, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49197, "responder_port": 88, "initiator_bytes": 2001, "last_seen_epoch": "1552959980.794973", "responder_bytes": 1982, "first_seen_epoch": "1552959980.793512" }, { "bytes": 3679, "stream": 42, "flow_id": "flow-6db1d9e576a211cfdf4a5337", "packets": 12, "transport": "tcp", "last_frame": 617, "first_frame": 606, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49198, "responder_port": 88, "initiator_bytes": 1833, "last_seen_epoch": "1552959980.795869", "responder_bytes": 1846, "first_seen_epoch": "1552959980.795046" }, { "bytes": 350, "stream": 25, "flow_id": "flow-49ee6532d093faa1d25d072a", "packets": 2, "transport": "udp", "last_frame": 633, "first_frame": 632, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49189, "responder_port": 53, "initiator_bytes": 135, "last_seen_epoch": "1552959981.295313", "responder_bytes": 215, "first_seen_epoch": "1552959981.294987" }, { "bytes": 288, "stream": 26, "flow_id": "flow-4900a5d3ee88b5fb16360d55", "packets": 2, "transport": "udp", "last_frame": 635, "first_frame": 634, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 57499, "responder_port": 53, "initiator_bytes": 104, "last_seen_epoch": "1552959981.295851", "responder_bytes": 184, "first_seen_epoch": "1552959981.295661" }, { "bytes": 5217, "stream": 43, "flow_id": "flow-0df8202b63c6b4bf0f03e1b6", "packets": 14, "transport": "tcp", "last_frame": 696, "first_frame": 636, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49199, "responder_port": 389, "initiator_bytes": 2926, "last_seen_epoch": "1552959981.89686", "responder_bytes": 2291, "first_seen_epoch": "1552959981.296757" }, { "bytes": 3983, "stream": 44, "flow_id": "flow-ac7a9d2774840772b84ec655", "packets": 12, "transport": "tcp", "last_frame": 650, "first_frame": 639, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49200, "responder_port": 88, "initiator_bytes": 2001, "last_seen_epoch": "1552959981.300003", "responder_bytes": 1982, "first_seen_epoch": "1552959981.297821" }, { "bytes": 3545, "stream": 45, "flow_id": "flow-9eaa92cae47d8ebfed679f79", "packets": 15, "transport": "tcp", "last_frame": 691, "first_frame": 657, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49201, "responder_port": 389, "initiator_bytes": 2633, "last_seen_epoch": "1552959981.315063", "responder_bytes": 912, "first_seen_epoch": "1552959981.304259" }, { "bytes": 7516, "stream": 46, "flow_id": "flow-a2c84f8bfeadcb47d8d1da38", "packets": 27, "transport": "tcp", "last_frame": 745, "first_frame": 670, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49202, "responder_port": 445, "initiator_bytes": 5352, "last_seen_epoch": "1552960020.733873", "responder_bytes": 2164, "first_seen_epoch": "1552959981.310233" }, { "bytes": 168, "stream": 27, "flow_id": "flow-75cfb6a141e026de43b47c2e", "packets": 2, "transport": "udp", "last_frame": 697, "first_frame": 694, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 53187, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1552959981.918924", "responder_bytes": 92, "first_seen_epoch": "1552959981.893723" }, { "bytes": 152, "stream": 28, "flow_id": "flow-55a5cb4c4ee1f9287b0fc4a1", "packets": 2, "transport": "udp", "last_frame": 699, "first_frame": 698, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 53492, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1552959981.923353", "responder_bytes": 76, "first_seen_epoch": "1552959981.919944" }, { "bytes": 1280, "stream": 47, "flow_id": "flow-558b41fbb92816d63db097d0", "packets": 12, "transport": "tcp", "last_frame": 728, "first_frame": 704, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49203, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1552960007.129591", "responder_bytes": 562, "first_seen_epoch": "1552959993.773549" }, { "bytes": 1050, "stream": 29, "flow_id": "flow-cc3afa17e74617dd53e620da", "packets": 6, "transport": "udp", "last_frame": 747, "first_frame": 736, "initiator_ip": "10.0.90.215", "responder_ip": "239.255.255.250", "initiator_port": 53494, "responder_port": 1900, "initiator_bytes": 1050, "last_seen_epoch": "1552960022.728006", "responder_bytes": 0, "first_seen_epoch": "1552960016.262103" }, { "bytes": 854106, "stream": 48, "flow_id": "flow-7dc270411fed3c3bc5c0f6ea", "packets": 777, "transport": "tcp", "last_frame": 1533, "first_frame": 751, "initiator_ip": "10.0.90.215", "responder_ip": "209.141.34.8", "initiator_port": 49204, "responder_port": 80, "initiator_bytes": 10310, "last_seen_epoch": "1552960041.094708", "responder_bytes": 843796, "first_seen_epoch": "1552960024.558889" }, { "bytes": 170, "stream": 30, "flow_id": "flow-20aae80520762df86fccb47d", "packets": 2, "transport": "udp", "last_frame": 1536, "first_frame": 1535, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 53146, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1552960184.65296", "responder_bytes": 93, "first_seen_epoch": "1552960184.555643" }, { "bytes": 536481, "stream": 49, "flow_id": "flow-285598dc1889c3dcbc22b322", "packets": 3886, "transport": "tcp", "last_frame": 13186, "first_frame": 1537, "initiator_ip": "10.0.90.215", "responder_ip": "103.1.184.108", "initiator_port": 49205, "responder_port": 2404, "initiator_bytes": 186939, "last_seen_epoch": "1552972317.257558", "responder_bytes": 349542, "first_seen_epoch": "1552960184.659413" }, { "bytes": 185841, "stream": 50, "flow_id": "flow-539c66aa400f3da4dc8ce8f3", "packets": 168, "transport": "tcp", "last_frame": 1756, "first_frame": 1549, "initiator_ip": "10.0.90.215", "responder_ip": "217.23.14.81", "initiator_port": 49206, "responder_port": 80, "initiator_bytes": 2369, "last_seen_epoch": "1552960305.884802", "responder_bytes": 183472, "first_seen_epoch": "1552960185.90093" }, { "bytes": 6417, "stream": 51, "flow_id": "flow-ef54b33cc4e4bfc111435a07", "packets": 22, "transport": "tcp", "last_frame": 1932, "first_frame": 1905, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49207, "responder_port": 445, "initiator_bytes": 4701, "last_seen_epoch": "1552960806.746769", "responder_bytes": 1716, "first_seen_epoch": "1552960796.254931" }, { "bytes": 1280, "stream": 52, "flow_id": "flow-e0fc1c69e556585f987b3fb7", "packets": 12, "transport": "tcp", "last_frame": 1995, "first_frame": 1939, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49208, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1552960843.016435", "responder_bytes": 562, "first_seen_epoch": "1552960833.009984" }, { "bytes": 1631, "stream": 53, "flow_id": "flow-4e634daa4187c773a70740a5", "packets": 12, "transport": "tcp", "last_frame": 1994, "first_frame": 1946, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49209, "responder_port": 49155, "initiator_bytes": 877, "last_seen_epoch": "1552960843.016274", "responder_bytes": 754, "first_seen_epoch": "1552960833.011609" }, { "bytes": 164, "stream": 31, "flow_id": "flow-bb8835efd61039a0f1bb2d42", "packets": 2, "transport": "udp", "last_frame": 1956, "first_frame": 1955, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 53147, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1552960833.517887", "responder_bytes": 82, "first_seen_epoch": "1552960833.509194" }, { "bytes": 270, "stream": 32, "flow_id": "flow-386345dad54802818c90d997", "packets": 2, "transport": "udp", "last_frame": 1958, "first_frame": 1957, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 53148, "responder_port": 53, "initiator_bytes": 95, "last_seen_epoch": "1552960833.519146", "responder_bytes": 175, "first_seen_epoch": "1552960833.518948" }, { "bytes": 263, "stream": 33, "flow_id": "flow-14c6134ba7236867325b17a0", "packets": 2, "transport": "udp", "last_frame": 1960, "first_frame": 1959, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 53149, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1552960833.520015", "responder_bytes": 186, "first_seen_epoch": "1552960833.519839" }, { "bytes": 1296, "stream": 34, "flow_id": "flow-9f628818bb8d7df2a9cfd407", "packets": 6, "transport": "udp", "last_frame": 9929, "first_frame": 1961, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.255", "initiator_port": 138, "responder_port": 138, "initiator_bytes": 1296, "last_seen_epoch": "1552970841.843934", "responder_bytes": 0, "first_seen_epoch": "1552960833.56873" }, { "bytes": 208, "stream": 35, "flow_id": "flow-9acc581ccfd458e9060873fb", "packets": 2, "transport": "udp", "last_frame": 9923, "first_frame": 1963, "initiator_ip": "10.0.90.9", "responder_ip": "10.0.90.215", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 208, "last_seen_epoch": "1552970839.815497", "responder_bytes": 0, "first_seen_epoch": "1552960833.568977" }, { "bytes": 1296, "stream": 36, "flow_id": "flow-6006caa46f0ee294e7ab8112", "packets": 6, "transport": "udp", "last_frame": 9930, "first_frame": 1964, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 138, "responder_port": 138, "initiator_bytes": 1296, "last_seen_epoch": "1552970841.844108", "responder_bytes": 0, "first_seen_epoch": "1552960833.569282" }, { "bytes": 244, "stream": 37, "flow_id": "flow-1d70c1034168faca65cc5321", "packets": 2, "transport": "udp", "last_frame": 1976, "first_frame": 1975, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 60460, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1552960839.946004", "responder_bytes": 162, "first_seen_epoch": "1552960839.945738" }, { "bytes": 227, "stream": 38, "flow_id": "flow-7282819ccdd13e54702195b3", "packets": 2, "transport": "udp", "last_frame": 1980, "first_frame": 1977, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 57167, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1552960839.954638", "responder_bytes": 151, "first_seen_epoch": "1552960839.946326" }, { "bytes": 128, "stream": 39, "flow_id": "flow-fa474d7aecdcc50458ca03d6", "packets": 2, "transport": "udp", "last_frame": 1983, "first_frame": 1981, "initiator_ip": "10.0.90.215", "responder_ip": "224.0.0.252", "initiator_port": 54293, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1552960840.051245", "responder_bytes": 0, "first_seen_epoch": "1552960839.955088" }, { "bytes": 248, "stream": 54, "flow_id": "flow-458e0dd37ae183caec062ad8", "packets": 4, "transport": "tcp", "last_frame": 2026, "first_frame": 1982, "initiator_ip": "10.0.90.215", "responder_ip": "109.230.231.176", "initiator_port": 49210, "responder_port": 443, "initiator_bytes": 194, "last_seen_epoch": "1552960915.187244", "responder_bytes": 54, "first_seen_epoch": "1552960839.958388" }, { "bytes": 248, "stream": 55, "flow_id": "flow-fd69aadb94dfa3016a812e7a", "packets": 4, "transport": "tcp", "last_frame": 2036, "first_frame": 2004, "initiator_ip": "10.0.90.215", "responder_ip": "109.230.231.176", "initiator_port": 49211, "responder_port": 443, "initiator_bytes": 194, "last_seen_epoch": "1552960936.228022", "responder_bytes": 54, "first_seen_epoch": "1552960860.987241" }, { "bytes": 168, "stream": 40, "flow_id": "flow-5c3c52e576793895f939a602", "packets": 2, "transport": "udp", "last_frame": 2006, "first_frame": 2005, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 59810, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1552960862.010975", "responder_bytes": 92, "first_seen_epoch": "1552960861.985463" }, { "bytes": 152, "stream": 41, "flow_id": "flow-25de06371f06b680880ea6b0", "packets": 2, "transport": "udp", "last_frame": 2008, "first_frame": 2007, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 62039, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1552960862.014785", "responder_bytes": 76, "first_seen_epoch": "1552960862.011541" }, { "bytes": 253, "stream": 42, "flow_id": "flow-3e7784070e45d4e2ee264c4a", "packets": 2, "transport": "udp", "last_frame": 2067, "first_frame": 2066, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 54068, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1552961003.770222", "responder_bytes": 176, "first_seen_epoch": "1552961003.744888" }, { "bytes": 1623, "stream": 56, "flow_id": "flow-95dbbf4fabadd75796c8b193", "packets": 8, "transport": "tcp", "last_frame": 2084, "first_frame": 2068, "initiator_ip": "10.0.90.215", "responder_ip": "173.205.6.202", "initiator_port": 49212, "responder_port": 80, "initiator_bytes": 509, "last_seen_epoch": "1552961004.546221", "responder_bytes": 1114, "first_seen_epoch": "1552961003.774019" }, { "bytes": 9598, "stream": 57, "flow_id": "flow-ee0a8dede498b6e62264ee38", "packets": 27, "transport": "tcp", "last_frame": 2102, "first_frame": 2075, "initiator_ip": "10.0.90.215", "responder_ip": "31.22.4.176", "initiator_port": 49213, "responder_port": 3389, "initiator_bytes": 7317, "last_seen_epoch": "1552961005.064277", "responder_bytes": 2281, "first_seen_epoch": "1552961004.038145" }, { "bytes": 669781, "stream": 58, "flow_id": "flow-463eaa8108332ca4af4f4369", "packets": 809, "transport": "tcp", "last_frame": 2914, "first_frame": 2103, "initiator_ip": "10.0.90.215", "responder_ip": "31.22.4.176", "initiator_port": 49214, "responder_port": 3389, "initiator_bytes": 20620, "last_seen_epoch": "1552961008.148759", "responder_bytes": 649161, "first_seen_epoch": "1552961006.066165" }, { "bytes": 2887, "stream": 59, "flow_id": "flow-a8d7d778a3690b3379b44d24", "packets": 17, "transport": "tcp", "last_frame": 2931, "first_frame": 2915, "initiator_ip": "10.0.90.215", "responder_ip": "31.22.4.176", "initiator_port": 49215, "responder_port": 3389, "initiator_bytes": 1180, "last_seen_epoch": "1552961009.958453", "responder_bytes": 1707, "first_seen_epoch": "1552961009.17048" }, { "bytes": 2887, "stream": 60, "flow_id": "flow-1f9843f74a15bb6a244a33e4", "packets": 17, "transport": "tcp", "last_frame": 2948, "first_frame": 2932, "initiator_ip": "10.0.90.215", "responder_ip": "31.22.4.176", "initiator_port": 49216, "responder_port": 3389, "initiator_bytes": 1180, "last_seen_epoch": "1552961015.493868", "responder_bytes": 1707, "first_seen_epoch": "1552961014.724225" }, { "bytes": 1540, "stream": 61, "flow_id": "flow-1e0e562553de1b32d38fe9b1", "packets": 9, "transport": "tcp", "last_frame": 3041, "first_frame": 3033, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49217, "responder_port": 443, "initiator_bytes": 766, "last_seen_epoch": "1552961296.457586", "responder_bytes": 774, "first_seen_epoch": "1552961296.002587" }, { "bytes": 4560, "stream": 62, "flow_id": "flow-b3154619ec60ab2d1a2b9235", "packets": 19, "transport": "tcp", "last_frame": 3068, "first_frame": 3045, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49218, "responder_port": 443, "initiator_bytes": 2365, "last_seen_epoch": "1552961301.774617", "responder_bytes": 2195, "first_seen_epoch": "1552961296.495481" }, { "bytes": 1789, "stream": 63, "flow_id": "flow-1aca76836d4c1409b3d3d136", "packets": 9, "transport": "tcp", "last_frame": 3077, "first_frame": 3069, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49219, "responder_port": 443, "initiator_bytes": 956, "last_seen_epoch": "1552961302.163925", "responder_bytes": 833, "first_seen_epoch": "1552961301.778254" }, { "bytes": 532143, "stream": 64, "flow_id": "flow-94835d4cabe4f4a7bf1a43af", "packets": 498, "transport": "tcp", "last_frame": 3578, "first_frame": 3078, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49220, "responder_port": 443, "initiator_bytes": 8058, "last_seen_epoch": "1552961308.092651", "responder_bytes": 524085, "first_seen_epoch": "1552961304.16921" }, { "bytes": 296050, "stream": 65, "flow_id": "flow-4069da80565995944a354f0a", "packets": 276, "transport": "tcp", "last_frame": 3854, "first_frame": 3579, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49221, "responder_port": 443, "initiator_bytes": 4386, "last_seen_epoch": "1552961314.516247", "responder_bytes": 291664, "first_seen_epoch": "1552961310.146846" }, { "bytes": 248301, "stream": 66, "flow_id": "flow-42813882613a40586cc430a8", "packets": 230, "transport": "tcp", "last_frame": 4087, "first_frame": 3855, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49222, "responder_port": 443, "initiator_bytes": 3490, "last_seen_epoch": "1552961319.299326", "responder_bytes": 244811, "first_seen_epoch": "1552961316.557795" }, { "bytes": 53724, "stream": 67, "flow_id": "flow-047f7ca28af7000fd6199abe", "packets": 57, "transport": "tcp", "last_frame": 4144, "first_frame": 4088, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49223, "responder_port": 443, "initiator_bytes": 1710, "last_seen_epoch": "1552961322.522326", "responder_bytes": 52014, "first_seen_epoch": "1552961321.33004" }, { "bytes": 899901, "stream": 68, "flow_id": "flow-5c146978a818287f2812b540", "packets": 1033, "transport": "tcp", "last_frame": 5186, "first_frame": 4145, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49224, "responder_port": 443, "initiator_bytes": 24809, "last_seen_epoch": "1552961357.168178", "responder_bytes": 875092, "first_seen_epoch": "1552961322.534445" }, { "bytes": 1657, "stream": 69, "flow_id": "flow-1ee14fa853412af27c3e95aa", "packets": 9, "transport": "tcp", "last_frame": 5198, "first_frame": 5190, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49225, "responder_port": 443, "initiator_bytes": 824, "last_seen_epoch": "1552961359.938042", "responder_bytes": 833, "first_seen_epoch": "1552961359.55133" }, { "bytes": 4121, "stream": 70, "flow_id": "flow-2f668a9464d33b8e844ad9d9", "packets": 17, "transport": "tcp", "last_frame": 5215, "first_frame": 5199, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49226, "responder_port": 443, "initiator_bytes": 1980, "last_seen_epoch": "1552961362.458837", "responder_bytes": 2141, "first_seen_epoch": "1552961359.941996" }, { "bytes": 21466, "stream": 71, "flow_id": "flow-8b3045621ed01599538db7f5", "packets": 222, "transport": "tcp", "last_frame": 13156, "first_frame": 5225, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49227, "responder_port": 445, "initiator_bytes": 13908, "last_seen_epoch": "1552972221.85329", "responder_bytes": 7558, "first_seen_epoch": "1552961397.029664" }, { "bytes": 1769, "stream": 72, "flow_id": "flow-86d7452eaad272ad4dae3ae4", "packets": 9, "transport": "tcp", "last_frame": 5277, "first_frame": 5269, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49228, "responder_port": 443, "initiator_bytes": 936, "last_seen_epoch": "1552961463.77662", "responder_bytes": 833, "first_seen_epoch": "1552961463.30227" }, { "bytes": 5174, "stream": 73, "flow_id": "flow-c5edfd7077a57a91fbd7c399", "packets": 21, "transport": "tcp", "last_frame": 5301, "first_frame": 5278, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49229, "responder_port": 443, "initiator_bytes": 2925, "last_seen_epoch": "1552961466.499803", "responder_bytes": 2249, "first_seen_epoch": "1552961463.782045" }, { "bytes": 1280, "stream": 74, "flow_id": "flow-213ab94b8574f1e4412296ff", "packets": 12, "transport": "tcp", "last_frame": 5352, "first_frame": 5305, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49230, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1552961507.5712", "responder_bytes": 562, "first_seen_epoch": "1552961469.41205" }, { "bytes": 6474, "stream": 75, "flow_id": "flow-19209ee76f6a72574ed5de79", "packets": 24, "transport": "tcp", "last_frame": 5348, "first_frame": 5312, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49231, "responder_port": 49155, "initiator_bytes": 4124, "last_seen_epoch": "1552961507.570129", "responder_bytes": 2350, "first_seen_epoch": "1552961469.414196" }, { "bytes": 6417, "stream": 76, "flow_id": "flow-6a526c3ad806e83da9689a61", "packets": 22, "transport": "tcp", "last_frame": 5435, "first_frame": 5409, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49232, "responder_port": 445, "initiator_bytes": 4701, "last_seen_epoch": "1552961706.736751", "responder_bytes": 1716, "first_seen_epoch": "1552961696.262587" }, { "bytes": 6417, "stream": 77, "flow_id": "flow-0b5a6ac706bd9c1384966ea2", "packets": 22, "transport": "tcp", "last_frame": 5744, "first_frame": 5720, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49233, "responder_port": 445, "initiator_bytes": 4701, "last_seen_epoch": "1552962606.734555", "responder_bytes": 1716, "first_seen_epoch": "1552962596.289849" }, { "bytes": 1447, "stream": 78, "flow_id": "flow-72a88ca01dad7bd1cd773b75", "packets": 9, "transport": "tcp", "last_frame": 5776, "first_frame": 5768, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49234, "responder_port": 443, "initiator_bytes": 614, "last_seen_epoch": "1552962675.064211", "responder_bytes": 833, "first_seen_epoch": "1552962674.674961" }, { "bytes": 560805, "stream": 79, "flow_id": "flow-76e05528ae38ec2e2be91710", "packets": 603, "transport": "tcp", "last_frame": 6385, "first_frame": 5777, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49235, "responder_port": 443, "initiator_bytes": 13345, "last_seen_epoch": "1552962696.660653", "responder_bytes": 547460, "first_seen_epoch": "1552962675.076251" }, { "bytes": 1753, "stream": 80, "flow_id": "flow-1da6e14750ce4e4eacb0bdef", "packets": 9, "transport": "tcp", "last_frame": 6394, "first_frame": 6386, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49236, "responder_port": 443, "initiator_bytes": 920, "last_seen_epoch": "1552962699.291216", "responder_bytes": 833, "first_seen_epoch": "1552962698.728728" }, { "bytes": 4682, "stream": 81, "flow_id": "flow-679179a5a6d0c8e73c0ee1c6", "packets": 19, "transport": "tcp", "last_frame": 6416, "first_frame": 6395, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49237, "responder_port": 443, "initiator_bytes": 2487, "last_seen_epoch": "1552962702.465921", "responder_bytes": 2195, "first_seen_epoch": "1552962699.296663" }, { "bytes": 1489, "stream": 82, "flow_id": "flow-27b239d409b6fead3126d5db", "packets": 9, "transport": "tcp", "last_frame": 6451, "first_frame": 6443, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49238, "responder_port": 443, "initiator_bytes": 656, "last_seen_epoch": "1552962782.123974", "responder_bytes": 833, "first_seen_epoch": "1552962781.736942" }, { "bytes": 5254, "stream": 83, "flow_id": "flow-156a215be2a09103d81a6f80", "packets": 21, "transport": "tcp", "last_frame": 6472, "first_frame": 6452, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49239, "responder_port": 443, "initiator_bytes": 3005, "last_seen_epoch": "1552962784.901951", "responder_bytes": 2249, "first_seen_epoch": "1552962782.129085" }, { "bytes": 6417, "stream": 84, "flow_id": "flow-c7184509720483c91dfef113", "packets": 22, "transport": "tcp", "last_frame": 6724, "first_frame": 6700, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49240, "responder_port": 445, "initiator_bytes": 4701, "last_seen_epoch": "1552963506.76027", "responder_bytes": 1716, "first_seen_epoch": "1552963496.333191" }, { "bytes": 1845, "stream": 85, "flow_id": "flow-c318db8500cb336b52770754", "packets": 9, "transport": "tcp", "last_frame": 6905, "first_frame": 6897, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49241, "responder_port": 443, "initiator_bytes": 1012, "last_seen_epoch": "1552964046.369588", "responder_bytes": 833, "first_seen_epoch": "1552964045.97996" }, { "bytes": 4394, "stream": 86, "flow_id": "flow-09244ae36f81470de03c409f", "packets": 19, "transport": "tcp", "last_frame": 6924, "first_frame": 6906, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49242, "responder_port": 443, "initiator_bytes": 2199, "last_seen_epoch": "1552964049.296173", "responder_bytes": 2195, "first_seen_epoch": "1552964046.378796" }, { "bytes": 202, "stream": 43, "flow_id": "flow-02641180021d0de38389ba78", "packets": 2, "transport": "udp", "last_frame": 7037, "first_frame": 7036, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 63956, "responder_port": 53, "initiator_bytes": 93, "last_seen_epoch": "1552964396.361774", "responder_bytes": 109, "first_seen_epoch": "1552964396.361279" }, { "bytes": 6417, "stream": 87, "flow_id": "flow-b7a3e7fa53ddc7a926052543", "packets": 22, "transport": "tcp", "last_frame": 7062, "first_frame": 7038, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49243, "responder_port": 445, "initiator_bytes": 4701, "last_seen_epoch": "1552964406.758084", "responder_bytes": 1716, "first_seen_epoch": "1552964396.364237" }, { "bytes": 1817, "stream": 88, "flow_id": "flow-df27ecb9c0171048b9024aa8", "packets": 9, "transport": "tcp", "last_frame": 7333, "first_frame": 7325, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49244, "responder_port": 443, "initiator_bytes": 984, "last_seen_epoch": "1552965224.793722", "responder_bytes": 833, "first_seen_epoch": "1552965224.404774" }, { "bytes": 4586, "stream": 89, "flow_id": "flow-a93920022963359d1140fab8", "packets": 19, "transport": "tcp", "last_frame": 7352, "first_frame": 7334, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49245, "responder_port": 443, "initiator_bytes": 2391, "last_seen_epoch": "1552965227.636631", "responder_bytes": 2195, "first_seen_epoch": "1552965224.80611" }, { "bytes": 6417, "stream": 90, "flow_id": "flow-21780d362eb9ba793eb812e7", "packets": 22, "transport": "tcp", "last_frame": 7400, "first_frame": 7376, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49246, "responder_port": 445, "initiator_bytes": 4701, "last_seen_epoch": "1552965306.753262", "responder_bytes": 1716, "first_seen_epoch": "1552965296.389822" }, { "bytes": 504, "stream": 44, "flow_id": "flow-3a2ed2f87d6b722e8e22ab90", "packets": 2, "transport": "udp", "last_frame": 7520, "first_frame": 7518, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 63957, "responder_port": 389, "initiator_bytes": 259, "last_seen_epoch": "1552965681.920323", "responder_bytes": 245, "first_seen_epoch": "1552965681.919932" }, { "bytes": 461, "stream": 45, "flow_id": "flow-11db99578cf68363cda4a6cd", "packets": 2, "transport": "udp", "last_frame": 7521, "first_frame": 7519, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 63958, "responder_port": 389, "initiator_bytes": 216, "last_seen_epoch": "1552965681.920492", "responder_bytes": 245, "first_seen_epoch": "1552965681.920237" }, { "bytes": 1824, "stream": 91, "flow_id": "flow-04ddef26afbef5b2d6aaff42", "packets": 14, "transport": "tcp", "last_frame": 7633, "first_frame": 7522, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49247, "responder_port": 135, "initiator_bytes": 940, "last_seen_epoch": "1552965696.924808", "responder_bytes": 884, "first_seen_epoch": "1552965682.030422" }, { "bytes": 3119, "stream": 92, "flow_id": "flow-62499dd39481a374860c1ad0", "packets": 12, "transport": "tcp", "last_frame": 7632, "first_frame": 7529, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49248, "responder_port": 49158, "initiator_bytes": 1677, "last_seen_epoch": "1552965696.924736", "responder_bytes": 1442, "first_seen_epoch": "1552965682.033165" }, { "bytes": 4997, "stream": 93, "flow_id": "flow-5a37af50581260accba85ff9", "packets": 20, "transport": "tcp", "last_frame": 7647, "first_frame": 7538, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49249, "responder_port": 49155, "initiator_bytes": 3386, "last_seen_epoch": "1552965716.92494", "responder_bytes": 1611, "first_seen_epoch": "1552965682.137436" }, { "bytes": 350, "stream": 46, "flow_id": "flow-14f03d2b8c79d68ab6c2ce2d", "packets": 2, "transport": "udp", "last_frame": 7557, "first_frame": 7556, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 64875, "responder_port": 53, "initiator_bytes": 135, "last_seen_epoch": "1552965682.544471", "responder_bytes": 215, "first_seen_epoch": "1552965682.544159" }, { "bytes": 288, "stream": 47, "flow_id": "flow-3d6592b5b55c2038cef780fd", "packets": 2, "transport": "udp", "last_frame": 7559, "first_frame": 7558, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 63011, "responder_port": 53, "initiator_bytes": 104, "last_seen_epoch": "1552965682.545422", "responder_bytes": 184, "first_seen_epoch": "1552965682.545206" }, { "bytes": 8170, "stream": 94, "flow_id": "flow-4642e2c1e58d96ef5b2dd8f8", "packets": 18, "transport": "tcp", "last_frame": 7617, "first_frame": 7560, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49250, "responder_port": 389, "initiator_bytes": 3384, "last_seen_epoch": "1552965683.200075", "responder_bytes": 4786, "first_seen_epoch": "1552965682.547388" }, { "bytes": 460, "stream": 48, "flow_id": "flow-3c393c953336641b761a6a80", "packets": 2, "transport": "udp", "last_frame": 7574, "first_frame": 7573, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 63012, "responder_port": 389, "initiator_bytes": 215, "last_seen_epoch": "1552965682.555787", "responder_bytes": 245, "first_seen_epoch": "1552965682.555565" }, { "bytes": 3437, "stream": 95, "flow_id": "flow-2153c25af6aa0ab315481a9d", "packets": 13, "transport": "tcp", "last_frame": 7613, "first_frame": 7575, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49251, "responder_port": 389, "initiator_bytes": 2579, "last_seen_epoch": "1552965682.686438", "responder_bytes": 858, "first_seen_epoch": "1552965682.667957" }, { "bytes": 9338, "stream": 96, "flow_id": "flow-d882f34b67324dd3b2d0a4c6", "packets": 36, "transport": "tcp", "last_frame": 7652, "first_frame": 7588, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49252, "responder_port": 445, "initiator_bytes": 6190, "last_seen_epoch": "1552965720.746978", "responder_bytes": 3148, "first_seen_epoch": "1552965682.676664" }, { "bytes": 1280, "stream": 97, "flow_id": "flow-3597269d5ac52ffef37aa53d", "packets": 12, "transport": "tcp", "last_frame": 7789, "first_frame": 7691, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49253, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1552965847.434434", "responder_bytes": 562, "first_seen_epoch": "1552965837.421623" }, { "bytes": 5037, "stream": 98, "flow_id": "flow-beb41d0a217d3c6c184b18c1", "packets": 20, "transport": "tcp", "last_frame": 7802, "first_frame": 7698, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49254, "responder_port": 49155, "initiator_bytes": 3410, "last_seen_epoch": "1552965867.434123", "responder_bytes": 1627, "first_seen_epoch": "1552965837.424236" }, { "bytes": 5220, "stream": 99, "flow_id": "flow-1278d80a8f0c56fdf5c76456", "packets": 14, "transport": "tcp", "last_frame": 7782, "first_frame": 7715, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49255, "responder_port": 389, "initiator_bytes": 2929, "last_seen_epoch": "1552965838.46575", "responder_bytes": 2291, "first_seen_epoch": "1552965837.936623" }, { "bytes": 3718, "stream": 100, "flow_id": "flow-7d8118409feb2077f4506e93", "packets": 12, "transport": "tcp", "last_frame": 7762, "first_frame": 7724, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49256, "responder_port": 88, "initiator_bytes": 1846, "last_seen_epoch": "1552965837.958976", "responder_bytes": 1872, "first_seen_epoch": "1552965837.947989" }, { "bytes": 3421, "stream": 101, "flow_id": "flow-e83851205409df345fc30a6d", "packets": 13, "transport": "tcp", "last_frame": 7778, "first_frame": 7730, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49257, "responder_port": 389, "initiator_bytes": 2563, "last_seen_epoch": "1552965837.960627", "responder_bytes": 858, "first_seen_epoch": "1552965837.948627" }, { "bytes": 7532, "stream": 102, "flow_id": "flow-2a3d9949d300d46299bd7f07", "packets": 27, "transport": "tcp", "last_frame": 7812, "first_frame": 7743, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49258, "responder_port": 445, "initiator_bytes": 5368, "last_seen_epoch": "1552965876.747487", "responder_bytes": 2164, "first_seen_epoch": "1552965837.955274" }, { "bytes": 3378, "stream": 103, "flow_id": "flow-03d524e00a675720b630ce9a", "packets": 10, "transport": "tcp", "last_frame": 7776, "first_frame": 7763, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49259, "responder_port": 88, "initiator_bytes": 2949, "last_seen_epoch": "1552965837.960318", "responder_bytes": 429, "first_seen_epoch": "1552965837.959142" }, { "bytes": 6417, "stream": 104, "flow_id": "flow-408540535723da9d5e3cb1a2", "packets": 22, "transport": "tcp", "last_frame": 7939, "first_frame": 7915, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49260, "responder_port": 445, "initiator_bytes": 4701, "last_seen_epoch": "1552966206.749541", "responder_bytes": 1716, "first_seen_epoch": "1552966196.418887" }, { "bytes": 1811, "stream": 105, "flow_id": "flow-24e36b997c37bc425972488f", "packets": 9, "transport": "tcp", "last_frame": 8053, "first_frame": 8045, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49261, "responder_port": 443, "initiator_bytes": 978, "last_seen_epoch": "1552966544.119304", "responder_bytes": 833, "first_seen_epoch": "1552966543.729853" }, { "bytes": 4522, "stream": 106, "flow_id": "flow-479c2e12e6361d0feb54ad0a", "packets": 19, "transport": "tcp", "last_frame": 8075, "first_frame": 8054, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49262, "responder_port": 443, "initiator_bytes": 2327, "last_seen_epoch": "1552966547.152442", "responder_bytes": 2195, "first_seen_epoch": "1552966544.130107" }, { "bytes": 604, "stream": 107, "flow_id": "flow-d1d4714f2e7009918559eee6", "packets": 11, "transport": "tcp", "last_frame": 8195, "first_frame": 8172, "initiator_ip": "10.0.90.9", "responder_ip": "10.0.90.215", "initiator_port": 135, "responder_port": 49206, "initiator_bytes": 604, "last_seen_epoch": "1552966864.087513", "responder_bytes": 0, "first_seen_epoch": "1552966854.055566" }, { "bytes": 604, "stream": 108, "flow_id": "flow-7c1d3b7e0383595824615455", "packets": 11, "transport": "tcp", "last_frame": 8196, "first_frame": 8173, "initiator_ip": "10.0.90.9", "responder_ip": "10.0.90.215", "initiator_port": 49155, "responder_port": 49207, "initiator_bytes": 604, "last_seen_epoch": "1552966864.087613", "responder_bytes": 0, "first_seen_epoch": "1552966854.055655" }, { "bytes": 6417, "stream": 109, "flow_id": "flow-ae7e7384f3f49b2b2f1223d2", "packets": 22, "transport": "tcp", "last_frame": 8299, "first_frame": 8272, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49263, "responder_port": 445, "initiator_bytes": 4701, "last_seen_epoch": "1552967106.746466", "responder_bytes": 1716, "first_seen_epoch": "1552967096.445883" }, { "bytes": 1845, "stream": 110, "flow_id": "flow-936b270751bb476943191b3e", "packets": 9, "transport": "tcp", "last_frame": 8457, "first_frame": 8449, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49264, "responder_port": 443, "initiator_bytes": 1012, "last_seen_epoch": "1552967583.902639", "responder_bytes": 833, "first_seen_epoch": "1552967583.361847" }, { "bytes": 4634, "stream": 111, "flow_id": "flow-525aedb960a708930fc4a461", "packets": 19, "transport": "tcp", "last_frame": 8476, "first_frame": 8458, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49265, "responder_port": 443, "initiator_bytes": 2439, "last_seen_epoch": "1552967586.854012", "responder_bytes": 2195, "first_seen_epoch": "1552967583.918697" }, { "bytes": 202, "stream": 49, "flow_id": "flow-4c3c8f7dcf03905b600119c8", "packets": 2, "transport": "udp", "last_frame": 8607, "first_frame": 8606, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 59972, "responder_port": 53, "initiator_bytes": 93, "last_seen_epoch": "1552967996.474098", "responder_bytes": 109, "first_seen_epoch": "1552967996.473551" }, { "bytes": 6417, "stream": 112, "flow_id": "flow-42240357094237d67d92426d", "packets": 22, "transport": "tcp", "last_frame": 8632, "first_frame": 8608, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49266, "responder_port": 445, "initiator_bytes": 4701, "last_seen_epoch": "1552968006.758486", "responder_bytes": 1716, "first_seen_epoch": "1552967996.475754" }, { "bytes": 1673, "stream": 113, "flow_id": "flow-d4d314f6b37ebc6df1bf3beb", "packets": 9, "transport": "tcp", "last_frame": 8906, "first_frame": 8898, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49267, "responder_port": 443, "initiator_bytes": 840, "last_seen_epoch": "1552968837.602942", "responder_bytes": 833, "first_seen_epoch": "1552968837.21472" }, { "bytes": 4217, "stream": 114, "flow_id": "flow-d01005df22714c91df753584", "packets": 17, "transport": "tcp", "last_frame": 8926, "first_frame": 8907, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49268, "responder_port": 443, "initiator_bytes": 1964, "last_seen_epoch": "1552968840.203329", "responder_bytes": 2253, "first_seen_epoch": "1552968837.615555" }, { "bytes": 6417, "stream": 115, "flow_id": "flow-5483f93767b09bec9ef2d3e3", "packets": 22, "transport": "tcp", "last_frame": 8968, "first_frame": 8944, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49269, "responder_port": 445, "initiator_bytes": 4701, "last_seen_epoch": "1552968906.755959", "responder_bytes": 1716, "first_seen_epoch": "1552968896.50022" }, { "bytes": 6417, "stream": 116, "flow_id": "flow-ec023e10ee5b5ab9097f0a6b", "packets": 22, "transport": "tcp", "last_frame": 9276, "first_frame": 9252, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49270, "responder_port": 445, "initiator_bytes": 4701, "last_seen_epoch": "1552969806.753021", "responder_bytes": 1716, "first_seen_epoch": "1552969796.530974" }, { "bytes": 1449, "stream": 117, "flow_id": "flow-ddc37cbe6fcb3d83c412dcc3", "packets": 9, "transport": "tcp", "last_frame": 9314, "first_frame": 9303, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49271, "responder_port": 443, "initiator_bytes": 616, "last_seen_epoch": "1552969891.413632", "responder_bytes": 833, "first_seen_epoch": "1552969890.935007" }, { "bytes": 4522, "stream": 118, "flow_id": "flow-9e392f565ecf4dc56bcfa9cc", "packets": 19, "transport": "tcp", "last_frame": 9333, "first_frame": 9315, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49272, "responder_port": 443, "initiator_bytes": 2327, "last_seen_epoch": "1552969894.358179", "responder_bytes": 2195, "first_seen_epoch": "1552969891.428053" }, { "bytes": 6417, "stream": 119, "flow_id": "flow-f968d8dc8074e8a0a7e32e1f", "packets": 22, "transport": "tcp", "last_frame": 9857, "first_frame": 9833, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49273, "responder_port": 445, "initiator_bytes": 4701, "last_seen_epoch": "1552970706.748751", "responder_bytes": 1716, "first_seen_epoch": "1552970696.557156" }, { "bytes": 504, "stream": 50, "flow_id": "flow-8d3cfebb7e3807c8e1b4a5bc", "packets": 2, "transport": "udp", "last_frame": 9900, "first_frame": 9899, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 59973, "responder_port": 389, "initiator_bytes": 259, "last_seen_epoch": "1552970839.554729", "responder_bytes": 245, "first_seen_epoch": "1552970839.554431" }, { "bytes": 1280, "stream": 120, "flow_id": "flow-837c3309fdcd907549e7a4c7", "packets": 12, "transport": "tcp", "last_frame": 9957, "first_frame": 9901, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49274, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1552970849.676691", "responder_bytes": 562, "first_seen_epoch": "1552970839.662321" }, { "bytes": 1631, "stream": 121, "flow_id": "flow-96ca25b4eb36e7ef5f13e07c", "packets": 12, "transport": "tcp", "last_frame": 9955, "first_frame": 9908, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49275, "responder_port": 49155, "initiator_bytes": 877, "last_seen_epoch": "1552970849.676412", "responder_bytes": 754, "first_seen_epoch": "1552970839.664618" }, { "bytes": 164, "stream": 51, "flow_id": "flow-21b3b653e6c0547d14e74ddb", "packets": 2, "transport": "udp", "last_frame": 9916, "first_frame": 9915, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 59974, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1552970839.763635", "responder_bytes": 82, "first_seen_epoch": "1552970839.756274" }, { "bytes": 270, "stream": 52, "flow_id": "flow-2f7af4edcf44ca097d6e2809", "packets": 2, "transport": "udp", "last_frame": 9918, "first_frame": 9917, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 59975, "responder_port": 53, "initiator_bytes": 95, "last_seen_epoch": "1552970839.764461", "responder_bytes": 175, "first_seen_epoch": "1552970839.764241" }, { "bytes": 263, "stream": 53, "flow_id": "flow-c09c3cfae5d5eda776dc4cb5", "packets": 2, "transport": "udp", "last_frame": 9920, "first_frame": 9919, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 59976, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1552970839.765126", "responder_bytes": 186, "first_seen_epoch": "1552970839.764925" }, { "bytes": 244, "stream": 54, "flow_id": "flow-503eeab9b51669a2709493a9", "packets": 2, "transport": "udp", "last_frame": 9935, "first_frame": 9934, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 51938, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1552970846.190869", "responder_bytes": 162, "first_seen_epoch": "1552970846.190608" }, { "bytes": 227, "stream": 55, "flow_id": "flow-902ee9bda8680ca7badb79d4", "packets": 2, "transport": "udp", "last_frame": 9939, "first_frame": 9936, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 60859, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1552970846.197493", "responder_bytes": 151, "first_seen_epoch": "1552970846.191269" }, { "bytes": 248, "stream": 122, "flow_id": "flow-57f7be2abc6788e7ce95e0bd", "packets": 4, "transport": "tcp", "last_frame": 9985, "first_frame": 9940, "initiator_ip": "10.0.90.215", "responder_ip": "109.230.231.176", "initiator_port": 49276, "responder_port": 443, "initiator_bytes": 194, "last_seen_epoch": "1552970921.42383", "responder_bytes": 54, "first_seen_epoch": "1552970846.197644" }, { "bytes": 128, "stream": 56, "flow_id": "flow-3ab99d4261c250a2576790e4", "packets": 2, "transport": "udp", "last_frame": 9945, "first_frame": 9941, "initiator_ip": "10.0.90.215", "responder_ip": "224.0.0.252", "initiator_port": 56723, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1552970846.304934", "responder_bytes": 0, "first_seen_epoch": "1552970846.19823" }, { "bytes": 248, "stream": 123, "flow_id": "flow-3109e6f2049f0dd520dbb349", "packets": 4, "transport": "tcp", "last_frame": 9992, "first_frame": 9965, "initiator_ip": "10.0.90.215", "responder_ip": "109.230.231.176", "initiator_port": 49277, "responder_port": 443, "initiator_bytes": 194, "last_seen_epoch": "1552970942.428014", "responder_bytes": 54, "first_seen_epoch": "1552970867.227225" }, { "bytes": 9598, "stream": 124, "flow_id": "flow-a480cb07e9321426429929a4", "packets": 27, "transport": "tcp", "last_frame": 10040, "first_frame": 10014, "initiator_ip": "10.0.90.215", "responder_ip": "31.22.4.176", "initiator_port": 49278, "responder_port": 3389, "initiator_bytes": 7317, "last_seen_epoch": "1552971011.281498", "responder_bytes": 2281, "first_seen_epoch": "1552971010.277649" }, { "bytes": 670213, "stream": 125, "flow_id": "flow-6edbee532c655521281be5a9", "packets": 817, "transport": "tcp", "last_frame": 10857, "first_frame": 10041, "initiator_ip": "10.0.90.215", "responder_ip": "31.22.4.176", "initiator_port": 49279, "responder_port": 3389, "initiator_bytes": 20998, "last_seen_epoch": "1552971014.614971", "responder_bytes": 649215, "first_seen_epoch": "1552971012.290243" }, { "bytes": 2887, "stream": 126, "flow_id": "flow-4fb47a1533eac13127dfb2ef", "packets": 17, "transport": "tcp", "last_frame": 10877, "first_frame": 10858, "initiator_ip": "10.0.90.215", "responder_ip": "31.22.4.176", "initiator_port": 49280, "responder_port": 3389, "initiator_bytes": 1180, "last_seen_epoch": "1552971016.427291", "responder_bytes": 1707, "first_seen_epoch": "1552971015.645675" }, { "bytes": 2887, "stream": 127, "flow_id": "flow-07fbf0f49bf6156f4c7b1758", "packets": 17, "transport": "tcp", "last_frame": 10894, "first_frame": 10878, "initiator_ip": "10.0.90.215", "responder_ip": "31.22.4.176", "initiator_port": 49281, "responder_port": 3389, "initiator_bytes": 1180, "last_seen_epoch": "1552971022.016159", "responder_bytes": 1707, "first_seen_epoch": "1552971021.198814" }, { "bytes": 1504, "stream": 128, "flow_id": "flow-d7654ee4c661038fbc055779", "packets": 9, "transport": "tcp", "last_frame": 10973, "first_frame": 10965, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49282, "responder_port": 443, "initiator_bytes": 730, "last_seen_epoch": "1552971245.337916", "responder_bytes": 774, "first_seen_epoch": "1552971244.952593" }, { "bytes": 473, "stream": 129, "flow_id": "flow-b852e70db3aa9caf410c09af", "packets": 6, "transport": "tcp", "last_frame": 10982, "first_frame": 10977, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49283, "responder_port": 443, "initiator_bytes": 307, "last_seen_epoch": "1552971245.894995", "responder_bytes": 166, "first_seen_epoch": "1552971245.37138" }, { "bytes": 574, "stream": 130, "flow_id": "flow-a3b17cc177f5d9b1b05bf3d1", "packets": 9, "transport": "tcp", "last_frame": 10992, "first_frame": 10983, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49284, "responder_port": 443, "initiator_bytes": 354, "last_seen_epoch": "1552971246.407398", "responder_bytes": 220, "first_seen_epoch": "1552971245.89591" }, { "bytes": 550, "stream": 131, "flow_id": "flow-4c74a9ab9a2f6adce0e3b0a5", "packets": 9, "transport": "tcp", "last_frame": 11004, "first_frame": 10993, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49285, "responder_port": 443, "initiator_bytes": 330, "last_seen_epoch": "1552971246.789552", "responder_bytes": 220, "first_seen_epoch": "1552971246.408067" }, { "bytes": 538, "stream": 132, "flow_id": "flow-3ba85233e3ae52b6158a7d22", "packets": 9, "transport": "tcp", "last_frame": 11014, "first_frame": 11005, "initiator_ip": "10.0.90.215", "responder_ip": "203.45.1.75", "initiator_port": 49286, "responder_port": 443, "initiator_bytes": 318, "last_seen_epoch": "1552971247.329812", "responder_bytes": 220, "first_seen_epoch": "1552971246.79005" }, { "bytes": 248, "stream": 133, "flow_id": "flow-50ef4cf3f3161065c8b0d986", "packets": 4, "transport": "tcp", "last_frame": 12562, "first_frame": 11015, "initiator_ip": "10.0.90.215", "responder_ip": "189.189.64.242", "initiator_port": 49287, "responder_port": 443, "initiator_bytes": 194, "last_seen_epoch": "1552971324.749904", "responder_bytes": 54, "first_seen_epoch": "1552971249.33712" }, { "bytes": 168, "stream": 57, "flow_id": "flow-7450638627ac3c1d525927bb", "packets": 2, "transport": "udp", "last_frame": 11025, "first_frame": 11024, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 59497, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1552971272.025011", "responder_bytes": 92, "first_seen_epoch": "1552971272.000839" }, { "bytes": 152, "stream": 58, "flow_id": "flow-9bdb611245d15cddfd692c3f", "packets": 2, "transport": "udp", "last_frame": 11027, "first_frame": 11026, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 51962, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1552971272.029527", "responder_bytes": 76, "first_seen_epoch": "1552971272.025596" }, { "bytes": 1442, "stream": 134, "flow_id": "flow-fce55b9f6eacf017cc7cc2b6", "packets": 9, "transport": "tcp", "last_frame": 11038, "first_frame": 11030, "initiator_ip": "10.0.90.215", "responder_ip": "115.112.43.81", "initiator_port": 49288, "responder_port": 443, "initiator_bytes": 668, "last_seen_epoch": "1552971273.135462", "responder_bytes": 774, "first_seen_epoch": "1552971272.393421" }, { "bytes": 4988, "stream": 135, "flow_id": "flow-557d83abd5ab9b6c7301c683", "packets": 21, "transport": "tcp", "last_frame": 11059, "first_frame": 11039, "initiator_ip": "10.0.90.215", "responder_ip": "115.112.43.81", "initiator_port": 49289, "responder_port": 443, "initiator_bytes": 2739, "last_seen_epoch": "1552971275.637882", "responder_bytes": 2249, "first_seen_epoch": "1552971273.153177" }, { "bytes": 1443, "stream": 136, "flow_id": "flow-baff6b4b79050cf537b70a6b", "packets": 9, "transport": "tcp", "last_frame": 11068, "first_frame": 11060, "initiator_ip": "10.0.90.215", "responder_ip": "115.112.43.81", "initiator_port": 49290, "responder_port": 443, "initiator_bytes": 610, "last_seen_epoch": "1552971276.309803", "responder_bytes": 833, "first_seen_epoch": "1552971275.642836" }, { "bytes": 533813, "stream": 137, "flow_id": "flow-d03ffb6a8ebf582f9b32c870", "packets": 524, "transport": "tcp", "last_frame": 11595, "first_frame": 11072, "initiator_ip": "10.0.90.215", "responder_ip": "115.112.43.81", "initiator_port": 49291, "responder_port": 443, "initiator_bytes": 9456, "last_seen_epoch": "1552971282.387961", "responder_bytes": 524357, "first_seen_epoch": "1552971278.320184" }, { "bytes": 296405, "stream": 138, "flow_id": "flow-096e2c0da2674b247d52bb01", "packets": 284, "transport": "tcp", "last_frame": 11882, "first_frame": 11596, "initiator_ip": "10.0.90.215", "responder_ip": "115.112.43.81", "initiator_port": 49292, "responder_port": 443, "initiator_bytes": 4686, "last_seen_epoch": "1552971287.743336", "responder_bytes": 291719, "first_seen_epoch": "1552971284.436459" }, { "bytes": 249135, "stream": 139, "flow_id": "flow-f26a46eb9aa5f5d9b79f628d", "packets": 245, "transport": "tcp", "last_frame": 12127, "first_frame": 11883, "initiator_ip": "10.0.90.215", "responder_ip": "115.112.43.81", "initiator_port": 49293, "responder_port": 443, "initiator_bytes": 4540, "last_seen_epoch": "1552971292.547942", "responder_bytes": 244595, "first_seen_epoch": "1552971289.770092" }, { "bytes": 53540, "stream": 140, "flow_id": "flow-5010e188ce1b9b218feac742", "packets": 53, "transport": "tcp", "last_frame": 12183, "first_frame": 12128, "initiator_ip": "10.0.90.215", "responder_ip": "115.112.43.81", "initiator_port": 49294, "responder_port": 443, "initiator_bytes": 1364, "last_seen_epoch": "1552971296.589746", "responder_bytes": 52176, "first_seen_epoch": "1552971294.57647" }, { "bytes": 336665, "stream": 141, "flow_id": "flow-efbd7f936257aca17e4c5744", "packets": 323, "transport": "tcp", "last_frame": 12509, "first_frame": 12184, "initiator_ip": "10.0.90.215", "responder_ip": "115.112.43.81", "initiator_port": 49295, "responder_port": 443, "initiator_bytes": 7129, "last_seen_epoch": "1552971310.00273", "responder_bytes": 329536, "first_seen_epoch": "1552971296.598503" }, { "bytes": 5152, "stream": 142, "flow_id": "flow-deacdf4e3cef1035183445a9", "packets": 21, "transport": "tcp", "last_frame": 12530, "first_frame": 12510, "initiator_ip": "10.0.90.215", "responder_ip": "46.105.131.77", "initiator_port": 49296, "responder_port": 443, "initiator_bytes": 2819, "last_seen_epoch": "1552971311.19119", "responder_bytes": 2333, "first_seen_epoch": "1552971310.312942" }, { "bytes": 1713, "stream": 143, "flow_id": "flow-9ed1fa4ea7c6d58db94e838f", "packets": 9, "transport": "tcp", "last_frame": 12539, "first_frame": 12531, "initiator_ip": "10.0.90.215", "responder_ip": "115.112.43.81", "initiator_port": 49297, "responder_port": 443, "initiator_bytes": 880, "last_seen_epoch": "1552971312.971349", "responder_bytes": 833, "first_seen_epoch": "1552971312.266171" }, { "bytes": 4314, "stream": 144, "flow_id": "flow-4b45070136c1748fe84d68eb", "packets": 19, "transport": "tcp", "last_frame": 12558, "first_frame": 12540, "initiator_ip": "10.0.90.215", "responder_ip": "115.112.43.81", "initiator_port": 49298, "responder_port": 443, "initiator_bytes": 2119, "last_seen_epoch": "1552971315.485718", "responder_bytes": 2195, "first_seen_epoch": "1552971312.976179" }, { "bytes": 461, "stream": 59, "flow_id": "flow-76f2a82de77052435725b1eb", "packets": 2, "transport": "udp", "last_frame": 12604, "first_frame": 12601, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 51963, "responder_port": 389, "initiator_bytes": 216, "last_seen_epoch": "1552971443.212574", "responder_bytes": 245, "first_seen_epoch": "1552971443.212131" }, { "bytes": 1824, "stream": 145, "flow_id": "flow-c27258f3f45e664c9f2b7476", "packets": 14, "transport": "tcp", "last_frame": 12715, "first_frame": 12602, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49299, "responder_port": 135, "initiator_bytes": 940, "last_seen_epoch": "1552971458.217389", "responder_bytes": 884, "first_seen_epoch": "1552971443.212222" }, { "bytes": 3119, "stream": 146, "flow_id": "flow-2542aeaeef1aedb8af836672", "packets": 12, "transport": "tcp", "last_frame": 12705, "first_frame": 12610, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49300, "responder_port": 49158, "initiator_bytes": 1677, "last_seen_epoch": "1552971453.225528", "responder_bytes": 1442, "first_seen_epoch": "1552971443.214178" }, { "bytes": 4997, "stream": 147, "flow_id": "flow-7882accc878166ef29e0ea78", "packets": 20, "transport": "tcp", "last_frame": 12728, "first_frame": 12619, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49301, "responder_port": 49155, "initiator_bytes": 3386, "last_seen_epoch": "1552971478.216806", "responder_bytes": 1611, "first_seen_epoch": "1552971443.319647" }, { "bytes": 350, "stream": 60, "flow_id": "flow-0abf370bda65f22c46c299cc", "packets": 2, "transport": "udp", "last_frame": 12638, "first_frame": 12637, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 55354, "responder_port": 53, "initiator_bytes": 135, "last_seen_epoch": "1552971443.728531", "responder_bytes": 215, "first_seen_epoch": "1552971443.728199" }, { "bytes": 288, "stream": 61, "flow_id": "flow-1a878bed42bfa306ff3af424", "packets": 2, "transport": "udp", "last_frame": 12640, "first_frame": 12639, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 61628, "responder_port": 53, "initiator_bytes": 104, "last_seen_epoch": "1552971443.729319", "responder_bytes": 184, "first_seen_epoch": "1552971443.72914" }, { "bytes": 8170, "stream": 148, "flow_id": "flow-856f3a87ab9ed9e7ff026436", "packets": 18, "transport": "tcp", "last_frame": 12698, "first_frame": 12641, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49302, "responder_port": 389, "initiator_bytes": 3384, "last_seen_epoch": "1552971444.382825", "responder_bytes": 4786, "first_seen_epoch": "1552971443.731301" }, { "bytes": 460, "stream": 62, "flow_id": "flow-36e08916dde947c2dbb6f9dc", "packets": 2, "transport": "udp", "last_frame": 12655, "first_frame": 12654, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 61629, "responder_port": 389, "initiator_bytes": 215, "last_seen_epoch": "1552971443.739411", "responder_bytes": 245, "first_seen_epoch": "1552971443.739193" }, { "bytes": 3437, "stream": 149, "flow_id": "flow-58f930d9d7d66897fcbd666e", "packets": 13, "transport": "tcp", "last_frame": 12694, "first_frame": 12656, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49303, "responder_port": 389, "initiator_bytes": 2579, "last_seen_epoch": "1552971443.865498", "responder_bytes": 858, "first_seen_epoch": "1552971443.849079" }, { "bytes": 9338, "stream": 150, "flow_id": "flow-f5d12662d26f23961bf08aa4", "packets": 36, "transport": "tcp", "last_frame": 12733, "first_frame": 12669, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49304, "responder_port": 445, "initiator_bytes": 6190, "last_seen_epoch": "1552971480.760264", "responder_bytes": 3148, "first_seen_epoch": "1552971443.85774" }, { "bytes": 1280, "stream": 151, "flow_id": "flow-ec08b2b4b7afade014d7848f", "packets": 12, "transport": "tcp", "last_frame": 12834, "first_frame": 12769, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49305, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1552971610.613853", "responder_bytes": 562, "first_seen_epoch": "1552971595.62472" }, { "bytes": 4917, "stream": 152, "flow_id": "flow-0180797a8bf0fd1df762341c", "packets": 20, "transport": "tcp", "last_frame": 12844, "first_frame": 12776, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49306, "responder_port": 49155, "initiator_bytes": 3386, "last_seen_epoch": "1552971630.627719", "responder_bytes": 1531, "first_seen_epoch": "1552971595.631563" }, { "bytes": 202, "stream": 63, "flow_id": "flow-c03a0be4d3b670ef398471e5", "packets": 2, "transport": "udp", "last_frame": 12799, "first_frame": 12798, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 50182, "responder_port": 53, "initiator_bytes": 93, "last_seen_epoch": "1552971596.580063", "responder_bytes": 109, "first_seen_epoch": "1552971596.579796" }, { "bytes": 6417, "stream": 153, "flow_id": "flow-d3fb6f972e428ea6cede0f59", "packets": 22, "transport": "tcp", "last_frame": 12826, "first_frame": 12800, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49307, "responder_port": 445, "initiator_bytes": 4701, "last_seen_epoch": "1552971606.747278", "responder_bytes": 1716, "first_seen_epoch": "1552971596.582094" }, { "bytes": 1280, "stream": 154, "flow_id": "flow-4451d33cc4c34cccfaae0650", "packets": 12, "transport": "tcp", "last_frame": 12999, "first_frame": 12895, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49308, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1552971788.504984", "responder_bytes": 562, "first_seen_epoch": "1552971778.497103" }, { "bytes": 5037, "stream": 155, "flow_id": "flow-1cc7d51a298387aa9d94ab1e", "packets": 20, "transport": "tcp", "last_frame": 13012, "first_frame": 12902, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49309, "responder_port": 49155, "initiator_bytes": 3410, "last_seen_epoch": "1552971808.504262", "responder_bytes": 1627, "first_seen_epoch": "1552971778.499168" }, { "bytes": 5328, "stream": 156, "flow_id": "flow-8d368e4c7c1eee798f33a3d4", "packets": 16, "transport": "tcp", "last_frame": 12992, "first_frame": 12919, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49310, "responder_port": 389, "initiator_bytes": 2983, "last_seen_epoch": "1552971779.64785", "responder_bytes": 2345, "first_seen_epoch": "1552971779.010492" }, { "bytes": 504, "stream": 64, "flow_id": "flow-c4cb156bbf1c5a86142e2561", "packets": 2, "transport": "udp", "last_frame": 12927, "first_frame": 12926, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 50183, "responder_port": 389, "initiator_bytes": 259, "last_seen_epoch": "1552971779.017387", "responder_bytes": 245, "first_seen_epoch": "1552971779.017168" }, { "bytes": 3529, "stream": 157, "flow_id": "flow-180bf8b248e75427acbae719", "packets": 15, "transport": "tcp", "last_frame": 12986, "first_frame": 12930, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49311, "responder_port": 389, "initiator_bytes": 2617, "last_seen_epoch": "1552971779.132901", "responder_bytes": 912, "first_seen_epoch": "1552971779.119834" }, { "bytes": 7532, "stream": 158, "flow_id": "flow-d1d5002ffa3845021e645258", "packets": 27, "transport": "tcp", "last_frame": 13017, "first_frame": 12943, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49312, "responder_port": 445, "initiator_bytes": 5368, "last_seen_epoch": "1552971816.757894", "responder_bytes": 2164, "first_seen_epoch": "1552971779.126518" }, { "bytes": 3718, "stream": 159, "flow_id": "flow-060ff67ecae5b8678b58ed45", "packets": 12, "transport": "tcp", "last_frame": 12970, "first_frame": 12954, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49313, "responder_port": 88, "initiator_bytes": 1846, "last_seen_epoch": "1552971779.131442", "responder_bytes": 1872, "first_seen_epoch": "1552971779.129108" }, { "bytes": 3378, "stream": 160, "flow_id": "flow-6e4bdfd96f698504966f258e", "packets": 10, "transport": "tcp", "last_frame": 12983, "first_frame": 12971, "initiator_ip": "10.0.90.215", "responder_ip": "10.0.90.9", "initiator_port": 49314, "responder_port": 88, "initiator_bytes": 2949, "last_seen_epoch": "1552971779.132715", "responder_bytes": 429, "first_seen_epoch": "1552971779.131458" } ], "events": { "dns": [ { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.littletigers.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-9bd9ffaface1c39b346d572d", "src_port": 63262, "tcp_stream": null, "udp_stream": 1, "frame_number": 3, "timestamp_epoch": "1552959895.654616000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.a": "10.0.90.9", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.littletigers.info", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 63262, "event_id": "evt-b98ede2578428a3c0468cfcb", "src_port": 53, "tcp_stream": null, "udp_stream": 1, "frame_number": 4, "timestamp_epoch": "1552959895.655060000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "littletigers-dc.littletigers.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-c6ca4326426ac8656360ecb7", "src_port": 55332, "tcp_stream": null, "udp_stream": 2, "frame_number": 5, "timestamp_epoch": "1552959895.657290000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.a": "10.0.90.9", "dns.qry.name": "littletigers-dc.littletigers.info", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 55332, "event_id": "evt-15237eb657e57248c5ff7577", "src_port": 53, "tcp_stream": null, "udp_stream": 2, "frame_number": 6, "timestamp_epoch": "1552959895.657459000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.littletigers.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-c7a2e83bf8140804f99139fb", "src_port": 53248, "tcp_stream": null, "udp_stream": 5, "frame_number": 133, "timestamp_epoch": "1552959895.853591000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.a": "10.0.90.9", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.littletigers.info", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 53248, "event_id": "evt-de58aa1e157ff737ed4bb4e9", "src_port": 53, "tcp_stream": null, "udp_stream": 5, "frame_number": 134, "timestamp_epoch": "1552959895.853768000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.littletigers.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-5fa611f2e59726406e820b7d", "src_port": 64687, "tcp_stream": null, "udp_stream": 7, "frame_number": 141, "timestamp_epoch": "1552959895.922339000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.a": "10.0.90.9", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.littletigers.info", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 64687, "event_id": "evt-f31bd02e904206063b89a14d", "src_port": 53, "tcp_stream": null, "udp_stream": 7, "frame_number": 142, "timestamp_epoch": "1552959895.922616000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.littletigers.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-c8881ee557a86cf2abe74d40", "src_port": 59191, "tcp_stream": null, "udp_stream": 9, "frame_number": 153, "timestamp_epoch": "1552959895.961795000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.a": "10.0.90.9", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.littletigers.info", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 59191, "event_id": "evt-d669ebbe8bdcd9d9f60f82cd", "src_port": 53, "tcp_stream": null, "udp_stream": 9, "frame_number": 154, "timestamp_epoch": "1552959895.962000000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.LittleTigers-DC.littletigers.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-5fc8537ceaeb4d9e72e4a499", "src_port": 54918, "tcp_stream": null, "udp_stream": 11, "frame_number": 257, "timestamp_epoch": "1552959896.984928000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.LittleTigers-DC.littletigers.info", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 54918, "event_id": "evt-c445f659c9810d6d85047289", "src_port": 53, "tcp_stream": null, "udp_stream": 11, "frame_number": 258, "timestamp_epoch": "1552959896.985217000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.LittleTigers-DC.littletigers.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-5daf6e848d0dc9be27d30f12", "src_port": 50104, "tcp_stream": null, "udp_stream": 12, "frame_number": 259, "timestamp_epoch": "1552959896.985653000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.qry.name": "_ldap._tcp.LittleTigers-DC.littletigers.info", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 50104, "event_id": "evt-76e227dc2aad187221602ecb", "src_port": 53, "tcp_stream": null, "udp_stream": 12, "frame_number": 260, "timestamp_epoch": "1552959896.985821000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "wpad.littletigers.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-9049360996ea63326d759981", "src_port": 56860, "tcp_stream": null, "udp_stream": 16, "frame_number": 386, "timestamp_epoch": "1552959898.685117000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.qry.name": "wpad.littletigers.info", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 56860, "event_id": "evt-8779c3c737c9c59d456f7ae3", "src_port": 53, "tcp_stream": null, "udp_stream": 16, "frame_number": 387, "timestamp_epoch": "1552959898.685365000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "LittleTigers-DC.littletigers.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-ead5de43efe9fa54a5a973dd", "src_port": 56185, "tcp_stream": null, "udp_stream": 18, "frame_number": 393, "timestamp_epoch": "1552959899.178940000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.a": "10.0.90.9", "dns.qry.name": "LittleTigers-DC.littletigers.info", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 56185, "event_id": "evt-a438dab0337c54a7b864f481", "src_port": 53, "tcp_stream": null, "udp_stream": 18, "frame_number": 394, "timestamp_epoch": "1552959899.179202000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "isatap.littletigers.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-a0ae1666c8b23696816b433d", "src_port": 53832, "tcp_stream": null, "udp_stream": 19, "frame_number": 395, "timestamp_epoch": "1552959899.185167000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.qry.name": "isatap.littletigers.info", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 53832, "event_id": "evt-bcd1f889744b2efa8c24c9fd", "src_port": 53, "tcp_stream": null, "udp_stream": 19, "frame_number": 396, "timestamp_epoch": "1552959899.185384000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "isatap.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-5e5b68d90603ac1efcb4ddc9", "src_port": 63108, "tcp_stream": null, "udp_stream": 20, "frame_number": 397, "timestamp_epoch": "1552959899.318803000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.qry.name": "isatap.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 63108, "event_id": "evt-e7343e9322e2e8ec134b9691", "src_port": 53, "tcp_stream": null, "udp_stream": 20, "frame_number": 398, "timestamp_epoch": "1552959899.319065000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "www.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-8dd1b82910ba4baa0f494ef3", "src_port": 61100, "tcp_stream": null, "udp_stream": 22, "frame_number": 403, "timestamp_epoch": "1552959901.255609000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.a": "209.121.139.185,209.121.139.187", "dns.cname": "www.msftncsi.com.edgesuite.net,a1961.g2.akamai.net", "dns.qry.name": "www.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 61100, "event_id": "evt-35a3c074600267ff485da014", "src_port": 53, "tcp_stream": null, "udp_stream": 22, "frame_number": 404, "timestamp_epoch": "1552959901.298914000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "Bobby-Tiger-PC.littletigers.info", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-b056bc393025599fceefbe41", "src_port": 58922, "tcp_stream": null, "udp_stream": 23, "frame_number": 414, "timestamp_epoch": "1552959903.684782000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.a": "10.0.90.9", "dns.qry.name": "Bobby-Tiger-PC.littletigers.info", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 58922, "event_id": "evt-ad76a9ead980d110cd7fadf4", "src_port": 53, "tcp_stream": null, "udp_stream": 23, "frame_number": 415, "timestamp_epoch": "1552959903.685091000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.a": "10.0.90.215", "dns.qry.name": "littletigers.info", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-2f1e7c253c04c144b0feefee", "src_port": 52609, "tcp_stream": null, "udp_stream": 24, "frame_number": 416, "timestamp_epoch": "1552959903.687090000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.a": "10.0.90.215", "dns.qry.name": "littletigers.info", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 52609, "event_id": "evt-e9bd34a458b5461a0dee10ef", "src_port": 53, "tcp_stream": null, "udp_stream": 24, "frame_number": 417, "timestamp_epoch": "1552959903.687704000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.LittleTigers-DC.littletigers.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-1c29fa80ae95ab9642cdf21f", "src_port": 49189, "tcp_stream": null, "udp_stream": 25, "frame_number": 632, "timestamp_epoch": "1552959981.294987000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.LittleTigers-DC.littletigers.info", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 49189, "event_id": "evt-c692a03f31239127852367a5", "src_port": 53, "tcp_stream": null, "udp_stream": 25, "frame_number": 633, "timestamp_epoch": "1552959981.295313000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.LittleTigers-DC.littletigers.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-dc82c9364519a6d4884a9c9f", "src_port": 57499, "tcp_stream": null, "udp_stream": 26, "frame_number": 634, "timestamp_epoch": "1552959981.295661000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.qry.name": "_ldap._tcp.LittleTigers-DC.littletigers.info", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 57499, "event_id": "evt-3e6cc34771d72f3f9c510a66", "src_port": 53, "tcp_stream": null, "udp_stream": 26, "frame_number": 635, "timestamp_epoch": "1552959981.295851000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-c9edfdec093f9be28651abd7", "src_port": 53187, "tcp_stream": null, "udp_stream": 27, "frame_number": 694, "timestamp_epoch": "1552959981.893723000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.a": "131.107.255.255", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 53187, "event_id": "evt-51ddfaf46be49b8cdfc2c7a8", "src_port": 53, "tcp_stream": null, "udp_stream": 27, "frame_number": 697, "timestamp_epoch": "1552959981.918924000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-b460c36ebfafb6350217de60", "src_port": 53492, "tcp_stream": null, "udp_stream": 28, "frame_number": 698, "timestamp_epoch": "1552959981.919944000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 53492, "event_id": "evt-e0deed080b7751aee8f187bd", "src_port": 53, "tcp_stream": null, "udp_stream": 28, "frame_number": 699, "timestamp_epoch": "1552959981.923353000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "toptoptop1.online", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-718d20d6dbf87dc062addbf6", "src_port": 53146, "tcp_stream": null, "udp_stream": 30, "frame_number": 1535, "timestamp_epoch": "1552960184.555643000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.a": "103.1.184.108", "dns.qry.name": "toptoptop1.online", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 53146, "event_id": "evt-472d2431100cd1f4e5f9c4da", "src_port": 53, "tcp_stream": null, "udp_stream": 30, "frame_number": 1536, "timestamp_epoch": "1552960184.652960000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "9.90.0.10.in-addr.arpa", "dns.qry.type": "12", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-a2dbcbc17dc7f7e1ad2f8216", "src_port": 53147, "tcp_stream": null, "udp_stream": 31, "frame_number": 1955, "timestamp_epoch": "1552960833.509194000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.qry.name": "9.90.0.10.in-addr.arpa", "dns.qry.type": "12", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 53147, "event_id": "evt-f51bdd40c0224196c4bff255", "src_port": 53, "tcp_stream": null, "udp_stream": 31, "frame_number": 1956, "timestamp_epoch": "1552960833.517887000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "LITTLETIGERS.INFO.littletigers.info", "dns.qry.type": "255", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-852926cfb91eacec4c1c21fe", "src_port": 53148, "tcp_stream": null, "udp_stream": 32, "frame_number": 1957, "timestamp_epoch": "1552960833.518948000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.qry.name": "LITTLETIGERS.INFO.littletigers.info", "dns.qry.type": "255", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 53148, "event_id": "evt-e8f3976c1a2083c7c87519b0", "src_port": 53, "tcp_stream": null, "udp_stream": 32, "frame_number": 1958, "timestamp_epoch": "1552960833.519146000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "LITTLETIGERS.INFO", "dns.qry.type": "255", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-5b09e0c8a3ae7ecaad1d7e9a", "src_port": 53149, "tcp_stream": null, "udp_stream": 33, "frame_number": 1959, "timestamp_epoch": "1552960833.519839000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.a": "10.0.90.9,10.0.90.9", "dns.qry.name": "LITTLETIGERS.INFO", "dns.qry.type": "255", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 53149, "event_id": "evt-481f3d5d40c9e69c488c1001", "src_port": 53, "tcp_stream": null, "udp_stream": 33, "frame_number": 1960, "timestamp_epoch": "1552960833.520015000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "wpad.littletigers.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-6b341f7622821e126b07fce9", "src_port": 60460, "tcp_stream": null, "udp_stream": 37, "frame_number": 1975, "timestamp_epoch": "1552960839.945738000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.qry.name": "wpad.littletigers.info", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 60460, "event_id": "evt-66abe3aa8a399dedc89f9c53", "src_port": 53, "tcp_stream": null, "udp_stream": 37, "frame_number": 1976, "timestamp_epoch": "1552960839.946004000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-100ce1551cf9d9f148419b91", "src_port": 57167, "tcp_stream": null, "udp_stream": 38, "frame_number": 1977, "timestamp_epoch": "1552960839.946326000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 57167, "event_id": "evt-a5e26dd9ac735887c09b529e", "src_port": 53, "tcp_stream": null, "udp_stream": 38, "frame_number": 1980, "timestamp_epoch": "1552960839.954638000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-5f0f1b97fa4a36ff4ab399b5", "src_port": 59810, "tcp_stream": null, "udp_stream": 40, "frame_number": 2005, "timestamp_epoch": "1552960861.985463000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.a": "131.107.255.255", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 59810, "event_id": "evt-223d8982551bd3750bfda761", "src_port": 53, "tcp_stream": null, "udp_stream": 40, "frame_number": 2006, "timestamp_epoch": "1552960862.010975000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-b5417431a95b1fe3d1750cbc", "src_port": 62039, "tcp_stream": null, "udp_stream": 41, "frame_number": 2007, "timestamp_epoch": "1552960862.011541000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 62039, "event_id": "evt-a8c4b7561b814321585f92c6", "src_port": 53, "tcp_stream": null, "udp_stream": 41, "frame_number": 2008, "timestamp_epoch": "1552960862.014785000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "crl.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-6cf2a62a2d9c6e944b183844", "src_port": 54068, "tcp_stream": null, "udp_stream": 42, "frame_number": 2066, "timestamp_epoch": "1552961003.744888000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.a": "173.205.6.202,173.205.6.155", "dns.cname": "crl.www.ms.akadns.net,a1363.dscg.akamai.net", "dns.qry.name": "crl.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 54068, "event_id": "evt-dcb445ed989155f50fc5b9fc", "src_port": 53, "tcp_stream": null, "udp_stream": 42, "frame_number": 2067, "timestamp_epoch": "1552961003.770222000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "LittleTigers-DC.littletigers.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-e5cb9187247c85153c40e366", "src_port": 63956, "tcp_stream": null, "udp_stream": 43, "frame_number": 7036, "timestamp_epoch": "1552964396.361279000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.a": "10.0.90.9", "dns.qry.name": "LittleTigers-DC.littletigers.info", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 63956, "event_id": "evt-1dda08b4201febdee30269e8", "src_port": 53, "tcp_stream": null, "udp_stream": 43, "frame_number": 7037, "timestamp_epoch": "1552964396.361774000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.LittleTigers-DC.littletigers.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-a4c69e21e115fdc36d72a494", "src_port": 64875, "tcp_stream": null, "udp_stream": 46, "frame_number": 7556, "timestamp_epoch": "1552965682.544159000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.LittleTigers-DC.littletigers.info", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 64875, "event_id": "evt-dbab6f2ff1524f158c4b4cc3", "src_port": 53, "tcp_stream": null, "udp_stream": 46, "frame_number": 7557, "timestamp_epoch": "1552965682.544471000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.LittleTigers-DC.littletigers.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-5e83d70837136b376b531949", "src_port": 63011, "tcp_stream": null, "udp_stream": 47, "frame_number": 7558, "timestamp_epoch": "1552965682.545206000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.qry.name": "_ldap._tcp.LittleTigers-DC.littletigers.info", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 63011, "event_id": "evt-8fa6f9322073aaf7e1775a1f", "src_port": 53, "tcp_stream": null, "udp_stream": 47, "frame_number": 7559, "timestamp_epoch": "1552965682.545422000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "LittleTigers-DC.littletigers.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-8c5e1c88f618dff9645cd43b", "src_port": 59972, "tcp_stream": null, "udp_stream": 49, "frame_number": 8606, "timestamp_epoch": "1552967996.473551000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.a": "10.0.90.9", "dns.qry.name": "LittleTigers-DC.littletigers.info", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 59972, "event_id": "evt-c1caa033db83cf59326ec7c7", "src_port": 53, "tcp_stream": null, "udp_stream": 49, "frame_number": 8607, "timestamp_epoch": "1552967996.474098000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "9.90.0.10.in-addr.arpa", "dns.qry.type": "12", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-f168a02d5c6ba4e670716fe6", "src_port": 59974, "tcp_stream": null, "udp_stream": 51, "frame_number": 9915, "timestamp_epoch": "1552970839.756274000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.qry.name": "9.90.0.10.in-addr.arpa", "dns.qry.type": "12", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 59974, "event_id": "evt-15d49aae9be2d54be94d2aef", "src_port": 53, "tcp_stream": null, "udp_stream": 51, "frame_number": 9916, "timestamp_epoch": "1552970839.763635000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "LITTLETIGERS.INFO.littletigers.info", "dns.qry.type": "255", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-129a10c385614d6c1d3fcfdd", "src_port": 59975, "tcp_stream": null, "udp_stream": 52, "frame_number": 9917, "timestamp_epoch": "1552970839.764241000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.qry.name": "LITTLETIGERS.INFO.littletigers.info", "dns.qry.type": "255", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 59975, "event_id": "evt-01c600bd4a4cbb1d2f60bf58", "src_port": 53, "tcp_stream": null, "udp_stream": 52, "frame_number": 9918, "timestamp_epoch": "1552970839.764461000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "LITTLETIGERS.INFO", "dns.qry.type": "255", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-9228afc9e6f8167502139ac8", "src_port": 59976, "tcp_stream": null, "udp_stream": 53, "frame_number": 9919, "timestamp_epoch": "1552970839.764925000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.a": "10.0.90.9,10.0.90.9", "dns.qry.name": "LITTLETIGERS.INFO", "dns.qry.type": "255", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 59976, "event_id": "evt-4b8282c5c4b7dd18984162e7", "src_port": 53, "tcp_stream": null, "udp_stream": 53, "frame_number": 9920, "timestamp_epoch": "1552970839.765126000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "wpad.littletigers.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-d350088dc1b736903eca4804", "src_port": 51938, "tcp_stream": null, "udp_stream": 54, "frame_number": 9934, "timestamp_epoch": "1552970846.190608000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.qry.name": "wpad.littletigers.info", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 51938, "event_id": "evt-154e6a227ab924aef7f5e02a", "src_port": 53, "tcp_stream": null, "udp_stream": 54, "frame_number": 9935, "timestamp_epoch": "1552970846.190869000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-1e3ca86c668103944cb65946", "src_port": 60859, "tcp_stream": null, "udp_stream": 55, "frame_number": 9936, "timestamp_epoch": "1552970846.191269000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 60859, "event_id": "evt-a83655255fd56c222d8a3d67", "src_port": 53, "tcp_stream": null, "udp_stream": 55, "frame_number": 9939, "timestamp_epoch": "1552970846.197493000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-b8506e22defd51489472cf83", "src_port": 59497, "tcp_stream": null, "udp_stream": 57, "frame_number": 11024, "timestamp_epoch": "1552971272.000839000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.a": "131.107.255.255", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 59497, "event_id": "evt-ab41eb067dc5352a8348079b", "src_port": 53, "tcp_stream": null, "udp_stream": 57, "frame_number": 11025, "timestamp_epoch": "1552971272.025011000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-85fd00bf40a08ee5bcb4cac9", "src_port": 51962, "tcp_stream": null, "udp_stream": 58, "frame_number": 11026, "timestamp_epoch": "1552971272.025596000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 51962, "event_id": "evt-f29c8d7716e6fa5052049d51", "src_port": 53, "tcp_stream": null, "udp_stream": 58, "frame_number": 11027, "timestamp_epoch": "1552971272.029527000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.LittleTigers-DC.littletigers.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-af60856657f64bf39782ef09", "src_port": 55354, "tcp_stream": null, "udp_stream": 60, "frame_number": 12637, "timestamp_epoch": "1552971443.728199000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.LittleTigers-DC.littletigers.info", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 55354, "event_id": "evt-3f700301004a9a709914794e", "src_port": 53, "tcp_stream": null, "udp_stream": 60, "frame_number": 12638, "timestamp_epoch": "1552971443.728531000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "_ldap._tcp.LittleTigers-DC.littletigers.info", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-04ca84ce57e0b9cac7988eaf", "src_port": 61628, "tcp_stream": null, "udp_stream": 61, "frame_number": 12639, "timestamp_epoch": "1552971443.729140000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.qry.name": "_ldap._tcp.LittleTigers-DC.littletigers.info", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 61628, "event_id": "evt-7acf6316d9c38370758af333", "src_port": 53, "tcp_stream": null, "udp_stream": 61, "frame_number": 12640, "timestamp_epoch": "1552971443.729319000" }, { "kind": "dns", "dst_ip": "10.0.90.9", "fields": { "dns.qry.name": "LittleTigers-DC.littletigers.info", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": 53, "event_id": "evt-1ac4ffde3ef1420d71578833", "src_port": 50182, "tcp_stream": null, "udp_stream": 63, "frame_number": 12798, "timestamp_epoch": "1552971596.579796000" }, { "kind": "dns", "dst_ip": "10.0.90.215", "fields": { "dns.a": "10.0.90.9", "dns.qry.name": "LittleTigers-DC.littletigers.info", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.90.9", "dst_port": 50182, "event_id": "evt-447a346da766b61982e18907", "src_port": 53, "tcp_stream": null, "udp_stream": 63, "frame_number": 12799, "timestamp_epoch": "1552971596.580063000" } ], "dhcp": [ { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "64:32:a8:57:2b:42", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "64:32:a8:57:2b:42,64:32:a8:57:2b:42", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Bobby-Tiger-PC" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-5d8581b97fc114814caf680e", "src_port": null, "tcp_stream": null, "udp_stream": 14, "frame_number": 384, "timestamp_epoch": "1552959898.681594000" }, { "kind": "dhcp", "dst_ip": "10.0.90.215", "fields": { "eth.src": "a4:1f:72:c2:09:6a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "64:32:a8:57:2b:42", "dhcp.option.dhcp": "5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-81e86577fd071e50a6cfe479", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 385, "timestamp_epoch": "1552959898.681969000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "64:32:a8:57:2b:42", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "64:32:a8:57:2b:42,64:32:a8:57:2b:42", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Bobby-Tiger-PC" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-5518ab4df9975bc62706f71f", "src_port": null, "tcp_stream": null, "udp_stream": 14, "frame_number": 749, "timestamp_epoch": "1552960024.528666000" }, { "kind": "dhcp", "dst_ip": "10.0.90.215", "fields": { "eth.src": "a4:1f:72:c2:09:6a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "64:32:a8:57:2b:42", "dhcp.option.dhcp": "5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7788d2f0c6a2896d5f98cf18", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 750, "timestamp_epoch": "1552960024.529058000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "64:32:a8:57:2b:42", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "64:32:a8:57:2b:42,64:32:a8:57:2b:42", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Bobby-Tiger-PC" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-efc59474ec16babad42e81ec", "src_port": null, "tcp_stream": null, "udp_stream": 14, "frame_number": 1547, "timestamp_epoch": "1552960185.893185000" }, { "kind": "dhcp", "dst_ip": "10.0.90.215", "fields": { "eth.src": "a4:1f:72:c2:09:6a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "64:32:a8:57:2b:42", "dhcp.option.dhcp": "5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-9e5b248f048c3b1e2fa39c94", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 1548, "timestamp_epoch": "1552960185.893607000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "64:32:a8:57:2b:42", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "64:32:a8:57:2b:42,64:32:a8:57:2b:42", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Bobby-Tiger-PC" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-87c825aee1607dbb528a8ba2", "src_port": null, "tcp_stream": null, "udp_stream": 14, "frame_number": 1978, "timestamp_epoch": "1552960839.947329000" }, { "kind": "dhcp", "dst_ip": "10.0.90.215", "fields": { "eth.src": "a4:1f:72:c2:09:6a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "64:32:a8:57:2b:42", "dhcp.option.dhcp": "5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0d0b417710a70018ca6caf97", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 1979, "timestamp_epoch": "1552960839.947597000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "64:32:a8:57:2b:42", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "64:32:a8:57:2b:42,64:32:a8:57:2b:42", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Bobby-Tiger-PC" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-a8ecd3f58ee309d5e4314795", "src_port": null, "tcp_stream": null, "udp_stream": 14, "frame_number": 2058, "timestamp_epoch": "1552960999.162850000" }, { "kind": "dhcp", "dst_ip": "10.0.90.215", "fields": { "eth.src": "a4:1f:72:c2:09:6a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "64:32:a8:57:2b:42", "dhcp.option.dhcp": "5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1300e9a9dfef43dc1bb26bac", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 2059, "timestamp_epoch": "1552960999.163448000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "64:32:a8:57:2b:42", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "64:32:a8:57:2b:42,64:32:a8:57:2b:42", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Bobby-Tiger-PC" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-84999a4b278dfae464db3f31", "src_port": null, "tcp_stream": null, "udp_stream": 14, "frame_number": 3043, "timestamp_epoch": "1552961296.484040000" }, { "kind": "dhcp", "dst_ip": "10.0.90.215", "fields": { "eth.src": "a4:1f:72:c2:09:6a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "64:32:a8:57:2b:42", "dhcp.option.dhcp": "5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-2cbe8c5dafe2e4c62913e401", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 3044, "timestamp_epoch": "1552961296.484684000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "64:32:a8:57:2b:42", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "64:32:a8:57:2b:42,64:32:a8:57:2b:42", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Bobby-Tiger-PC" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-9c19ecaf0d6597acd4daf21f", "src_port": null, "tcp_stream": null, "udp_stream": 14, "frame_number": 9937, "timestamp_epoch": "1552970846.191937000" }, { "kind": "dhcp", "dst_ip": "10.0.90.215", "fields": { "eth.src": "a4:1f:72:c2:09:6a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "64:32:a8:57:2b:42", "dhcp.option.dhcp": "5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1b2c96cc87f477ee417ab48e", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 9938, "timestamp_epoch": "1552970846.192190000" }, { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "64:32:a8:57:2b:42", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "64:32:a8:57:2b:42,64:32:a8:57:2b:42", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Bobby-Tiger-PC" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-42d858d7f87d163662a96c80", "src_port": null, "tcp_stream": null, "udp_stream": 14, "frame_number": 10975, "timestamp_epoch": "1552971245.360596000" }, { "kind": "dhcp", "dst_ip": "10.0.90.215", "fields": { "eth.src": "a4:1f:72:c2:09:6a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "64:32:a8:57:2b:42", "dhcp.option.dhcp": "5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-5299b922855cad5db41096ed", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 10976, "timestamp_epoch": "1552971245.361345000" } ], "smtp": [], "identity": [ { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "BOBBY-TIGER-PC<00>,BOBBY-TIGER-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-3d2347ccee6171221f63e501", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1, "timestamp_epoch": "1552959895.636766000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "LITTLETIGERS<00>,LITTLETIGERS<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-c342ac50809755b285acc8ef", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2, "timestamp_epoch": "1552959895.636976000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-99ab02203a0dbd97dd26c7c3", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 38, "timestamp_epoch": "1552959895.784676000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-07e128b027065050819f7348", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 42, "timestamp_epoch": "1552959895.785967000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-9530be429ada273fce888077", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 43, "timestamp_epoch": "1552959895.786183000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "10", "kerberos.CNameString": "bobby-tiger-pc$" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-accd239aa8d2ac9d2005b188", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 51, "timestamp_epoch": "1552959895.793065000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-f1ba12dcb5f551581531db6c", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 52, "timestamp_epoch": "1552959895.793575000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "10", "kerberos.CNameString": "bobby-tiger-pc$" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-ce77d92ec3c0151a16857f39", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 59, "timestamp_epoch": "1552959895.807560000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-47bf9f5177edd4f7bc85b6dc", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 60, "timestamp_epoch": "1552959895.808146000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "10", "kerberos.CNameString": "bobby-tiger-pc$" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-d5959aea6cbf2e366d84414b", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 67, "timestamp_epoch": "1552959895.817997000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "BOBBY-TIGER-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-19f0797268b5565ba7005fd2", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 69, "timestamp_epoch": "1552959895.819258000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "10", "kerberos.CNameString": "bobby-tiger-pc$" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-d7d70b8292a0dd73b1ab51ec", "src_port": null, "tcp_stream": 7, "udp_stream": null, "frame_number": 79, "timestamp_epoch": "1552959895.840289000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-ca88e895a7707c4fbeb5776f", "src_port": null, "tcp_stream": 8, "udp_stream": null, "frame_number": 82, "timestamp_epoch": "1552959895.840558000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "BOBBY-TIGER-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7fb87199f0299d48c91665d9", "src_port": null, "tcp_stream": 7, "udp_stream": null, "frame_number": 85, "timestamp_epoch": "1552959895.841273000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "BOBBY-TIGER-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-50c3ceb04597139b9fdcbf45", "src_port": null, "tcp_stream": 8, "udp_stream": null, "frame_number": 89, "timestamp_epoch": "1552959895.842209000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-5d374d155656588e09362591", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 99, "timestamp_epoch": "1552959895.845945000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-2ec8b344fc07dafe1a4e51fe", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 103, "timestamp_epoch": "1552959895.846321000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "BOBBY-TIGER-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-77167db80d513828f9330b6d", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 106, "timestamp_epoch": "1552959895.847321000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-73d624eb04d495c3a5feb082", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 107, "timestamp_epoch": "1552959895.847608000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-3ebf27d5fb3e09bfedd7ec70", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 118, "timestamp_epoch": "1552959895.850003000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "BOBBY-TIGER-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-45e85972ba9f511714cb8892", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 122, "timestamp_epoch": "1552959895.850380000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-98623247047d608e46f8efed", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 131, "timestamp_epoch": "1552959895.852935000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-986b434c564bdd5a929176a3", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 132, "timestamp_epoch": "1552959895.853458000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-66ede876924a4dd2e41ae469", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 135, "timestamp_epoch": "1552959895.854251000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-39b6ce7fec7ac27b1a56397e", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 136, "timestamp_epoch": "1552959895.854384000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-a2a92abee6880ad03becd0a1", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 139, "timestamp_epoch": "1552959895.855462000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-4b04255877b3fc9f513dbf2c", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 140, "timestamp_epoch": "1552959895.855700000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-cb064c4958d988cd39a6c046", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 169, "timestamp_epoch": "1552959896.036551000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "BOBBY-TIGER-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-4cac919f13921e63896b6be9", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 172, "timestamp_epoch": "1552959896.037321000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-69a50d14a1c4f659ff022f1e", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 178, "timestamp_epoch": "1552959896.039053000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-26cd6fca2c2bd9eb10ae0b4d", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 180, "timestamp_epoch": "1552959896.039655000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "BOBBY-TIGER-PC<20>,BOBBY-TIGER-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-4210e0f9fc24a9bbbda2c9aa", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 217, "timestamp_epoch": "1552959896.166022000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-d623670bffe5a829c48c87c9", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 218, "timestamp_epoch": "1552959896.230395000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-b5245a43e5506ce77b6d804e", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 219, "timestamp_epoch": "1552959896.230758000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "LITTLETIGERS<00>,LITTLETIGERS<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-6f48d0ad56bc26937ac39da2", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 220, "timestamp_epoch": "1552959896.382036000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "BOBBY-TIGER-PC<00>,BOBBY-TIGER-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-d0ce2d8d8f0ca7c52b4c2323", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 221, "timestamp_epoch": "1552959896.382174000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-011ab3c172b0a8f44615defa", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 231, "timestamp_epoch": "1552959896.401983000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "BOBBY-TIGER-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d4bbc9543d435c7f667e53e6", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 234, "timestamp_epoch": "1552959896.402702000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-8521028fb87af8159c35ab40", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 240, "timestamp_epoch": "1552959896.403222000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-711a89a605cdad03ac205c4e", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 242, "timestamp_epoch": "1552959896.403732000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-754cabffb4b6e66f2f6694b8", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 243, "timestamp_epoch": "1552959896.404049000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "BOBBY-TIGER-PC<20>,BOBBY-TIGER-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-cbb7b892971264f261d6fcce", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 256, "timestamp_epoch": "1552959896.922304000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-51ffb5379a785d6599bcb49a", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 269, "timestamp_epoch": "1552959896.989874000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-45f852eb3665d98b6aa669d0", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 271, "timestamp_epoch": "1552959896.990551000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-011626720235f9e5509d7cb2", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 276, "timestamp_epoch": "1552959896.999469000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "BOBBY-TIGER-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-2c33f67b748af15c33d1758d", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 279, "timestamp_epoch": "1552959897.000197000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-2f2791946ec9611898eb7564", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 290, "timestamp_epoch": "1552959897.007254000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-75f94dcf736d68b72d4bc537", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 292, "timestamp_epoch": "1552959897.007798000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-a728330884fd1cc748397ea3", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 303, "timestamp_epoch": "1552959897.012108000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-17500ea47b39649b5cb3af7d", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 308, "timestamp_epoch": "1552959897.012537000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "BOBBY-TIGER-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-12aa13be4501518ddc831d6a", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 310, "timestamp_epoch": "1552959897.013007000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-4de50307717c627a85601f5d", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 313, "timestamp_epoch": "1552959897.013246000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-394daac31288a8d9fb5539a7", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 322, "timestamp_epoch": "1552959897.014062000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-40d3d22cb855e06344022027", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 326, "timestamp_epoch": "1552959897.014218000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-4baef8a8e4f703555b1482c6", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 328, "timestamp_epoch": "1552959897.014732000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "BOBBY-TIGER-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e5708ddfce990291ad4ab91d", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 331, "timestamp_epoch": "1552959897.015310000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-24987be76f4c183626cb2ef5", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 342, "timestamp_epoch": "1552959897.016043000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "BOBBY-TIGER-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a3de8e1ea0a641efdc468c37", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 345, "timestamp_epoch": "1552959897.016353000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-0738cac74074d2876adfe0f3", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 353, "timestamp_epoch": "1552959897.017074000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-bd7ac33ed8d08ee1419962bb", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 354, "timestamp_epoch": "1552959897.017681000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-78a21822159c1c3c1c8e2bb6", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 355, "timestamp_epoch": "1552959897.018174000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e1322c60dbbcf0a41bdac27d", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 356, "timestamp_epoch": "1552959897.018323000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-4f8f7af352456958e0c401e3", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 357, "timestamp_epoch": "1552959897.018654000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-cb7d4be4d8bff8349e32aa47", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 358, "timestamp_epoch": "1552959897.018831000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-7a765ae7bef9a5ab2d02a895", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 359, "timestamp_epoch": "1552959897.019277000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a2115d06986b381f6aa8e1e7", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 360, "timestamp_epoch": "1552959897.019536000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-6c7fabdc26f828a23a194ccd", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 361, "timestamp_epoch": "1552959897.019890000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a8ab6a61b8be50d22c5f9dbf", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 362, "timestamp_epoch": "1552959897.020131000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-bc173182a5bb1964446f2d63", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 363, "timestamp_epoch": "1552959897.020722000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c5d3af9c42caad78d29e121b", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 364, "timestamp_epoch": "1552959897.021027000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-d514a13ecfe9225ff886960b", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 365, "timestamp_epoch": "1552959897.021418000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-aa64d97f9fdbebfa18809e8a", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 366, "timestamp_epoch": "1552959897.021664000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "BOBBY-TIGER-PC<00>,BOBBY-TIGER-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-6813812980643eefac5c1de2", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 369, "timestamp_epoch": "1552959897.131799000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "LITTLETIGERS<00>,LITTLETIGERS<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-0c9981d908499ef1c639c14e", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 370, "timestamp_epoch": "1552959897.131908000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "BOBBY-TIGER-PC<20>,BOBBY-TIGER-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-8a0d442cc5775ee1742b62e0", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 377, "timestamp_epoch": "1552959897.672284000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "LITTLETIGERS<00>,LITTLETIGERS<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-5a90555b2f1037c398e0d354", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 378, "timestamp_epoch": "1552959897.881536000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "BOBBY-TIGER-PC<00>,BOBBY-TIGER-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-782c34c094f223cf4cec157b", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 379, "timestamp_epoch": "1552959897.881656000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "BOBBY-TIGER-PC<20>,BOBBY-TIGER-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-89fd3d999beda9c3e317bb76", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 380, "timestamp_epoch": "1552959898.421689000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "64:32:a8:57:2b:42", "dns.qry.name": "Bobby-Tiger-PC" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-fa8c43e513765e50e9dbc03e", "src_port": null, "tcp_stream": null, "udp_stream": 13, "frame_number": 383, "timestamp_epoch": "1552959898.677281000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "64:32:a8:57:2b:42", "dns.qry.name": "wpad" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-45e1a7ce183aa4d60bd179cf", "src_port": null, "tcp_stream": null, "udp_stream": 17, "frame_number": 388, "timestamp_epoch": "1552959898.686023000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "64:32:a8:57:2b:42", "dns.qry.name": "Bobby-Tiger-PC" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-0de5f79c203e61a8b763dd46", "src_port": null, "tcp_stream": null, "udp_stream": 13, "frame_number": 389, "timestamp_epoch": "1552959898.772738000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "64:32:a8:57:2b:42", "dns.qry.name": "wpad" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-2e36f0b1c2f537f64329c272", "src_port": null, "tcp_stream": null, "udp_stream": 17, "frame_number": 390, "timestamp_epoch": "1552959898.782554000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-ea23662b849d9191560ad777", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 391, "timestamp_epoch": "1552959898.981913000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-7e4ccd0b55d66efbfb8481e2", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 399, "timestamp_epoch": "1552959899.731815000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-627ef6082ac2b5d5ad824b96", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 400, "timestamp_epoch": "1552959900.486411000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-f4a762fef5f67c573aabf2f1", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 426, "timestamp_epoch": "1552959906.515880000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-08e421948256fa3a313706e1", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 428, "timestamp_epoch": "1552959906.516502000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-f82343689efa145706c32ef6", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 441, "timestamp_epoch": "1552959906.529413000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-aac7532cf805384b978b5a45", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 443, "timestamp_epoch": "1552959906.530054000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "10", "kerberos.CNameString": "BOBBY-TIGER-PC$" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-77b3415682dfb971040a5ecc", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 449, "timestamp_epoch": "1552959906.532302000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1fe210ba8e2c9a60e18fadd6", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 450, "timestamp_epoch": "1552959906.532630000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "10", "kerberos.CNameString": "BOBBY-TIGER-PC$" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-a1bdc4488a584620b3524aa0", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 457, "timestamp_epoch": "1552959906.548130000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "BOBBY-TIGER-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a697969b34a1a60221a6d1f4", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 459, "timestamp_epoch": "1552959906.548583000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-9da63293eb78146fd396c703", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 468, "timestamp_epoch": "1552959906.550166000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "BOBBY-TIGER-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-eb90b3b5514fbb6aa682b750", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 471, "timestamp_epoch": "1552959906.550771000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-942fd7ad861397a4039af4ab", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 482, "timestamp_epoch": "1552959912.733634000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1a35eba25afa228b90bbea58", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 483, "timestamp_epoch": "1552959912.733958000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-c8112092e5e2d61ad1b480e7", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 484, "timestamp_epoch": "1552959912.734203000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-028f282977ac492ebeb41525", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 485, "timestamp_epoch": "1552959912.734407000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-38ddfcb0311d8805672b3d35", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 486, "timestamp_epoch": "1552959912.734690000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-68b919895f8c6764c9c872f1", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 488, "timestamp_epoch": "1552959912.734971000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-cdbacdb1aac24e75b11790a8", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 498, "timestamp_epoch": "1552959924.745482000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e72146f1371fefecf2ba196c", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 499, "timestamp_epoch": "1552959924.745878000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-d4fa6304fcc6ee97d2505bfa", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 506, "timestamp_epoch": "1552959936.741139000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-810cbff0b2a55661f554617c", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 507, "timestamp_epoch": "1552959936.741440000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-ea9ed0613a73426dfa657d3a", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 508, "timestamp_epoch": "1552959936.741696000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e473acdd353945ddd0e64feb", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 509, "timestamp_epoch": "1552959936.741919000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "10", "kerberos.CNameString": "bobby.tiger" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-3df561a4a063361060d8d03d", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 524, "timestamp_epoch": "1552959980.212307000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e57a6891cf4f6afd127ff482", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 525, "timestamp_epoch": "1552959980.212721000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "10", "kerberos.CNameString": "bobby.tiger" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-1f9476ece0220b8e39d174a2", "src_port": null, "tcp_stream": 35, "udp_stream": null, "frame_number": 532, "timestamp_epoch": "1552959980.223025000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "bobby.tiger" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-ebdc95fd119f3f2924d7e9d8", "src_port": null, "tcp_stream": 35, "udp_stream": null, "frame_number": 534, "timestamp_epoch": "1552959980.223613000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-150668b0738f56d24a34c431", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 543, "timestamp_epoch": "1552959980.224588000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "bobby.tiger" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-5da73d9c53d3b9c8d0310f0e", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 546, "timestamp_epoch": "1552959980.225143000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-698e551706d0e8cd31150ab9", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 565, "timestamp_epoch": "1552959980.759506000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "bobby.tiger" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-71bb7d4e81e6505c296e0a16", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 568, "timestamp_epoch": "1552959980.760200000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-f5f378425bc9306f592bf600", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 574, "timestamp_epoch": "1552959980.760653000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d79e17c76685ec942c6dd28c", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 576, "timestamp_epoch": "1552959980.761099000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-52af38972af9aabd4f1cec6c", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 577, "timestamp_epoch": "1552959980.762151000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-f5aad1a97c771f29eb03d66c", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 591, "timestamp_epoch": "1552959980.792441000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-481aa17321c1df662d3c44c5", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 592, "timestamp_epoch": "1552959980.792617000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-01bf42b449038f6c0360c0a1", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 593, "timestamp_epoch": "1552959980.792843000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-a50b36afebae09fb4e7f32d5", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 598, "timestamp_epoch": "1552959980.793849000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "bobby.tiger" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-cf5465167c023124162a78b5", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 601, "timestamp_epoch": "1552959980.794709000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-51196d068a4219aaa6ca0301", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 610, "timestamp_epoch": "1552959980.795240000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "bobby.tiger" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-91853ed38d3acf096a94c9e5", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 613, "timestamp_epoch": "1552959980.795550000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-1e31bd8355769e6b9e235b51", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 621, "timestamp_epoch": "1552959980.796151000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-baddb3cf1c927216411f87d9", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 622, "timestamp_epoch": "1552959980.796722000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-4bed75c376ccd6a5d9b65081", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 623, "timestamp_epoch": "1552959980.797018000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-652734ddb064b86cfd545848", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 624, "timestamp_epoch": "1552959980.797147000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-7b0afd96907c8190599e018a", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 625, "timestamp_epoch": "1552959980.797881000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d4f752ded9dca02e4e8e50c4", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 626, "timestamp_epoch": "1552959980.903961000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-bacc7e202305507b33e7fbf3", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 627, "timestamp_epoch": "1552959980.905647000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-45b3887ccd6ddab09ec5e901", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 628, "timestamp_epoch": "1552959980.905806000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-212b0aab66f668d013141d0b", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 643, "timestamp_epoch": "1552959981.298532000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "bobby.tiger" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-acf52a6794e0a16ab25488c7", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 646, "timestamp_epoch": "1552959981.299598000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-353b8efdc7cf1a1c1b799aa7", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 652, "timestamp_epoch": "1552959981.300324000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3824e5e06006df1852f631d9", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 654, "timestamp_epoch": "1552959981.300889000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-bd47c06d3d1f8589be4ccdb8", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 661, "timestamp_epoch": "1552959981.305968000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-978b9083576258d644410f3f", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 663, "timestamp_epoch": "1552959981.306548000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-07b8d9d640ee1f4e6cd87013", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 674, "timestamp_epoch": "1552959981.311192000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-7f84f05909c32e62ce76d16e", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 675, "timestamp_epoch": "1552959981.311342000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-ff6ec44d6c31433e220c3589", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 676, "timestamp_epoch": "1552959981.311553000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-126c645188d43b40a75a5bd1", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 680, "timestamp_epoch": "1552959981.312269000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a70d59460e8222b03747829c", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 681, "timestamp_epoch": "1552959981.312817000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-4a356cbe58daf7e255bda1e0", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 682, "timestamp_epoch": "1552959981.313037000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-9fa0947f33e254558a0c8b72", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 683, "timestamp_epoch": "1552959981.313156000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-a009497f74aab7810ee45258", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 684, "timestamp_epoch": "1552959981.313393000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-89e423bf671781b027ce557b", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 685, "timestamp_epoch": "1552959981.313640000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-90072e015432f846ec2107db", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 686, "timestamp_epoch": "1552959981.313853000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-600d1410092109af21946603", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 687, "timestamp_epoch": "1552959981.313980000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-8821f497a8040225be94db4e", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 717, "timestamp_epoch": "1552959996.736555000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e6835c081ce79b394bf9ac8b", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 718, "timestamp_epoch": "1552959996.736778000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-df30fea023541160190ee74b", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 720, "timestamp_epoch": "1552959997.310024000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c6f5826ab6f1f6046790a12b", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 721, "timestamp_epoch": "1552959997.310246000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-3cb8dd401cd01e5903c6e9e6", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 722, "timestamp_epoch": "1552959997.310424000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-08e808b3de30b5f2a5c52568", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 723, "timestamp_epoch": "1552959997.410397000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-432e7fba96c97b9357cea963", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 729, "timestamp_epoch": "1552960008.738829000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6623acce418505442b393639", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 730, "timestamp_epoch": "1552960008.739212000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-fa9693714650c2a77911515a", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 731, "timestamp_epoch": "1552960008.742249000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-4b73b09b798ba5391a15dffb", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 732, "timestamp_epoch": "1552960008.742442000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-07573dfd6af0e51427f42c76", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 741, "timestamp_epoch": "1552960020.732351000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c2d48cd153570033c046e0a4", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 742, "timestamp_epoch": "1552960020.732605000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-9e43bf3f439298252886c9b2", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 743, "timestamp_epoch": "1552960020.733017000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-12bf8f35c75d625d493e7ca5", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 744, "timestamp_epoch": "1552960020.733253000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-004db5511db37b6754cfa9ca", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 748, "timestamp_epoch": "1552960024.527439000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-48aaf423861b81f1f3ce4a9b", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1525, "timestamp_epoch": "1552960025.285735000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-e48fd32b61fcf220e335b6ab", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1526, "timestamp_epoch": "1552960026.050167000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-eca6a84378dc92a1b613f6fd", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1546, "timestamp_epoch": "1552960185.888956000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-220a6cdecad3196b3b9da144", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1622, "timestamp_epoch": "1552960186.645319000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-3076be2d29eb1c18cd177c1a", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1715, "timestamp_epoch": "1552960187.409471000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6aeef5e6d8cc2badb99f8f17", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 1909, "timestamp_epoch": "1552960796.255855000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-0494b8ed55d0b1fa2e20d7be", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 1910, "timestamp_epoch": "1552960796.256015000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3373498751d3ae946df86ae1", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 1911, "timestamp_epoch": "1552960796.256320000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-a292de66ebbb1c8b1d1d250e", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 1915, "timestamp_epoch": "1552960796.257353000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3fe40cd69cb150925661efa3", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 1916, "timestamp_epoch": "1552960796.258217000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-517d6b98fb6742f7485bef56", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 1917, "timestamp_epoch": "1552960796.258700000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c8b0c4d5e2a6366f7ee755f0", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 1918, "timestamp_epoch": "1552960796.258869000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-5c781cf442e991547f9f7ccc", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 1919, "timestamp_epoch": "1552960796.259279000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-df2fe9409e36fbcdd965f8d0", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 1920, "timestamp_epoch": "1552960796.259509000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-ab43f15aaab41a467b5b65eb", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 1928, "timestamp_epoch": "1552960806.745584000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-08a6a938d58f820ba61bac6d", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 1929, "timestamp_epoch": "1552960806.745907000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-7637a2482c0056b4677ebe85", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 1930, "timestamp_epoch": "1552960806.746211000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-deb275696133394dfc7cb703", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 1931, "timestamp_epoch": "1552960806.746488000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-a4902b6840c7b4c68eaba7d8", "src_port": null, "tcp_stream": null, "udp_stream": 34, "frame_number": 1961, "timestamp_epoch": "1552960833.568730000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "LITTLETIGERS<1b>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-c82fa23fbbe734a5aeb1f140", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1962, "timestamp_epoch": "1552960833.568845000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "nbns.name": "LITTLETIGERS<1b> (Domain Master Browser)", "nbns.flags.opcode": "0", "nbns.flags.response": "True", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8f19335de7d87098a2fb7148", "src_port": null, "tcp_stream": null, "udp_stream": 35, "frame_number": 1963, "timestamp_epoch": "1552960833.568977000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-f756659dfdc1b80869e3c3fc", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 1964, "timestamp_epoch": "1552960833.569282000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-77c93894b7076cd7e8967db1", "src_port": null, "tcp_stream": null, "udp_stream": 34, "frame_number": 1965, "timestamp_epoch": "1552960834.574754000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-44e4018465218d01d63f8ca1", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 1966, "timestamp_epoch": "1552960834.575029000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-e068e820c827fc826fdd2133", "src_port": null, "tcp_stream": null, "udp_stream": 34, "frame_number": 1967, "timestamp_epoch": "1552960835.590058000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-778e8ca5aaa07fbf9f1f4251", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 1968, "timestamp_epoch": "1552960835.590249000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "LITTLETIGERS<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-7ef86bfbb90487b72ef94ae4", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1972, "timestamp_epoch": "1552960836.603039000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "LITTLETIGERS<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-42340c81eacc116c6662f7ef", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1973, "timestamp_epoch": "1552960837.367890000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "LITTLETIGERS<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-354be8fd639f04f36e131af0", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1974, "timestamp_epoch": "1552960838.132510000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "64:32:a8:57:2b:42", "dns.qry.name": "wpad" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-88b9159ed1cc356a350a1810", "src_port": null, "tcp_stream": null, "udp_stream": 39, "frame_number": 1981, "timestamp_epoch": "1552960839.955088000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "64:32:a8:57:2b:42", "dns.qry.name": "wpad" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-f0116c24a33133b505ca9442", "src_port": null, "tcp_stream": null, "udp_stream": 39, "frame_number": 1983, "timestamp_epoch": "1552960840.051245000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-c91522a3b0d38a968fcd0b1d", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1984, "timestamp_epoch": "1552960840.254114000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-2d4fb393b1b7b475fe44c13b", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1985, "timestamp_epoch": "1552960841.017898000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-ebeb6cdc13b907cf1bdb18df", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1986, "timestamp_epoch": "1552960841.781752000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-d1287df32042ca0340e69c29", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2060, "timestamp_epoch": "1552960999.166554000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-b132df7642d9c9618a2d8df7", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2061, "timestamp_epoch": "1552960999.919595000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-88c17762a036d6166031fa8b", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2062, "timestamp_epoch": "1552961000.683663000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-1a67e677e2ec47d2905e4adf", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2063, "timestamp_epoch": "1552961001.460936000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-4e2ea5b4e02b5fad77789e0c", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2064, "timestamp_epoch": "1552961002.213042000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-3b45d9dd896b38f7de630d86", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2065, "timestamp_epoch": "1552961002.977538000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-16e15a0be8e9b3e69611cd9f", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3042, "timestamp_epoch": "1552961296.482171000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-4c2725cc6d9a9ec62a5e6826", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3053, "timestamp_epoch": "1552961297.240421000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-1326c37014ac820959cc4e44", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 3058, "timestamp_epoch": "1552961298.005169000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-8bea7cbc1a9b915f73f4468d", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 5228, "timestamp_epoch": "1552961397.030364000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-49485d2e9ac857059b1b9f8f", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 5229, "timestamp_epoch": "1552961397.030703000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-52b7ce71a90daeeb2ad6d97d", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 5233, "timestamp_epoch": "1552961397.031908000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-96ae4fba89fb867fd5cc00ed", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 5234, "timestamp_epoch": "1552961397.032908000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-4b54e8bbf27c7f4ed67ba7ff", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 5235, "timestamp_epoch": "1552961397.033275000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c8220347fed0a6b7c8841ce7", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 5236, "timestamp_epoch": "1552961397.033426000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-577141ef437fb765f1bd79f5", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 5237, "timestamp_epoch": "1552961397.033746000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-074a200279ce6cc389d8bc1d", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 5238, "timestamp_epoch": "1552961397.138442000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-b98871e0e2d72f0674808199", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 5239, "timestamp_epoch": "1552961397.139530000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-b4731d14001de14b4118bce5", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 5240, "timestamp_epoch": "1552961397.139767000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-41bb9a54a033663cafdaec25", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 5245, "timestamp_epoch": "1552961397.537138000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c86f4bda510f183c802b6048", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 5246, "timestamp_epoch": "1552961397.537580000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-f4e55585cd7ce2056b3d8ba7", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 5251, "timestamp_epoch": "1552961412.737132000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-10f53a9fa8472e5797557eb3", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 5252, "timestamp_epoch": "1552961412.737372000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-1d220f005e4a2932a9cd19a7", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 5287, "timestamp_epoch": "1552961465.054913000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-337787a861235e64c0893c6a", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 5288, "timestamp_epoch": "1552961465.055341000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-986b9cd1ff64707f05584d80", "src_port": null, "tcp_stream": 75, "udp_stream": null, "frame_number": 5316, "timestamp_epoch": "1552961469.415205000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-49e1a102819612b86315dfd1", "src_port": null, "tcp_stream": 75, "udp_stream": null, "frame_number": 5318, "timestamp_epoch": "1552961469.415754000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-943dc9854afd17cfcdc830d5", "src_port": null, "tcp_stream": 75, "udp_stream": null, "frame_number": 5319, "timestamp_epoch": "1552961469.416022000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e2043774534d2553872a1942", "src_port": null, "tcp_stream": 76, "udp_stream": null, "frame_number": 5413, "timestamp_epoch": "1552961696.263549000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-440dd390381b0cef064d2a17", "src_port": null, "tcp_stream": 76, "udp_stream": null, "frame_number": 5414, "timestamp_epoch": "1552961696.263745000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a5c7e6804b4592896873c758", "src_port": null, "tcp_stream": 76, "udp_stream": null, "frame_number": 5415, "timestamp_epoch": "1552961696.263978000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-b52fc2c973cbc4ddabbd45c8", "src_port": null, "tcp_stream": 76, "udp_stream": null, "frame_number": 5419, "timestamp_epoch": "1552961696.265713000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8b57008a8712d8d7a5d65736", "src_port": null, "tcp_stream": 76, "udp_stream": null, "frame_number": 5420, "timestamp_epoch": "1552961696.266352000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-2728d73d4548670c05755a67", "src_port": null, "tcp_stream": 76, "udp_stream": null, "frame_number": 5421, "timestamp_epoch": "1552961696.266776000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-53c45593b2c88701b56dc16e", "src_port": null, "tcp_stream": 76, "udp_stream": null, "frame_number": 5422, "timestamp_epoch": "1552961696.266929000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-35eacce431d15158f7f0a3d7", "src_port": null, "tcp_stream": 76, "udp_stream": null, "frame_number": 5423, "timestamp_epoch": "1552961696.267336000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c09200a6a55bee58cd747589", "src_port": null, "tcp_stream": 76, "udp_stream": null, "frame_number": 5424, "timestamp_epoch": "1552961696.267674000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-31a03490022462278078b2cf", "src_port": null, "tcp_stream": 76, "udp_stream": null, "frame_number": 5431, "timestamp_epoch": "1552961706.735103000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7dca953ebf370cfcae611d9f", "src_port": null, "tcp_stream": 76, "udp_stream": null, "frame_number": 5432, "timestamp_epoch": "1552961706.735390000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-fba3e6f782729f707d833ca0", "src_port": null, "tcp_stream": 76, "udp_stream": null, "frame_number": 5433, "timestamp_epoch": "1552961706.736226000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-54d84925e14b2e7f327c00bb", "src_port": null, "tcp_stream": 76, "udp_stream": null, "frame_number": 5434, "timestamp_epoch": "1552961706.736445000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-eb0887a5b5cf81722ac57cb0", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 5501, "timestamp_epoch": "1552961911.409580000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c5b73886c5cf6fa9de83a410", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 5502, "timestamp_epoch": "1552961911.410049000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c606832198cfc8c99d921e60", "src_port": null, "tcp_stream": 77, "udp_stream": null, "frame_number": 5724, "timestamp_epoch": "1552962596.290788000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-2007edcf462c7f19fe0a8c0f", "src_port": null, "tcp_stream": 77, "udp_stream": null, "frame_number": 5725, "timestamp_epoch": "1552962596.290975000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8c4c12438cd9273158729238", "src_port": null, "tcp_stream": 77, "udp_stream": null, "frame_number": 5726, "timestamp_epoch": "1552962596.291163000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-ad7744d1d92cd98a679c7da1", "src_port": null, "tcp_stream": 77, "udp_stream": null, "frame_number": 5730, "timestamp_epoch": "1552962596.292555000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0ec34b8b45225f340fd43638", "src_port": null, "tcp_stream": 77, "udp_stream": null, "frame_number": 5731, "timestamp_epoch": "1552962596.293448000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-e82cd7ecf1a91a99090e2d45", "src_port": null, "tcp_stream": 77, "udp_stream": null, "frame_number": 5732, "timestamp_epoch": "1552962596.293922000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-555ed03030d9182ff978ae4f", "src_port": null, "tcp_stream": 77, "udp_stream": null, "frame_number": 5733, "timestamp_epoch": "1552962596.294056000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-08052ada807d4b7a37fa1955", "src_port": null, "tcp_stream": 77, "udp_stream": null, "frame_number": 5734, "timestamp_epoch": "1552962596.294471000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1f05ed245e7d4900dd660883", "src_port": null, "tcp_stream": 77, "udp_stream": null, "frame_number": 5735, "timestamp_epoch": "1552962596.294732000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-53e48592b1e99b2a068067e1", "src_port": null, "tcp_stream": 77, "udp_stream": null, "frame_number": 5740, "timestamp_epoch": "1552962606.733289000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-fbec58ce6818cbb441049987", "src_port": null, "tcp_stream": 77, "udp_stream": null, "frame_number": 5741, "timestamp_epoch": "1552962606.733542000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-3d8158a8936bb76f64204821", "src_port": null, "tcp_stream": 77, "udp_stream": null, "frame_number": 5742, "timestamp_epoch": "1552962606.733730000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-18d178a900b4827ffae46622", "src_port": null, "tcp_stream": 77, "udp_stream": null, "frame_number": 5743, "timestamp_epoch": "1552962606.733938000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-78da6d0cbd9d01fbeac9c154", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 6704, "timestamp_epoch": "1552963496.334065000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-6b758ab4668503789deae2db", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 6705, "timestamp_epoch": "1552963496.334426000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d38f734a051d871f849156dd", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 6706, "timestamp_epoch": "1552963496.334638000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-94459cdafe27f5eff2a9af5b", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 6710, "timestamp_epoch": "1552963496.336025000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7807ad3be40ac529b63df2bc", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 6711, "timestamp_epoch": "1552963496.336651000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-72f8b320ed097061a427f3b3", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 6712, "timestamp_epoch": "1552963496.337124000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1256abc1fd2462de1da55527", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 6713, "timestamp_epoch": "1552963496.337280000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-06c12396b0813be9e0d7a818", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 6714, "timestamp_epoch": "1552963496.337835000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a5b10c911a98546671d25c71", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 6715, "timestamp_epoch": "1552963496.338103000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-010ed1366750499728ae8442", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 6720, "timestamp_epoch": "1552963506.759032000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-178f028f770af32a5a0228e7", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 6721, "timestamp_epoch": "1552963506.759327000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-0684bca87ea228f8f1d7590a", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 6722, "timestamp_epoch": "1552963506.759715000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-fcae21cf72decfaebf6887f4", "src_port": null, "tcp_stream": 84, "udp_stream": null, "frame_number": 6723, "timestamp_epoch": "1552963506.759932000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-4d840575d82654ad472277c4", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 7042, "timestamp_epoch": "1552964396.365029000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-5c783e783f5805b2e02ca0d0", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 7043, "timestamp_epoch": "1552964396.365243000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-cda0f8c62eab63cbd6b1aa5c", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 7044, "timestamp_epoch": "1552964396.365419000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-87a748a688327bd8cd2bcb20", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 7048, "timestamp_epoch": "1552964396.366653000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6cde7edf26e528126205ae6f", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 7049, "timestamp_epoch": "1552964396.367501000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-1892f143317d6c3aed311c87", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 7050, "timestamp_epoch": "1552964396.367969000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-45c027ba95ade18ccfce7944", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 7051, "timestamp_epoch": "1552964396.368097000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-a5d207a85306822cc7c39709", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 7052, "timestamp_epoch": "1552964396.368450000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-958b362af4bc3e58b0e505cb", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 7053, "timestamp_epoch": "1552964396.368736000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-ab61024c6ca0b8ee0b3aa0aa", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 7058, "timestamp_epoch": "1552964406.756744000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-b53b0f97af31b880de74e907", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 7059, "timestamp_epoch": "1552964406.756995000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-b6675aa0516193ac31d0eeb9", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 7060, "timestamp_epoch": "1552964406.757539000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-40fde951dbddd7b61eb395ae", "src_port": null, "tcp_stream": 87, "udp_stream": null, "frame_number": 7061, "timestamp_epoch": "1552964406.757721000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-ac92adb064af9ec7961a8619", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 7380, "timestamp_epoch": "1552965296.390500000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-7e6ae76a6192908ba5db3fc8", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 7381, "timestamp_epoch": "1552965296.390830000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3b94b399de17b82af51a35a2", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 7382, "timestamp_epoch": "1552965296.391008000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-d8ec9830a7a83a8eb04d01e5", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 7386, "timestamp_epoch": "1552965296.392952000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-765c4ec38678874307369194", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 7387, "timestamp_epoch": "1552965296.393558000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-79509fc0f24fcd032fe97f80", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 7388, "timestamp_epoch": "1552965296.394399000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1c677f7f1a6db5e216d44bd7", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 7389, "timestamp_epoch": "1552965296.394566000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-18419064620caf1721bb1645", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 7390, "timestamp_epoch": "1552965296.395205000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e9897cff24640514f5e48253", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 7391, "timestamp_epoch": "1552965296.395536000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-a0c7b67536e3aaa807672270", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 7396, "timestamp_epoch": "1552965306.752229000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-167aaa3e60e3218048e02a86", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 7397, "timestamp_epoch": "1552965306.752465000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-717fe5dee9b2649da34ae251", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 7398, "timestamp_epoch": "1552965306.752839000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-56cba4c11504d45a3df5a38f", "src_port": null, "tcp_stream": 90, "udp_stream": null, "frame_number": 7399, "timestamp_epoch": "1552965306.753018000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-7aa01d60538fffc4740e5e13", "src_port": null, "tcp_stream": 93, "udp_stream": null, "frame_number": 7542, "timestamp_epoch": "1552965682.138339000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a84d9230d7c1a85b6c064e36", "src_port": null, "tcp_stream": 93, "udp_stream": null, "frame_number": 7544, "timestamp_epoch": "1552965682.139166000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-9b25e43eb78b4fffa144b9da", "src_port": null, "tcp_stream": 93, "udp_stream": null, "frame_number": 7545, "timestamp_epoch": "1552965682.139544000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-f17f53fbef53a6850a6711ba", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 7568, "timestamp_epoch": "1552965682.549474000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-4870f8eda4ca9f8ae4313be1", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 7570, "timestamp_epoch": "1552965682.550027000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-6c570fc43705c7075ae91174", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 7579, "timestamp_epoch": "1552965682.670156000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-87e919d29a2fe55afa2768bd", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 7581, "timestamp_epoch": "1552965682.671009000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0d61647b5d5720ee5778796d", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 7592, "timestamp_epoch": "1552965682.677474000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-886fad30b616843424d82139", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 7593, "timestamp_epoch": "1552965682.677788000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6629d53cc11e6f44dc28fbac", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 7594, "timestamp_epoch": "1552965682.677945000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-e185e70425cf403b9b92ca64", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 7598, "timestamp_epoch": "1552965682.679155000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e4dbe578976f446d1cb977f3", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 7599, "timestamp_epoch": "1552965682.679820000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-db4505bb13b33976432aa5d5", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 7600, "timestamp_epoch": "1552965682.680253000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-145bad3b40ff8177ed7b929d", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 7601, "timestamp_epoch": "1552965682.680462000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-557ec34598c584c9cee84ce3", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 7602, "timestamp_epoch": "1552965682.680763000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-27362f9b808a33a4e3d9d680", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 7603, "timestamp_epoch": "1552965682.682772000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-c105296c104136c18bf418c8", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 7604, "timestamp_epoch": "1552965682.683142000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7be31eb92259e5c4ef140179", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 7605, "timestamp_epoch": "1552965682.683368000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-c238c775df530e9ee122503c", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 7606, "timestamp_epoch": "1552965682.683801000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6aa44189472deb9a9433eed5", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 7607, "timestamp_epoch": "1552965682.683952000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-6f0cfd81752cd6a3a0227ce3", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 7608, "timestamp_epoch": "1552965682.684459000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-ce346b42b40c4fb61990692f", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 7609, "timestamp_epoch": "1552965682.684746000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-0efc15d38735069a6f005254", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 7610, "timestamp_epoch": "1552965682.685067000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-79ca90be70842609c63c93db", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 7611, "timestamp_epoch": "1552965682.685229000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-a6580709b8f6e9d0a550be46", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 7624, "timestamp_epoch": "1552965696.751854000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-539a01244419f5f9249935ff", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 7625, "timestamp_epoch": "1552965696.752132000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-3226e395e25b5b09d6d36044", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 7638, "timestamp_epoch": "1552965708.750621000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d9399bc51c056381affa813f", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 7639, "timestamp_epoch": "1552965708.750991000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-2f2793062a97c82f54179b49", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 7648, "timestamp_epoch": "1552965720.746016000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-643bf2f776cbf9885f09a857", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 7649, "timestamp_epoch": "1552965720.746334000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-f2cd04e7657711d462082228", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 7650, "timestamp_epoch": "1552965720.746571000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d8e973d274dde882a21c2b55", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 7651, "timestamp_epoch": "1552965720.746780000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-b63cf450753162943fe94a60", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 7702, "timestamp_epoch": "1552965837.424781000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0afe3aafda50796c5725c7d0", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 7704, "timestamp_epoch": "1552965837.425516000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-bafb2a8b2058f98ed9155a79", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 7705, "timestamp_epoch": "1552965837.425783000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-37ffd8584108a26da94934b0", "src_port": null, "tcp_stream": 99, "udp_stream": null, "frame_number": 7719, "timestamp_epoch": "1552965837.937986000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3f18e197c8dd350e91c6701c", "src_port": null, "tcp_stream": 99, "udp_stream": null, "frame_number": 7721, "timestamp_epoch": "1552965837.938643000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-cbe8272b377f04a1a3a30c9d", "src_port": null, "tcp_stream": 100, "udp_stream": null, "frame_number": 7728, "timestamp_epoch": "1552965837.948519000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-28e1d9a33064d2a33745c8d4", "src_port": null, "tcp_stream": 101, "udp_stream": null, "frame_number": 7734, "timestamp_epoch": "1552965837.950685000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3379617853a6fad444746fea", "src_port": null, "tcp_stream": 101, "udp_stream": null, "frame_number": 7736, "timestamp_epoch": "1552965837.951264000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-eb5237b458abcb118a69c15f", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 7747, "timestamp_epoch": "1552965837.955889000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-b01dbaa816940b5d54ba287d", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 7748, "timestamp_epoch": "1552965837.956060000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-b7836991607fcfdd0ddfa62d", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 7749, "timestamp_epoch": "1552965837.956333000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-de89be2306ffa84f303cabd0", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 7753, "timestamp_epoch": "1552965837.957259000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-27bf9a26dd29daa34ae2cde5", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 7754, "timestamp_epoch": "1552965837.957759000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-a7f3abe85ab0b6e8b2b33988", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 7755, "timestamp_epoch": "1552965837.958155000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "BOBBY-TIGER-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6ed6ba7fdb5eea09ce9bb8f9", "src_port": null, "tcp_stream": 100, "udp_stream": null, "frame_number": 7757, "timestamp_epoch": "1552965837.958626000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0efb48ed069c0b7dc80327a7", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 7758, "timestamp_epoch": "1552965837.958722000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-b3a6f99579439e5591ac9990", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 7765, "timestamp_epoch": "1552965837.959269000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-a4117cea5f40425ffbec4af2", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 7768, "timestamp_epoch": "1552965837.959467000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-caabdc093c3e84e8aa7ec188", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 7769, "timestamp_epoch": "1552965837.959546000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-93a440698666d011e16e4d7e", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 7771, "timestamp_epoch": "1552965837.959859000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a0e92f71e85cffeac6db0e14", "src_port": null, "tcp_stream": 103, "udp_stream": null, "frame_number": 7772, "timestamp_epoch": "1552965837.960014000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d9b12b12b72be55237db3f58", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 7773, "timestamp_epoch": "1552965837.960115000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-20e772aba26f64c481b6117a", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 7796, "timestamp_epoch": "1552965864.748126000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-5e5df54aa344e6b17a26f3d7", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 7797, "timestamp_epoch": "1552965864.748406000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-bec687033349e8ac89378ff4", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 7808, "timestamp_epoch": "1552965876.745445000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-43f04d0a7f61b3cf5e66596a", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 7809, "timestamp_epoch": "1552965876.745727000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-0f8ad4e4abcaea7be508b755", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 7810, "timestamp_epoch": "1552965876.746208000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-88dff2b4ea22d7cec5dde7aa", "src_port": null, "tcp_stream": 102, "udp_stream": null, "frame_number": 7811, "timestamp_epoch": "1552965876.746427000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-51008acd7679aef7180e7b81", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 7919, "timestamp_epoch": "1552966196.420349000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-d87e8f1a9f79601a1bccd716", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 7920, "timestamp_epoch": "1552966196.420685000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e523a627ed25827469c94565", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 7921, "timestamp_epoch": "1552966196.420932000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-32ddfbb277ebb513baef2631", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 7925, "timestamp_epoch": "1552966196.422269000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7e6bfac7a60bcedbe770b6e1", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 7926, "timestamp_epoch": "1552966196.423000000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-399126fb7c5ebed2953a7417", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 7927, "timestamp_epoch": "1552966196.423427000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6a867a3d0900883b6f6f926a", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 7928, "timestamp_epoch": "1552966196.423544000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-554a4c2ddfdc48ef12011c1a", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 7929, "timestamp_epoch": "1552966196.423876000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-48143b8ce5feed92ae2dfb90", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 7930, "timestamp_epoch": "1552966196.424102000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-a8750893896f5b4d71fee754", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 7935, "timestamp_epoch": "1552966206.748335000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-bf9588f92a88edb5b82c5849", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 7936, "timestamp_epoch": "1552966206.748601000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-520227a06efc797b5ea28b40", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 7937, "timestamp_epoch": "1552966206.748850000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c90031e09dfd83dcedbb2c38", "src_port": null, "tcp_stream": 104, "udp_stream": null, "frame_number": 7938, "timestamp_epoch": "1552966206.749066000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-93fa4ddc712fd08e7884630b", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 8276, "timestamp_epoch": "1552967096.446713000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-4c00a583cae51f5562a29455", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 8277, "timestamp_epoch": "1552967096.446924000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-740f6d9493003b5c161dfe82", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 8278, "timestamp_epoch": "1552967096.447101000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-3f29b7390466b02878560f06", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 8282, "timestamp_epoch": "1552967096.448429000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-2f0109a8ce1e56c44c0896b3", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 8283, "timestamp_epoch": "1552967096.449054000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-7e97935868e0f7df1e548067", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 8284, "timestamp_epoch": "1552967096.449703000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c94fd7ab21bfb9d2d891a284", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 8285, "timestamp_epoch": "1552967096.449843000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-feef782f205fe8b563f25047", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 8286, "timestamp_epoch": "1552967096.450269000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-33e942956139049159574b41", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 8287, "timestamp_epoch": "1552967096.450468000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-5cbf61d3b5b4421ac457e322", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 8295, "timestamp_epoch": "1552967106.745436000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-5e1179526c575775c523cd93", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 8296, "timestamp_epoch": "1552967106.745666000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-a7582046244df696653f942a", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 8297, "timestamp_epoch": "1552967106.745954000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6dc44a11965c605ac3999971", "src_port": null, "tcp_stream": 109, "udp_stream": null, "frame_number": 8298, "timestamp_epoch": "1552967106.746147000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-88f70e41dad4497acb6033a6", "src_port": null, "tcp_stream": 112, "udp_stream": null, "frame_number": 8612, "timestamp_epoch": "1552967996.476736000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-21b17112e7c59020c8c4a88d", "src_port": null, "tcp_stream": 112, "udp_stream": null, "frame_number": 8613, "timestamp_epoch": "1552967996.476942000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-9fcad3b7144f210c7a25a0e2", "src_port": null, "tcp_stream": 112, "udp_stream": null, "frame_number": 8614, "timestamp_epoch": "1552967996.477122000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-64f4fc9dd34521630455bda4", "src_port": null, "tcp_stream": 112, "udp_stream": null, "frame_number": 8618, "timestamp_epoch": "1552967996.478793000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-aeecd4a98982cc638410d76f", "src_port": null, "tcp_stream": 112, "udp_stream": null, "frame_number": 8619, "timestamp_epoch": "1552967996.479607000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-566b6fb65a7f844bfd39689b", "src_port": null, "tcp_stream": 112, "udp_stream": null, "frame_number": 8620, "timestamp_epoch": "1552967996.480036000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e9f87b7eb503905d5ca376ad", "src_port": null, "tcp_stream": 112, "udp_stream": null, "frame_number": 8621, "timestamp_epoch": "1552967996.480164000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-bf6506252ac6a0ddf2bbf2bd", "src_port": null, "tcp_stream": 112, "udp_stream": null, "frame_number": 8622, "timestamp_epoch": "1552967996.480551000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0850f5bbf55856125bfb61e3", "src_port": null, "tcp_stream": 112, "udp_stream": null, "frame_number": 8623, "timestamp_epoch": "1552967996.480852000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-59bd42e2c207591579b8edfd", "src_port": null, "tcp_stream": 112, "udp_stream": null, "frame_number": 8628, "timestamp_epoch": "1552968006.757045000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-12cc27603eb8e63c9dae7d73", "src_port": null, "tcp_stream": 112, "udp_stream": null, "frame_number": 8629, "timestamp_epoch": "1552968006.757325000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-d6f929b7876e813a1ae07618", "src_port": null, "tcp_stream": 112, "udp_stream": null, "frame_number": 8630, "timestamp_epoch": "1552968006.757968000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-72844a6e48739a5d5a0d1a1a", "src_port": null, "tcp_stream": 112, "udp_stream": null, "frame_number": 8631, "timestamp_epoch": "1552968006.758161000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-398badbefa55d7d08c2267e0", "src_port": null, "tcp_stream": 115, "udp_stream": null, "frame_number": 8948, "timestamp_epoch": "1552968896.501093000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-6de66e83b0f0f3573f21ad4b", "src_port": null, "tcp_stream": 115, "udp_stream": null, "frame_number": 8949, "timestamp_epoch": "1552968896.501311000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-cf80d457937b03fdc5ab6165", "src_port": null, "tcp_stream": 115, "udp_stream": null, "frame_number": 8950, "timestamp_epoch": "1552968896.501527000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-47946ebf8eaf5d2baf5db1f5", "src_port": null, "tcp_stream": 115, "udp_stream": null, "frame_number": 8954, "timestamp_epoch": "1552968896.502869000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d30679a7f5eb34129fcd797a", "src_port": null, "tcp_stream": 115, "udp_stream": null, "frame_number": 8955, "timestamp_epoch": "1552968896.503473000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-6be943f6695e225fc4358044", "src_port": null, "tcp_stream": 115, "udp_stream": null, "frame_number": 8956, "timestamp_epoch": "1552968896.503937000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-455ef053a9aea78466836fea", "src_port": null, "tcp_stream": 115, "udp_stream": null, "frame_number": 8957, "timestamp_epoch": "1552968896.504155000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-69640e285e0bdb27b4097708", "src_port": null, "tcp_stream": 115, "udp_stream": null, "frame_number": 8958, "timestamp_epoch": "1552968896.504604000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a22d6d5fbc66f55b7307a27b", "src_port": null, "tcp_stream": 115, "udp_stream": null, "frame_number": 8959, "timestamp_epoch": "1552968896.504893000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-7c21537c8f7f80e0dcfb005b", "src_port": null, "tcp_stream": 115, "udp_stream": null, "frame_number": 8964, "timestamp_epoch": "1552968906.754497000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1b0ee44f498e5830e8aea1a9", "src_port": null, "tcp_stream": 115, "udp_stream": null, "frame_number": 8965, "timestamp_epoch": "1552968906.754801000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-5853da481ae423cd2d7f78ab", "src_port": null, "tcp_stream": 115, "udp_stream": null, "frame_number": 8966, "timestamp_epoch": "1552968906.755089000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-37633290d285bf9c1784cd50", "src_port": null, "tcp_stream": 115, "udp_stream": null, "frame_number": 8967, "timestamp_epoch": "1552968906.755394000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-524ffbef0e2e2fbd6081b27c", "src_port": null, "tcp_stream": 116, "udp_stream": null, "frame_number": 9256, "timestamp_epoch": "1552969796.532493000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-50d9b7cbbbba065ce1451cea", "src_port": null, "tcp_stream": 116, "udp_stream": null, "frame_number": 9257, "timestamp_epoch": "1552969796.532673000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-95ea4921de26d023e95376b1", "src_port": null, "tcp_stream": 116, "udp_stream": null, "frame_number": 9258, "timestamp_epoch": "1552969796.532878000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-b6e36d2e11abd74973820b51", "src_port": null, "tcp_stream": 116, "udp_stream": null, "frame_number": 9262, "timestamp_epoch": "1552969796.534327000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-57bf7425f506ba2616d20846", "src_port": null, "tcp_stream": 116, "udp_stream": null, "frame_number": 9263, "timestamp_epoch": "1552969796.535008000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-39ac261ca8ca86f40fb08ea3", "src_port": null, "tcp_stream": 116, "udp_stream": null, "frame_number": 9264, "timestamp_epoch": "1552969796.535423000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-453457bad20c01f76196f3df", "src_port": null, "tcp_stream": 116, "udp_stream": null, "frame_number": 9265, "timestamp_epoch": "1552969796.535575000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-9099e3587a17e9dc634278c7", "src_port": null, "tcp_stream": 116, "udp_stream": null, "frame_number": 9266, "timestamp_epoch": "1552969796.535891000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-4d604b6ff7ce2397470b3bad", "src_port": null, "tcp_stream": 116, "udp_stream": null, "frame_number": 9267, "timestamp_epoch": "1552969796.536244000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-55a12c373d3a072613014b2d", "src_port": null, "tcp_stream": 116, "udp_stream": null, "frame_number": 9272, "timestamp_epoch": "1552969806.751845000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8150b6436097d33f67e550e9", "src_port": null, "tcp_stream": 116, "udp_stream": null, "frame_number": 9273, "timestamp_epoch": "1552969806.752148000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-27f71f9948d89851058c1068", "src_port": null, "tcp_stream": 116, "udp_stream": null, "frame_number": 9274, "timestamp_epoch": "1552969806.752324000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-f80c6fc1f72cfbf6f1885fb3", "src_port": null, "tcp_stream": 116, "udp_stream": null, "frame_number": 9275, "timestamp_epoch": "1552969806.752548000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1e7465924502517a75874a5b", "src_port": null, "tcp_stream": 119, "udp_stream": null, "frame_number": 9837, "timestamp_epoch": "1552970696.557911000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-76a0a56d006c5822f22c370d", "src_port": null, "tcp_stream": 119, "udp_stream": null, "frame_number": 9838, "timestamp_epoch": "1552970696.558110000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6d10d53176ff8ed0eb37a33e", "src_port": null, "tcp_stream": 119, "udp_stream": null, "frame_number": 9839, "timestamp_epoch": "1552970696.558293000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-538d251c528d829944f1248c", "src_port": null, "tcp_stream": 119, "udp_stream": null, "frame_number": 9843, "timestamp_epoch": "1552970696.559622000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-063bde16be9b4634a02ab37f", "src_port": null, "tcp_stream": 119, "udp_stream": null, "frame_number": 9844, "timestamp_epoch": "1552970696.560234000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-771901006ea3c62e8f746b6e", "src_port": null, "tcp_stream": 119, "udp_stream": null, "frame_number": 9845, "timestamp_epoch": "1552970696.560615000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-5160ea3ffd1c25bead30780e", "src_port": null, "tcp_stream": 119, "udp_stream": null, "frame_number": 9846, "timestamp_epoch": "1552970696.560735000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-1884fc83fd4208732517b51d", "src_port": null, "tcp_stream": 119, "udp_stream": null, "frame_number": 9847, "timestamp_epoch": "1552970696.561142000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-f2182339230606df7478fdfb", "src_port": null, "tcp_stream": 119, "udp_stream": null, "frame_number": 9848, "timestamp_epoch": "1552970696.561465000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-e6668bbcbb76f80a80fc7c94", "src_port": null, "tcp_stream": 119, "udp_stream": null, "frame_number": 9853, "timestamp_epoch": "1552970706.747407000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8592c255b7b24490b765c063", "src_port": null, "tcp_stream": 119, "udp_stream": null, "frame_number": 9854, "timestamp_epoch": "1552970706.747675000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-a60d36b096b9ee435159ed80", "src_port": null, "tcp_stream": 119, "udp_stream": null, "frame_number": 9855, "timestamp_epoch": "1552970706.748165000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c2b2c3e9e0deb5a16ee87393", "src_port": null, "tcp_stream": 119, "udp_stream": null, "frame_number": 9856, "timestamp_epoch": "1552970706.748334000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-6318c01bf42a7af41b9b763d", "src_port": null, "tcp_stream": null, "udp_stream": 34, "frame_number": 9921, "timestamp_epoch": "1552970839.815224000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "LITTLETIGERS<1b>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-87f77991f6d00f6304d88caf", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 9922, "timestamp_epoch": "1552970839.815392000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "nbns.name": "LITTLETIGERS<1b> (Domain Master Browser)", "nbns.flags.opcode": "0", "nbns.flags.response": "True", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a190d83332ad0fd34fe25929", "src_port": null, "tcp_stream": null, "udp_stream": 35, "frame_number": 9923, "timestamp_epoch": "1552970839.815497000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-bda0ed3d5a5279c5bdd9351c", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 9924, "timestamp_epoch": "1552970839.815688000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-560d2258522f80b5cc07f328", "src_port": null, "tcp_stream": null, "udp_stream": 34, "frame_number": 9927, "timestamp_epoch": "1552970840.832286000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-6393313e42c1931d97ce0977", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 9928, "timestamp_epoch": "1552970840.832446000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-ccbc4e002a718cdb90e9aa3f", "src_port": null, "tcp_stream": null, "udp_stream": 34, "frame_number": 9929, "timestamp_epoch": "1552970841.843934000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-8a5b5fa56b5ad02e8870e606", "src_port": null, "tcp_stream": null, "udp_stream": 36, "frame_number": 9930, "timestamp_epoch": "1552970841.844108000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "LITTLETIGERS<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-3b2c00a19840941d48a5269e", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 9931, "timestamp_epoch": "1552970842.857955000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "LITTLETIGERS<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-2fee9a2869ccff684b21ac74", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 9932, "timestamp_epoch": "1552970843.621914000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "LITTLETIGERS<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-8bf6d883124ff3ce4e24cfcb", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 9933, "timestamp_epoch": "1552970844.388275000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "64:32:a8:57:2b:42", "dns.qry.name": "wpad" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-17ef09cd9ace2bff062f7999", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 9941, "timestamp_epoch": "1552970846.198230000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "64:32:a8:57:2b:42", "dns.qry.name": "wpad" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-4d2d5343a8af25d1075080db", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 9945, "timestamp_epoch": "1552970846.304934000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-610eef7c8bf87aa17b536640", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 9946, "timestamp_epoch": "1552970846.508268000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-6f74a09de19565436d5a3df5", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 9947, "timestamp_epoch": "1552970847.272746000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-c9c9bb7a20b64d58213a9116", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 9948, "timestamp_epoch": "1552970848.038357000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-5f99068e897800a05c49701b", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 10974, "timestamp_epoch": "1552971245.358104000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-cd9c2545e2c51835e8d1f4ea", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 10984, "timestamp_epoch": "1552971246.119522000" }, { "kind": "identity", "dst_ip": "10.0.90.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "64:32:a8:57:2b:42", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-bb98e45e6785b412fa339629", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 11006, "timestamp_epoch": "1552971246.882500000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-584595670ad5664b842180f6", "src_port": null, "tcp_stream": 147, "udp_stream": null, "frame_number": 12623, "timestamp_epoch": "1552971443.320348000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-89677b6e760625abf48374fa", "src_port": null, "tcp_stream": 147, "udp_stream": null, "frame_number": 12625, "timestamp_epoch": "1552971443.320926000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-629b74579b721078cbce3d12", "src_port": null, "tcp_stream": 147, "udp_stream": null, "frame_number": 12626, "timestamp_epoch": "1552971443.321197000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-6af87f915d97572676bce453", "src_port": null, "tcp_stream": 148, "udp_stream": null, "frame_number": 12649, "timestamp_epoch": "1552971443.733466000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-efd54193cccb5ab2f263faba", "src_port": null, "tcp_stream": 148, "udp_stream": null, "frame_number": 12651, "timestamp_epoch": "1552971443.734069000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-435c6f1d4903bedd87209734", "src_port": null, "tcp_stream": 149, "udp_stream": null, "frame_number": 12660, "timestamp_epoch": "1552971443.851500000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-4bfebb74189e7285827c877d", "src_port": null, "tcp_stream": 149, "udp_stream": null, "frame_number": 12662, "timestamp_epoch": "1552971443.852189000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-84057ce71c528bd82b1fad8f", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 12673, "timestamp_epoch": "1552971443.858386000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-55d9755f01aefd25652b535f", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 12674, "timestamp_epoch": "1552971443.858510000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6b2bc8f0d7121126c5e7a737", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 12675, "timestamp_epoch": "1552971443.858679000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-9a53b312a4f6aeca3c7aab36", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 12679, "timestamp_epoch": "1552971443.859974000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-b7ff3ed20657f6dbcfcb0182", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 12680, "timestamp_epoch": "1552971443.860531000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-b9f3af8fbc529993d19ebe03", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 12681, "timestamp_epoch": "1552971443.861011000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-da4f69ff879198e3ce1d9c69", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 12682, "timestamp_epoch": "1552971443.861163000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-51fe81a149252141ef13ab37", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 12683, "timestamp_epoch": "1552971443.861488000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-bb7a4e6888d4352b6e156e2c", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 12684, "timestamp_epoch": "1552971443.861786000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-54f50252d4e0396ee9d2e054", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 12685, "timestamp_epoch": "1552971443.862093000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e114301d60b0e1684abffd1f", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 12686, "timestamp_epoch": "1552971443.862356000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-1b5f3cb7ed6abaecaf6ae620", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 12687, "timestamp_epoch": "1552971443.862680000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-480faaae298a5f2346e3b45d", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 12688, "timestamp_epoch": "1552971443.862852000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-2235bb6d27197ccd24f9088a", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 12689, "timestamp_epoch": "1552971443.863377000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-974c1d0c524bf3e49119fbeb", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 12690, "timestamp_epoch": "1552971443.863757000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-776e03638fc4c997bfb6a2f7", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 12691, "timestamp_epoch": "1552971443.864260000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7177ec9256b1915154d3632c", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 12692, "timestamp_epoch": "1552971443.864433000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-87bd3f9439a44a514815c309", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 12706, "timestamp_epoch": "1552971456.749777000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0033f6a25e2160aa295cfc36", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 12707, "timestamp_epoch": "1552971456.750068000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-e1cfa9c1a517d72a7ea38985", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 12719, "timestamp_epoch": "1552971468.746619000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-264db75fec4fb8b70f7e3730", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 12720, "timestamp_epoch": "1552971468.746990000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-897baa44558f4935eeb5ebfd", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 12729, "timestamp_epoch": "1552971480.759012000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1684da172c9772dfe5ee1aee", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 12730, "timestamp_epoch": "1552971480.759313000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-e5c187292ba9f4fecb04b75d", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 12731, "timestamp_epoch": "1552971480.759585000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1e1c6b6e3e18f9b01579309b", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 12732, "timestamp_epoch": "1552971480.759796000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-581f2449446974c796a0d645", "src_port": null, "tcp_stream": 152, "udp_stream": null, "frame_number": 12780, "timestamp_epoch": "1552971595.632378000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-406069ec6a8bf74e7bbb465f", "src_port": null, "tcp_stream": 152, "udp_stream": null, "frame_number": 12782, "timestamp_epoch": "1552971595.632896000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-37486e801a35b691faa87e43", "src_port": null, "tcp_stream": 152, "udp_stream": null, "frame_number": 12783, "timestamp_epoch": "1552971595.633145000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-56b376bbaec15f79f825099c", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 12791, "timestamp_epoch": "1552971595.721401000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-f4b2c67f1d34784cbd0d81a0", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 12792, "timestamp_epoch": "1552971595.721872000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-2f7c0480c7bc1ed28a3d6444", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 12793, "timestamp_epoch": "1552971595.722457000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-397e050e563920433232b14e", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 12794, "timestamp_epoch": "1552971595.826927000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1e03daebb4861b06b1b46f36", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 12804, "timestamp_epoch": "1552971596.582697000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-92962ce5fc3e299b59b62765", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 12805, "timestamp_epoch": "1552971596.582812000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d094d6aaf9806a8d6e2d84db", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 12806, "timestamp_epoch": "1552971596.582978000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-e3f8e27018ce94e944190d4d", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 12810, "timestamp_epoch": "1552971596.583996000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-617e2c44d57ff99462ed77ac", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 12811, "timestamp_epoch": "1552971596.584544000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-26abf88d79a412540b55ec0b", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 12812, "timestamp_epoch": "1552971596.584852000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1795bffac477bbfcd1168f19", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 12813, "timestamp_epoch": "1552971596.584960000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-1d478162a44fa402d0262fd4", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 12814, "timestamp_epoch": "1552971596.585167000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-5d0867f46f216d56017f3638", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 12815, "timestamp_epoch": "1552971596.585410000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-d7a870b3d8c8241830626f63", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 12820, "timestamp_epoch": "1552971606.744744000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-23da0d5f5dea6d1aec5cb31d", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 12821, "timestamp_epoch": "1552971606.745014000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-ed94dd180bf16efac8bc9ef3", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 12822, "timestamp_epoch": "1552971606.745462000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0b0a214efdf30fe891ed4313", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 12823, "timestamp_epoch": "1552971606.745820000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-6502f8eb3a19489d573fc3b1", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 12824, "timestamp_epoch": "1552971606.746574000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-ff21c28fc45954bd893e6697", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 12825, "timestamp_epoch": "1552971606.747035000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-78fff1764f1303541af184a0", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 12889, "timestamp_epoch": "1552971773.162618000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-677d560d6b5a1830491673e3", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 12890, "timestamp_epoch": "1552971773.162913000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-e148468ea2565ec52baf90aa", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 12906, "timestamp_epoch": "1552971778.499744000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-92a62abdc9482259e24bf767", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 12908, "timestamp_epoch": "1552971778.500305000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-a6e85782a61743a408c77728", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 12909, "timestamp_epoch": "1552971778.500581000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-429e1bdd2f172aca4202643e", "src_port": null, "tcp_stream": 156, "udp_stream": null, "frame_number": 12923, "timestamp_epoch": "1552971779.012324000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e9cb1c6d00ceaede95f8bd2f", "src_port": null, "tcp_stream": 156, "udp_stream": null, "frame_number": 12925, "timestamp_epoch": "1552971779.013048000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-e22746fcab0bcc9a0112a0ec", "src_port": null, "tcp_stream": 157, "udp_stream": null, "frame_number": 12934, "timestamp_epoch": "1552971779.121318000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d6fb64b705e70e4b9fa70328", "src_port": null, "tcp_stream": 157, "udp_stream": null, "frame_number": 12936, "timestamp_epoch": "1552971779.121877000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e2e7e82277b55ba2c8eabc49", "src_port": null, "tcp_stream": 158, "udp_stream": null, "frame_number": 12947, "timestamp_epoch": "1552971779.127164000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-a975a67599c5608371b76c9f", "src_port": null, "tcp_stream": 158, "udp_stream": null, "frame_number": 12948, "timestamp_epoch": "1552971779.127419000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-59cc99241cdb2fc0062c6425", "src_port": null, "tcp_stream": 158, "udp_stream": null, "frame_number": 12949, "timestamp_epoch": "1552971779.127657000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-92a8b14719f02a885ad95cd8", "src_port": null, "tcp_stream": 158, "udp_stream": null, "frame_number": 12953, "timestamp_epoch": "1552971779.128747000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-bbb80d295617997535a2ebbd", "src_port": null, "tcp_stream": 158, "udp_stream": null, "frame_number": 12955, "timestamp_epoch": "1552971779.129442000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-44dcb083f74c2e4f91b21804", "src_port": null, "tcp_stream": 159, "udp_stream": null, "frame_number": 12959, "timestamp_epoch": "1552971779.129746000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-5a8fb6f33e7dd84e98ea5317", "src_port": null, "tcp_stream": 158, "udp_stream": null, "frame_number": 12961, "timestamp_epoch": "1552971779.129801000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e16ad81371b1935305e5811e", "src_port": null, "tcp_stream": 158, "udp_stream": null, "frame_number": 12962, "timestamp_epoch": "1552971779.130201000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-ab413119c871f0c32e881e05", "src_port": null, "tcp_stream": 158, "udp_stream": null, "frame_number": 12963, "timestamp_epoch": "1552971779.130723000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "BOBBY-TIGER-PC$" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-ce2d401e252c0a15c14495c9", "src_port": null, "tcp_stream": 159, "udp_stream": null, "frame_number": 12965, "timestamp_epoch": "1552971779.131034000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-b3cdd3317441a423e4d3ea73", "src_port": null, "tcp_stream": 158, "udp_stream": null, "frame_number": 12968, "timestamp_epoch": "1552971779.131309000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-071c4e0f408cc0d543489c8b", "src_port": null, "tcp_stream": 158, "udp_stream": null, "frame_number": 12973, "timestamp_epoch": "1552971779.131704000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-9bac1e3db459fdbbde6fe9df", "src_port": null, "tcp_stream": 158, "udp_stream": null, "frame_number": 12975, "timestamp_epoch": "1552971779.131890000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-275b0b3025dbc605b16681d5", "src_port": null, "tcp_stream": 160, "udp_stream": null, "frame_number": 12977, "timestamp_epoch": "1552971779.131904000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-dde53fe0fe556439547059e0", "src_port": null, "tcp_stream": 160, "udp_stream": null, "frame_number": 12979, "timestamp_epoch": "1552971779.132376000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-11788202d0f5d3cde4a09a9b", "src_port": null, "tcp_stream": 158, "udp_stream": null, "frame_number": 13003, "timestamp_epoch": "1552971804.761607000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-511262bc549b39427141ffde", "src_port": null, "tcp_stream": 158, "udp_stream": null, "frame_number": 13004, "timestamp_epoch": "1552971804.762054000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-b35f2bf950df4e2fd3bbab7b", "src_port": null, "tcp_stream": 158, "udp_stream": null, "frame_number": 13013, "timestamp_epoch": "1552971816.756646000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-56239cc68dbcb9fc0666d8b6", "src_port": null, "tcp_stream": 158, "udp_stream": null, "frame_number": 13014, "timestamp_epoch": "1552971816.756921000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-7817044055b13e40dcee77a5", "src_port": null, "tcp_stream": 158, "udp_stream": null, "frame_number": 13015, "timestamp_epoch": "1552971816.757401000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a358cb2b9f939a2641c356fc", "src_port": null, "tcp_stream": 158, "udp_stream": null, "frame_number": 13016, "timestamp_epoch": "1552971816.757562000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-cce7e2c9d279da8607db491c", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 13033, "timestamp_epoch": "1552971862.467675000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-f76ef658aa3fd8e63e343cac", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 13034, "timestamp_epoch": "1552971862.468201000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-55523cad7860f30d25b72914", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 13063, "timestamp_epoch": "1552971949.556694000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-6f60d8a6024b71b668a71460", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 13064, "timestamp_epoch": "1552971949.557085000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-2c716a46e03bebb9f67bcdc2", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 13084, "timestamp_epoch": "1552972015.726995000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7cccb1bd399d814c6c20c945", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 13085, "timestamp_epoch": "1552972015.727386000" }, { "kind": "identity", "dst_ip": "10.0.90.9", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "64:32:a8:57:2b:42" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-082b377d086f794f50b99b27", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 13114, "timestamp_epoch": "1552972101.638151000" }, { "kind": "identity", "dst_ip": "10.0.90.215", "fields": { "eth.dst": "64:32:a8:57:2b:42", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-b151683b7df4639bd4d31966", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 13115, "timestamp_epoch": "1552972101.638582000" } ], "http_request": [ { "kind": "http_request", "dst_ip": "209.121.139.185", "fields": { "http.host": "www.msftncsi.com", "http.user_agent": "Microsoft NCSI", "http.request.uri": "/ncsi.txt", "http.response_in": "410", "http.request.method": "GET", "http.request.full_uri": "http://www.msftncsi.com/ncsi.txt" }, "src_ip": "10.0.90.215", "dst_port": 80, "event_id": "evt-23871e1e5c790b784b0c971c", "src_port": 49183, "tcp_stream": 27, "udp_stream": null, "frame_number": 408, "timestamp_epoch": "1552959901.306324000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-9076b3b6dc9ff08e8a9a260c", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 736, "timestamp_epoch": "1552960016.262103000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-336048cc36af29f6b6f2cd6c", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 738, "timestamp_epoch": "1552960016.716756000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-2ab9feaafecd111bc9437da4", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 739, "timestamp_epoch": "1552960019.264886000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-8c9f6291041d3d37d85c69ab", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 740, "timestamp_epoch": "1552960019.717449000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-4fe6e5a9709ed826704492bb", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 746, "timestamp_epoch": "1552960022.275623000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-2bef4a722df67ae8a8c1bf37", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 747, "timestamp_epoch": "1552960022.728006000" }, { "kind": "http_request", "dst_ip": "209.141.34.8", "fields": { "http.host": "209.141.34.8", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/test1.exe", "http.response_in": "1523", "http.request.method": "GET", "http.request.full_uri": "http://209.141.34.8/test1.exe" }, "src_ip": "10.0.90.215", "dst_port": 80, "event_id": "evt-f7392415ad55a856cf858599", "src_port": 49204, "tcp_stream": 48, "udp_stream": null, "frame_number": 754, "timestamp_epoch": "1552960024.599220000" }, { "kind": "http_request", "dst_ip": "217.23.14.81", "fields": { "http.host": "217.23.14.81", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/f4.exe", "http.response_in": "1713", "http.request.method": "GET", "http.request.full_uri": "http://217.23.14.81/f4.exe" }, "src_ip": "10.0.90.215", "dst_port": 80, "event_id": "evt-a792eef43c8629c6d5b6670b", "src_port": 49206, "tcp_stream": 50, "udp_stream": null, "frame_number": 1553, "timestamp_epoch": "1552960186.057432000" }, { "kind": "http_request", "dst_ip": "173.205.6.202", "fields": { "http.host": "crl.microsoft.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/pki/crl/products/CSPCA.crl", "http.response_in": "2073", "http.request.method": "GET", "http.request.full_uri": "http://crl.microsoft.com/pki/crl/products/CSPCA.crl" }, "src_ip": "10.0.90.215", "dst_port": 80, "event_id": "evt-6f0a597a1609606e2ca6b214", "src_port": 49212, "tcp_stream": 56, "udp_stream": null, "frame_number": 2071, "timestamp_epoch": "1552961003.800356000" } ], "http_response": [ { "kind": "http_response", "dst_ip": "10.0.90.215", "fields": { "http.request_in": "408", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "14" }, "src_ip": "209.121.139.185", "dst_port": 49183, "event_id": "evt-41f88b6352a006e4cc95281e", "src_port": 80, "tcp_stream": 27, "udp_stream": null, "body_sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "frame_number": 410, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 14, "timestamp_epoch": "1552959901.315002000" }, { "kind": "http_response", "dst_ip": "10.0.90.215", "fields": { "http.request_in": "754", "http.content_type": "application/octet-stream", "http.response.code": "200", "http.content_length": "811520" }, "src_ip": "209.141.34.8", "dst_port": 49204, "event_id": "evt-bc34cb83136fb0104b004c84", "src_port": 80, "tcp_stream": 48, "udp_stream": null, "body_sha256": "2a9b0ed40f1f0bc0c13ff35d304689e9cadd633781cbcad1c2d2b92ced3f1c85", "frame_number": 1523, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 811520, "timestamp_epoch": "1552960024.930842000" }, { "kind": "http_response", "dst_ip": "10.0.90.215", "fields": { "http.request_in": "1553", "http.content_type": "application/octet-stream", "http.response.code": "200", "http.content_length": "176128" }, "src_ip": "217.23.14.81", "dst_port": 49206, "event_id": "evt-180d8d5852835b8cfe69377f", "src_port": 80, "tcp_stream": 50, "udp_stream": null, "body_sha256": "5865e801e6324166d6d05b39a14f2a8a798c6eb652831f78c2634f2b7a400eaf", "frame_number": 1713, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 176128, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 176128, "timestamp_epoch": "1552960186.860440000" }, { "kind": "http_response", "dst_ip": "10.0.90.215", "fields": { "http.request_in": "2071", "http.content_type": "application/octet-stream", "http.response.code": "200", "http.content_length": "506" }, "src_ip": "173.205.6.202", "dst_port": 49212, "event_id": "evt-e8db8b9866784d047434ffed", "src_port": 80, "tcp_stream": 56, "udp_stream": null, "body_sha256": "3ceb4a8069b2b9e5fdf508ef67d5af5b9d3e6a7b417919953a89fa9773e16440", "frame_number": 2073, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 506, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 506, "timestamp_epoch": "1552961003.830737000" } ], "tls_client_hello": [ { "kind": "tls_client_hello", "dst_ip": "31.22.4.176", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.215", "dst_port": 3389, "event_id": "evt-dc920fe25ed4a80072a919db", "src_port": 49213, "tcp_stream": 57, "udp_stream": null, "frame_number": 2078, "timestamp_epoch": "1552961004.196634000" }, { "kind": "tls_client_hello", "dst_ip": "31.22.4.176", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.0.90.215", "dst_port": 3389, "event_id": "evt-e0a03a389da3811cada2697b", "src_port": 49214, "tcp_stream": 58, "udp_stream": null, "frame_number": 2106, "timestamp_epoch": "1552961006.219930000" }, { "kind": "tls_client_hello", "dst_ip": "31.22.4.176", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.0.90.215", "dst_port": 3389, "event_id": "evt-24b5d4fc62afaada19b23786", "src_port": 49215, "tcp_stream": 59, "udp_stream": null, "frame_number": 2918, "timestamp_epoch": "1552961009.324785000" }, { "kind": "tls_client_hello", "dst_ip": "31.22.4.176", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.0.90.215", "dst_port": 3389, "event_id": "evt-2cb2975c9e7aa60d6a320c36", "src_port": 49216, "tcp_stream": 60, "udp_stream": null, "frame_number": 2935, "timestamp_epoch": "1552961014.877072000" }, { "kind": "tls_client_hello", "dst_ip": "203.45.1.75", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.215", "dst_port": 443, "event_id": "evt-a46a2794c5fbe2a128858106", "src_port": 49218, "tcp_stream": 62, "udp_stream": null, "frame_number": 3048, "timestamp_epoch": "1552961296.692913000" }, { "kind": "tls_client_hello", "dst_ip": "203.45.1.75", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.0.90.215", "dst_port": 443, "event_id": "evt-07e417cd80b55c4e6db082ea", "src_port": 49224, "tcp_stream": 68, "udp_stream": null, "frame_number": 4148, "timestamp_epoch": "1552961322.758145000" }, { "kind": "tls_client_hello", "dst_ip": "203.45.1.75", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.0.90.215", "dst_port": 443, "event_id": "evt-0b91d161374201ed136315c8", "src_port": 49226, "tcp_stream": 70, "udp_stream": null, "frame_number": 5202, "timestamp_epoch": "1552961360.165766000" }, { "kind": "tls_client_hello", "dst_ip": "203.45.1.75", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.0.90.215", "dst_port": 443, "event_id": "evt-2f056ec945e8cecc19a13473", "src_port": 49229, "tcp_stream": 73, "udp_stream": null, "frame_number": 5281, "timestamp_epoch": "1552961463.973937000" }, { "kind": "tls_client_hello", "dst_ip": "203.45.1.75", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.0.90.215", "dst_port": 443, "event_id": "evt-70b3ebc03a98b7b88192bdce", "src_port": 49235, "tcp_stream": 79, "udp_stream": null, "frame_number": 5780, "timestamp_epoch": "1552962675.268663000" }, { "kind": "tls_client_hello", "dst_ip": "203.45.1.75", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.0.90.215", "dst_port": 443, "event_id": "evt-49ebd75d50b66619df7a317c", "src_port": 49237, "tcp_stream": 81, "udp_stream": null, "frame_number": 6401, "timestamp_epoch": "1552962699.520895000" }, { "kind": "tls_client_hello", "dst_ip": "203.45.1.75", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.0.90.215", "dst_port": 443, "event_id": "evt-a60101858d7e96c841e501bf", "src_port": 49239, "tcp_stream": 83, "udp_stream": null, "frame_number": 6455, "timestamp_epoch": "1552962782.353047000" }, { "kind": "tls_client_hello", "dst_ip": "203.45.1.75", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.0.90.215", "dst_port": 443, "event_id": "evt-de3709b246265b31be93148d", "src_port": 49242, "tcp_stream": 86, "udp_stream": null, "frame_number": 6909, "timestamp_epoch": "1552964046.570150000" }, { "kind": "tls_client_hello", "dst_ip": "203.45.1.75", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.0.90.215", "dst_port": 443, "event_id": "evt-56700bf34414adcade19e70b", "src_port": 49245, "tcp_stream": 89, "udp_stream": null, "frame_number": 7337, "timestamp_epoch": "1552965224.997984000" }, { "kind": "tls_client_hello", "dst_ip": "203.45.1.75", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.0.90.215", "dst_port": 443, "event_id": "evt-0bc36667543e1f84b04d5732", "src_port": 49262, "tcp_stream": 106, "udp_stream": null, "frame_number": 8057, "timestamp_epoch": "1552966544.321444000" }, { "kind": "tls_client_hello", "dst_ip": "203.45.1.75", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.0.90.215", "dst_port": 443, "event_id": "evt-58cb3b5e001fdd9fe6c7b88e", "src_port": 49265, "tcp_stream": 111, "udp_stream": null, "frame_number": 8461, "timestamp_epoch": "1552967584.210126000" }, { "kind": "tls_client_hello", "dst_ip": "203.45.1.75", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.0.90.215", "dst_port": 443, "event_id": "evt-af20b09e2051de34e46eaa57", "src_port": 49268, "tcp_stream": 114, "udp_stream": null, "frame_number": 8910, "timestamp_epoch": "1552968837.840283000" }, { "kind": "tls_client_hello", "dst_ip": "203.45.1.75", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.0.90.215", "dst_port": 443, "event_id": "evt-6764b8537c174c6ab8243de7", "src_port": 49272, "tcp_stream": 118, "udp_stream": null, "frame_number": 9318, "timestamp_epoch": "1552969891.696646000" }, { "kind": "tls_client_hello", "dst_ip": "31.22.4.176", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.215", "dst_port": 3389, "event_id": "evt-e9ed5bbd8440dbfac7f2696e", "src_port": 49278, "tcp_stream": 124, "udp_stream": null, "frame_number": 10017, "timestamp_epoch": "1552971010.444374000" }, { "kind": "tls_client_hello", "dst_ip": "31.22.4.176", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.0.90.215", "dst_port": 3389, "event_id": "evt-ea28115be7c4cc58c14ee211", "src_port": 49279, "tcp_stream": 125, "udp_stream": null, "frame_number": 10044, "timestamp_epoch": "1552971012.444040000" }, { "kind": "tls_client_hello", "dst_ip": "31.22.4.176", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.0.90.215", "dst_port": 3389, "event_id": "evt-dbf27fe1044fe9e972619d21", "src_port": 49280, "tcp_stream": 126, "udp_stream": null, "frame_number": 10861, "timestamp_epoch": "1552971015.800625000" }, { "kind": "tls_client_hello", "dst_ip": "31.22.4.176", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.0.90.215", "dst_port": 3389, "event_id": "evt-8673cd8bfef081a77399c419", "src_port": 49281, "tcp_stream": 127, "udp_stream": null, "frame_number": 10881, "timestamp_epoch": "1552971021.360251000" }, { "kind": "tls_client_hello", "dst_ip": "203.45.1.75", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.215", "dst_port": 443, "event_id": "evt-0bfede3db71695d1533b7ab2", "src_port": 49283, "tcp_stream": 129, "udp_stream": null, "frame_number": 10980, "timestamp_epoch": "1552971245.605865000" }, { "kind": "tls_client_hello", "dst_ip": "115.112.43.81", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.215", "dst_port": 443, "event_id": "evt-d48f314b0b4d2a5184a020e2", "src_port": 49289, "tcp_stream": 135, "udp_stream": null, "frame_number": 11042, "timestamp_epoch": "1552971273.544551000" }, { "kind": "tls_client_hello", "dst_ip": "115.112.43.81", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.0.90.215", "dst_port": 443, "event_id": "evt-f9e05b60feef870df175b629", "src_port": 49295, "tcp_stream": 141, "udp_stream": null, "frame_number": 12187, "timestamp_epoch": "1552971296.995377000" }, { "kind": "tls_client_hello", "dst_ip": "46.105.131.77", "fields": { "tls.handshake.ja3": "74927e242d6c3febf8cb9cab10a7f889" }, "src_ip": "10.0.90.215", "dst_port": 443, "event_id": "evt-53b9aefa844f7dd9f606670a", "src_port": 49296, "tcp_stream": 142, "udp_stream": null, "frame_number": 12513, "timestamp_epoch": "1552971310.452040000" }, { "kind": "tls_client_hello", "dst_ip": "115.112.43.81", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.0.90.215", "dst_port": 443, "event_id": "evt-c1fabcd633be30b85fc34e26", "src_port": 49298, "tcp_stream": 144, "udp_stream": null, "frame_number": 12543, "timestamp_epoch": "1552971313.278154000" } ], "unclassified_tcp": [ { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49196, "event_id": "evt-dca13a11671345ae9ebef6cb", "src_port": 445, "tcp_stream": 40, "udp_stream": null, "frame_number": 1534, "timestamp_epoch": "1552960128.962409000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49196, "event_id": "evt-f9bea7d891fb1dd79843d970", "src_port": 445, "tcp_stream": 40, "udp_stream": null, "frame_number": 1736, "timestamp_epoch": "1552960248.973207000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49196, "event_id": "evt-80aafe8de42b382f1d872cc9", "src_port": 445, "tcp_stream": 40, "udp_stream": null, "frame_number": 1775, "timestamp_epoch": "1552960368.985038000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49196, "event_id": "evt-7eb865c71c994e97a20976d5", "src_port": 445, "tcp_stream": 40, "udp_stream": null, "frame_number": 1812, "timestamp_epoch": "1552960488.995601000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49196, "event_id": "evt-488e08dab010ffca046e41eb", "src_port": 445, "tcp_stream": 40, "udp_stream": null, "frame_number": 1849, "timestamp_epoch": "1552960609.008141000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49196, "event_id": "evt-82588896d56f448c0166c4b7", "src_port": 445, "tcp_stream": 40, "udp_stream": null, "frame_number": 1886, "timestamp_epoch": "1552960729.018570000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49196, "event_id": "evt-9e3df5dc266fe093a3113f16", "src_port": 445, "tcp_stream": 40, "udp_stream": null, "frame_number": 2000, "timestamp_epoch": "1552960849.028851000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "4c21757def5367c60417855009fe33529d72400c78e4d26f2cd7609222a55bbcdca96fc5c346cf68e72b5a4740ecce8bd9d55b8bc7d407b45552d03959a7629e3ee538989dd363184815f726dd95b37fcf0a8cb06332396d730aa86fece5f63f073236793cf367f9a420e4f549d8ef95893b7523117132493afbe233d3770c09ec3dda3986161ed14ebfa1fed381037c055fae08944e7b28ee9022252b7858c4ea23d05e9c5be166d2eeb3c985bf82067c00be53a9ded90de6c6f131593be26de74514bf16d7bf6af87ef02b5723e5aed0a5b5369ea878dd940841a23ae0c7dc6a9fd4f83f55a19c2e4d9204767309ed6b635aa8eaa48eb26a0729c258ae9a3f3c751e1f67e8a9c209ed48db8f731cf4bd6985e5cf4517502b20423f49febdb5d4cd42d1481ebde4a90cf00a20c0cb86883dfb3d8f6fb99f12a3a3c5944c34ec7ac8589c77689e9cbb963c39902b73ae0a7acc273890518791a5f269abc3343ec92e83d6b64150c10ec4be97fdeccc51c794c4730733022d60c4ded6e55ae3282d6ec238d2cc70dcba60194f5486fe6d6ed7705f635d47ef130a7cc19a855721bb974d18e0bf07a1a391d09fe58b324a85a3f2d5da450356e236b295c77853a99245f98038d7e6744ef227ffdecbe08f947f1426e9adbead3eedaae1265154aad4d7816db7cea9736de6f5967e379f821828b8f7b3c8032f51c13f60d5835e2c590af908217c8c8069896c40b6cdbafebf6d29b7a61b3168777c6ddcbb3093c7ab5c4590fcf7261560b9769e6a24b956da37d79d9c1212ec88ff6ea62923bf1fd66d873d6aa228d9b490300e6cb2dea3112df55c42f5e8d556f004974c2b94ea7de21e26ba874e5302d006720728f49b0be68abc49a74d2e9e05dbee436a8105db6fdc69bc76ff0e1014939b90337b3a465259ddf0021b3a15099432826fbc81cb895ce3ce4492b88e99c3fabffd089d466478062a447e3c34caaae5b6626aef2bedaa3e3e582db15218e69e76a9737e89fa2eefec721af4ef0f86685e7c6eb1f41e57bcce780ea4b59a8a6e901543924984551d4f7d36e9f6425af322f5924bb9129eedc300ab7a589a4c9e3aad4e35635bf2d5128d59a8b59db94184ea8d332008fa6c758e4bad104735668a41fc0dc024540683037835d7f0c5c38df71bd35fdc700fe85225d59dccc064dbc6af3d73452cb3899fe3a0767defb1183cf1fd43f228183d0daf35e8358c52c8272e2ab0c95f6426513f39bbec63cfef589b489ea308af37f461922c0d536d517aad574ae9ac14c9b84fe71205fdc4f0990cb28fd8125647c646f09e5140fcbff41689cf61c4d930d9e3713eb5590494dc7ec169d1c600a539ac2c5fff947717f6eab2964904676ae885b26527dabd6e6c779e75a7695d90bc292675f6f8ce882ef42933bdc4821520f8568d275e9c8fe9a32d957ced929d8577690f39a14f0f27f0b6bfd26ee87c3ce4c82a50a301b770c0b01bc11bbc6987917a6380676bfd37bc9937b360cd1cf4303d7d395d7dbb01597f5dc1f8e812efc014fecc4a7e6cc8d38f4795a219b5785e73ea8454f1aa776a62c4d0ffa887e4e99cb20257981a0c20199773b51cdaf0b6a003eb321335a1bbbef0a881846e5585bc5bea8d1d2c9e1b97cae82685026b02ac602112f1a114bfc9d8b294f0a67202df51beed2d3d59d515e93968632b6bad08aa66766022dbc76a69123fd63785c34f7192e8e9be5f6e50577db90411dee3c2da7102c92eb3fa5f8ec41e99c01d3e0f31ce0b40ef69fa5e0c08494400cc09eaa926a938eed2bdf9261dc0ad721116ff6264aa9e24aa1228ee7186249e20bc1ccabe07bb4957a3c9aa25c555b5233269d6b19bbd6c8cd485dc6f637dd87fdcb1252528fabdd7562050576d782047e1f0e912dfd25997d40eb866eea2e6d8156358c2658bc6d595f4ef20c70207eada8875e2656bf4d26a261eeb3b9cc3b3091cdf64e46770af458250d2c8794bef8094cc378a31f4393e1231a612b2205bcc1af4c0b6c2" }, "src_ip": "203.45.1.75", "dst_port": 49220, "event_id": "evt-c5c1b64fd5fad585c40c74a1", "src_port": 443, "tcp_stream": 64, "udp_stream": null, "frame_number": 3099, "timestamp_epoch": "1552961305.277653000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "2126432355b47f9b2e787baa4ae9015b4b3827cb09b1090a5d089d840a097a33e20833ad362ab7a583629257cc5cebe6445f52757146646c3f8c5d662d3546dfb0dea15de43d7e95097abb2515eaa0f6d848053899dc3b091d71bab7ddcde4ba922d40ffe8835043a2924a60d912fb91641b369137fb496d43dcc24675b961ce8089bfd500455bf1e50e7bcb4b2b566cc83228f466cf595c1de246f87cc98e80692ed0090716c216fc2ea292f50b96ce2430d745aa8487a2fad357b6419c2706c0466a7bc9f7c4f27fbd1c9de2d39a008aa8a15830c83f00345b8142f01b05bdc6331f4e53e610660790f1ae82036c59765f20a648b7261d2ed42e2eadc237675d3492dc10419380e2dff5cbbf4392149d931061308308c3069da053b35d7b68087fbba14454178c99ec3b6fa6035a8378e2bd40ab1a5257d2c465177c5194736c713dfb950829daacf7caa41e788b01d88707611f6abf5ecbd969e4fced62305ccac39bda3df6787b5d0c4f9a790374146e830a610a56fc8ef5f833cfed08550e4324a266413b74583377006018b5bda0d519d85b6c05231e437cfbf1d2d860c1702f7ee039408018df4aac9e453fb729be789b96923f30feba53ecca8c7acf8978c09b1f7aa064ccbca79d715b43fbf40e513984e298a5098c297cc3549998e109fde6dd97cd10ee1a45e0f23629f6fad283ad6445e69f22e3bea0623f1ae48af2df4d5fa3dfd02b306774410a50ee09c02c34a1dd58be2192d1260be9866c0fae6067a43ca40dbb779ee55cbd9b0a3f2f01f33900537fd15eeb8b45a89361e084ad1f88fe0a55e70128e811db4e9dd273e85b28d104ff494971b14cb67f4450b4076ff948162bf026765673c5d472f623d33c6f74566975a091284ee00264621f8bc2d22b9e697e1743f367a5a6d5a59b2053f2480fa1714c70f879825c0992100c9ba55d715c7baf32966a1407100ad54704380893ef851e29df0f9ed0e9ecc3e0c8c4e444af8d322a785fb757d9b5fbdbc135f1b78b287b2a049ddd71b3a96712dc501221c05e08b8a9aefa7f276aa626e3e44d0307edbd3f07b111a2ba58483366a352cfd614d3603940dcd58e1fd0137ad5f83d35a2f5112599b840844f300ed4d7bed112b5ea41b291652c1a64623dddee3aaa0e0fa16d834187c3614e291fb2b5180c6b3a816ddf73731056558666fb423971bf003728679cba8cdb1e0f7616cdb9e614cf8808fb08a8576d570cf2eb5530008d78e66c8e419f3d879676b64ae58d9dca5fadf2f00e3a3268a6baa56d2b43f398b0d25d48f90ea07f43fed3b3d3d3ec596bb8a4538d6145307699001738dd7c441c70ac4e04c2d89f1297ec2edf6073706692b37c5ad3be7ad6a3d16a67333758a421bfcde0e2ab849b001b2d31651362d151f797bbfa73d360e19a0c3b51bc59298212e70ed8d68e4371997eee7dc66843e67ccbad8e94e7f455245fadc083868dab76fed1b5462cd4ff69fb70d1c8fe549da3cf2655ccb068fb5dddc5a7959042e83f1976726780e1aab3f20229240c4f52905347aa2c2c6bf8806240357609ae863aa9a7df03b65c205a35e50a63ac54c96a4eb4a262719d5ef38ad79db98fc207e6c633b5ede9849723199b68f4266b8735b20017d3f00d5eef873736d57b59a31c1f13691064d9d2aaceb6619849e48bf19f0e41025d3e870bba28e379b66e773cea88f1d593998798ec04e9f501ac0e270c37418668a3e7ba5ddb3541f0c339c9db20e6e5708d3f57019fc453a384fa489f044f5bebf4a1739ab2ba2c5337fda16a05f15b09d60981f75e8e329cf6da105b73df38681a8fb1bf99ebdc460fec6e7f629a64fadf8b090c5d8db85627671a76f0106795e1ec0e5339a9c86e34044f21e9b85e17e517429ab2a722d0819fb0088a7366eaefd2e9a7b2976a6d9bfc7df5267318df6463c7f8ab2cccb0b5611c5936381d58bdcbac57654b9f8d20f0413e7b067297031abf1c736f5b47ed04a28a0357f30bf1ecf6b679f706b0fc0c12e5" }, "src_ip": "203.45.1.75", "dst_port": 49220, "event_id": "evt-ae8959a8127808fe6c565985", "src_port": 443, "tcp_stream": 64, "udp_stream": null, "frame_number": 3339, "timestamp_epoch": "1552961306.857064000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "37435d3029a87ec1b73e2b3342d41496590c8d5e058f0aa8b608400432218a022abd1f75c56886184b44ff92f56cb0c0b3c7df7a72489dc685b264505032d1b2008a05c37222e07bd86a5cb5ee1a8e87dc34f387e328040c42a0931f60b5393511ca92c78a0dcc490114fad30d25e2aae8733551c2af28930b3efa564766094de75a8d04cb2a22fa38eff75af51b6983c959e8ecfa2620ef90b73a340515b8133a6fd21845f705b435518e4877b130565156e28c8c1023de4d1141cd5c0dadf0fdb3524de163666480670d1ac0d03ebed131ae6917533faf72b1d1ae7222f5adf3ddd3f9450043833fdc4ad12333f082678ea0c502f45b49aa447a53d0ec83713f45b7a6e1a7db38f1b81931efefe0a255be637f1744243ce5be09295db64123f285f3190051328943358d7c8e969b9d6a9d1f70a14c3128efa48a7a12942b2c410f93f2a74db72e1cc5f429e799dae7ac0b1311452cc0c8eb2417a5b1a14a7d16539a2a2471fdda37a02d59ef1dd78f2ef16bdac44c56b03114a03f1fa81b068d17b4dfbe7f5b8e544004070e01516730a5ab19777c5b07e261f684d77aee8b0f47cf3b80cce9926269982e2ada3026a8d978acfed16b16f7b90d77953e5f9fef1627c8be7a54156f33bab95c25a8fbe1e870a91e63ebdbf7892d8b84c064e853e32cc26fb4136719862c0807446767f55a659e11dc4f092c42a47169dc6246724f222edce7600161a84f6ec7c7fc06aeb9a8ae316148d464bce51fdb9c1a21222d1cc133ee1704a7eb5b896ada24aad61d1c715960b0a64b6cb9676bfeca9be5b032ae09a641aadf24656f579cee65be50cf7b99b6e13ff459a63079ba5b3341444e131f6709b9a83b4a513cd94265b311bab42b90838005342deba92bc889ccb238edddb7549c1089bf4bc2d638a09cbe23160fdd2962ebde67c1fa57627da5f8f3d463098a1efd2a3d0ad2184645a948c1d5d360c8742e238815618df8300924c064de602d9d8e707a3f85ccdec4a8093814dbf0573c20eced2e4d4176903cb0faebc6dd883540bdb7aef413dca2b666660214d511d674c41c8b026afdec5c403b6b4a690ccfc5a5c539b451dcb655ee481d7f9969a8515731fd1829b273d1bf9e3b83876d592b6bda436b48a33290ca82e3c6d8fc295da2f48cbaac8ca18fc6810a3dee4ae7c3678995e5" }, "src_ip": "203.45.1.75", "dst_port": 49220, "event_id": "evt-abb344bac0e256470492e984", "src_port": 443, "tcp_stream": 64, "udp_stream": null, "frame_number": 3575, "timestamp_epoch": "1552961308.070776000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "7e53285f1c0cc134d9228adcf9ac4f581df824735fc4b528f9fbd40101abc0a581c3b07fb59a44f46f6feeee212620fcaebfbaffbf4cf4b0b1731a715bcb379536820bdeb5d2236ac8ccdaea077dec31453684f47c91f5a510f4fd12c24edb33b6a4cb3b209f686dfb646b79f43f890339474a2a7472a62fa36081c941247b35923996c84556eb037dfd2b14762e06ef0b7d7f319765db3b13e47101509597ba195c619bf189580c4adbdb538a0282162349cfad8f6b8b3edc23455d40e5a87ae20cda2678563a8803a5ed05f0e4ebeeb6e0c799327bdee88e0960072ace59997f99fa36c6b457811b173256bcb4ec689fbb2682f7b475c1638bbbff3b1914aaf5b036cd23f04223a394adc22046e1b7694cab4e662bdbefedba749e02f4ac627d40742e608bddc29044e018a11bf6a1e1dd6b064b517c5d6c78d8b397ff3bdcc7449f1e4a21645d2e22ff9663acb8c9c343a0c85b5d4d547d2480f0c339964f8c86fc64f30ae20f3021d372bd77fcc789db1540b1ce80d8747cd0b1458d53bbb9f1203f4c3824e55cde9216774f8cb0249e7241c5bdc72d0d5e2f143ce3ffcd8b15a6e8a357615e0b5257abf395144a7f4bd5b85110cb0529eda61d05c3ea6e9ba54765aa9539ec168612c9761125961e09073d6d4ed5c966be0c372da27bacdf9ab9e8c284d84518333d529abeccf350d58332c33fad2d8e7a976500b45b557e0c4b299961ed323363760d613f2291a2a4fe4d9732b2c5163f610fdf9cb2ba91e6824a95c17b8d8692fbe928b3138aba50b6344e1df6418e2c1bd1f999829e49538fe8680f5007bb447c6715d304737d49053ee0fb38614b8cbd3a800ea587e39aa21db434ea3dca83f5a2731b0e81752488a77aded26c08232e7fe803bb6c644110337cf94a1c520f8f9356281cca38be3d76f263889f73f9b96a462074534124b58cf1c8611b4aa5f8e23f4516f08ae1748010a742781ff7744ba03410b952aa16fcfae852b8e1e6355bd6c94b26499bcbea07670539a378917f98841a8e1d6c2e70e7fb3abe9c2ad4634f23eaa89329f8f4eed9327301eb1125325c0a0e91f97328a65cdfe4fb4d15209b5dffc19ee15300f47f2816609ae4617793595d1d2f03868b6ffcd5612b607912b68921d630ff557af4919ed7b1c161fece11cd07ce474448627c19ce1e1ccfba44f728474a33cd58d6f27616f2ac48948f914231f4852e70122893c8f90946aa24a0ee99a7d9791b5c15c0399c865ff15c091df91313550df241472e162247cc9f92f4cc4b63d7c6851e4d277d1ec8ae1520b87316f7e9f6a141d53cc44c0a546d7503d8e347c73a5d36acba9438d2cfddcadfa39a0bf146b06f979fba01f7b31786768d7987c641a533302535d7e74383fb4c7dd9847ef94a3f46f7851dec19f74604e3ec9a30a1e45e446ef8070575032c300004ae4eb7968fb6c1b98fb43de95918d17ef24d899587d71492dd26e1d9c8a20fde018f3cf3d96bbef8e4e41f8a286b826741f282a8a9013729456b04e747b5ade835ec1a5e96e036e19275e11052d5cecfcfe9e2130f4b1ca3e2eb0b428601575ceb4bd9a4bc292e92137e60116ff19e498ec01f07bcacb6dbf0571e08c48a814fa83223459e0aac5613c33cd26a5f3b5f01faa343af0186db459fea54edc27943e919a0986100d8c67f373ca8f27216b52fb9ad75ae55d97c983ff54137e9f5ee28b3cca0ecc29d07232764b00ee84bf345a1ba682e14865f732d112286c82b60deb428a854d48a43de761df6c8f5fe346d257fb6cf15de661930cf99e5cf909ca158d0c6f97eee68ce90fcb0606fe2f68fe288558e57e9d6b47cc0dfcd8dfedc218bbdd3595324f944fc152c8040113e93703085026dac60acc809360c8c9ed3913c5c8ecb8e90b517d0c7a08efe905ba4b8b98d61381284bd0f98075f0f04187bf747b45b4420791f8bae09c7ab29626c6a6d056d49d4be7d788f3f1ec945e64fd9cddda27820523eabea1718d98ec51734a336d39d9a88e78f" }, "src_ip": "203.45.1.75", "dst_port": 49221, "event_id": "evt-6723fb84f65b2a9b3192036a", "src_port": 443, "tcp_stream": 65, "udp_stream": null, "frame_number": 3605, "timestamp_epoch": "1552961311.418986000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "4c6d72385b12c0bf406c9639f89c10ca1c233b30b0f29f3df96d52c670aeb2f21807c155ac004fe47f4f71e1ce8dc797843588a1e0da0a78cf7d51d374bf73b27b2b74fd7cfc9717e274c3a785ce0c1b02d136484ca26e53497cb5c5d53f1ab6de4650164a0b2821bdce8cf843131def722bb5038e1a009d46bcf08b2ec02846d16879505f3504e16ccfe1e0bf19107dce5791ec2d2c8c3f9347438d773720757cf2beb872ffba92c128f63280b64f4f4134bc551f51152385be4fd8d38a2b3b76c1e28638bcc3c69897814894f78d2687957894e6439fe26dff0b454d11b2e1f51a918bfc9475b78db6b1dafd7831fa698fa7a64a1a018d67224a33ad471c3a67ab6a9e35ed75afb3541ee8c0defd2c573849212aaf57d2a3047e8d3faca7e8ca7e0e855aec25a6437c89115f4954d78768bf866e21421f333838c9f8bde09f24fb2162c77e1ec73c1211c9b247dfe25628fb0eb141998e935d79e7e66345ca8976a96471301ca7682673bd86cfd8bfdbf556c77452e386c8d49c7687c39bc3814367115ecb70ece3ce1c8817384f3b44bcbec92b51ed7ac5e5b64accc78c39816a43237af87b3f0bd100acbc374a32204e942ab2523672c76c059fa3a6c94f4ce6338d26b6bfa8c0af2ede7ab6e195e9f8cea262b2f76b65d810cbb57fafd1f10da3f24e560be9a95a83fb9247b202dbd0ea95cc1dcde31fdeb3d3f6983a1eb326d8e431d77d1222605a5ac21f521739879173fb97adc03a5413bab35358353584f38687303f2cac3d88b463542147334e983539962f1098c80a194b91a4d91d9f14e01e95607a2a17402036d8f27447902a1c780f26316c34dc1a15a2be3b1228b2fcd418a8c9fcbabf9aebd3b5f43dc6158b5419cc420ea0f3f9818d10c208063c2642978665ff78cf52c7b341cd1a05f19b641ac5d82b2048f56b0ed4c46f3826cd2fbff4bfbd4023fc4441eaf83dcef0a5dab0283bef7121000bb9d34e8a8bd13958bda788c0b4cac2da824495bc85d304b24dfa9658b525eddb0358e389fb10fabb612e574bdd78fe931ab3354ce1a61ba7ae07a2f009fba8a2e359a42262ad6e3746410d55af722b01f9b9b7804484ea76b5f08c5840bd0615446e0b8aea9582846a0751f8352e2f9a3b932e96b11721417d59d30f4319b23895887373e77049bb9123ebfa8056f5b5963b68d26ca16d122916b92c494899aae170a5fafdda445d1026b2b8df3ac3346160e5599da7b4a0377f8c45ba3f5f63700a7ff6bc217bc4b26d05fe756e4dd6dda596da7f87e5d0826a6e837dbae3ab21dcd6a205b14da6669c5755faca0f3029fa5067e00de7b93430ec4d4c544cbfb9ef1f4dd68ae0b388f7fe630c297ff39298c77f1829258e68b84b7054cc8e7f962d9579189bf7cdbd7e508c9f463e68b54206ab429591fa02dbf62d91f9138a55413609853b3ddf6e6caa00661d9044165d20eff22c040111e3e4ddc4fa27a77f4df64b97800df432e3f3d83340fb8e00fceb3367ff9587bd8220d8c82ec2811911ab904c33bc898fc3bf73e1f58616b8a69cb0c93795413145547b717541fa745ef2c5d91c07926fb043a53808db8fb1076e357d7bd0a48a7f11668be481c4002b5b49a66227c94fb513a4780fb937bb472de7cc7e96e46930c7df7361bbd712d55e310bb1cdf399b9e0b946ef2f15afa904795b1921e04f71d7f0cd80f6ecebf0f4ed3efbf378a4b1dda25ee4e723e359571038eb8b9d1294f4af76ce149fdaeeaee8d9e534e7f4805cf0b446c343fafb297bb39826a0d65e4fb88729f1116371d22534b8f56030264d21cdb6cf3b595b6f75fc678bc1f3bdcae722d55e0af2b572f1332bdcbda7fd83c11001ee9281e10a104f4b0dc9fbf5efc43376bcd42932fc38536ec235d73d46dd5750c661c6a5ccc39c2345b0c83cb0d59c8f8fa4333623af47095006b8130fcfcd106c6f7f186c3045d0f4a0b050369302500c2c3453db57c41cb7567691b8dd7d902d5946dd26898a1007ed318625b8d6123e8129a26ed3d142ab6711acfc0161a73b6b9198005ba299aa" }, "src_ip": "203.45.1.75", "dst_port": 49222, "event_id": "evt-19a8da262eadcc1bfe6828c8", "src_port": 443, "tcp_stream": 66, "udp_stream": null, "frame_number": 3950, "timestamp_epoch": "1552961318.188053000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "5442535f5dd9aedf6f4083fec646fcd71e8b43e50981e6113747a7af7e8a5ebba00e11a57a7f2a9299332d6c5725bcf47b33ec7d76aaf4dd5e636ebcc1611d888f935d0f097ea65ef2265d217b1536e2d7a19149b5c0b129001ffc0c4af49d3c73327d3f0dae552a4973296201b71e9a196eeababb301716bc48073ca63ae6cad631d6c8040d47bad0e9bca0d0100dba5b04af7402940592728ea59494f4c2e43035b7e61faa4e37317cb4761d355efce5911516f107ae06dcd857714f7c074029a1899a71520c640b4585509c7810a45030fc296ce930a679d131a2b3d85556955c3eda34c0b96ceb3f75656bdac3930e3794921babb521685dafd2a5ec0dc7f9f4259c0507d18040e355cd9d522d09fdf940a9cdd768971356911ace8b947e040d177863eadefa47dc6ba19d56284bffd2954ee2d2e3c7980c69733af6727658aa3f56a0122532928ce391b9c27e71d09a4f53e6ea70973d9d68409ebd78bac0d277d92f6e6720ec7891ceac92b2534db097b871224835dc863c38f928dabb69ef63b92e058d500b622c5071e93e6318be5257631a5729a10c362d8e027ec4d2251c8b45418add870138d47701d26962a5e06ebb6bd7c8c64a0a8e7a9322f49b373d2999c500e4b15407324a594eb6f7adaf671a85a6832971586f7e1f5bc765d3cc077f571cdbf7c96d36e5210188a14f3528b133dcb299c0dafc86bd0ae9160129d319913346660b843fe54c1efc2bef0225d82b20f93b309af04d53b3588fb59bc02a88aea298868f6e656edbb1c9074cdd1254900292998b904bacd2ea0d4a61d1b2c84f0de7c55aa7f422a660cb39b3a39c02fbad1fe839a5a177ca69006e20662ae6bd2c00e716fb31f2c903ef631368dad0337a123272bc424a10337f3f75245639125a109466f0577f32959f66e17f7de86747c169bcb7d116c6171d0893ac2db0475d308419375321a4c9d828735527aef31d0602026b291d3228b61ba4bb775a190d42fc3ecb5a6a904f285d406688e9338b1eaf44eef1e61f4264d22626e76dd2feb941cf6d878b4f7078ceb42350941f4d281b1992deab843068192ebfd87b01fa9edc80d40d0b63f7292c7d8626fe99082407b90913faacce399333d695f53ef2e09905aae911e11c89f76b3fa3a0cbd046b4ba0d09f8afa6f651dfb3647a4a4352f40f3eb94f7d8216d3b6dccb8bac23627d8310786534605abea1b1849b05d525113a667882a16141a2abf65c8f111fe4cf5c830ca52539a3e75b98f12f81403b006f24d53446840c78b7437dc3ac0fd2a4e521f688fa88ec268eb594d65f10498d833029bb3fe5fbc3aaff62f4925b4d16d2d05282b0629bfa30113d5d2d5593745ef8e97495ed9521ea106cb6e5d8412129964658474240a29597e7dbc0392c7093cb07d12d30c7d50b4595b66eef32f0ac2bce41dc18475c3f88b4a9beb5029a68c35c8e3d27f42f389cf4febf483ec74ed50a9835d2c5e165219584551b461e223140f3fc1699e243f1074ef58af5f115a0bd5e82e04de854e52875e91f3b33cc27aecf66f9ee02479f47853e49e5f57ccf211f78f08b875e34dee6ca9254070d6b7409d25d192f8c9a5c1f4b678d3126abd4db4c90e52978a381c843ec696314407c296123f87b7a04961411c9fdd67cb0f008b454a044081200eb47d38a68e0d06f420201c051afc534a04271967dc9b979747a89ca145d6fef1a2ba7986e24df85099ea82f35a9b65533daf31f74541209c70f479c14a603d80943b62208fcae04967e50534568f867c5821e76e26a10a545d25e5ab4b6a215a12936a0add0643fe3d090f7230b8f1055b44a44e464223cb25a83c803225afd8609d8b02933a5bf5c029bb9a7dcac0664b4fa00719913b7fbce593a26d637070f9fb68a08c88703fa906fdce82a9cec62eecd5a29b02ed0f1f4236a2fc56209a313520c78c8cdfe3eb813c64a0cddef9d5ea8b75ca4280fe9d8ceb5f1aa5841614bb9157cca6e32bcfef4a48b8c2b3626d6d0c7346f043de6e9ac6c787cff8ce94dd378ad972381bddaa00683ead3" }, "src_ip": "203.45.1.75", "dst_port": 49222, "event_id": "evt-225edf0d0a19e7657f43c005", "src_port": 443, "tcp_stream": 66, "udp_stream": null, "frame_number": 3962, "timestamp_epoch": "1552961318.188473000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-9d219e1f9b69d71d9874ed08", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 5374, "timestamp_epoch": "1552961585.272809000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-7f15b66c0a5d829721af76b1", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 5429, "timestamp_epoch": "1552961705.283249000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-6c66d4db6b99e1d7f97ed4eb", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 5472, "timestamp_epoch": "1552961825.293758000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-4101877f407865b05d0ef3cf", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 5542, "timestamp_epoch": "1552962031.619316000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-5263015040e9750b59a39342", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 5580, "timestamp_epoch": "1552962151.616345000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-c55900eee37def91e291e011", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 5618, "timestamp_epoch": "1552962271.626813000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-52efae04d7594c90a1e71788", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 5656, "timestamp_epoch": "1552962391.637623000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-92ec8344c6fc491b755b302c", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 5694, "timestamp_epoch": "1552962511.649746000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-7eebc09c7bf59b900cb95ad4", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 5754, "timestamp_epoch": "1552962631.660404000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "5e346c6ece347a7737a69bebe69777356cc642c9a5fb9129c809805f83331c6c72ca4a20f9707f2677769ad35d163f5b2d90c2e61ceb62f73df956885921ba13f0ee97a849a02518d297c657da5f11316a38940288a00b8d5ef97291b666130f12811779bef8195e3a0c7bc4c2771e968134e895d5a955b5e26d9bc04ef15a93380f1ffe81bf40acfa69d5cbaed59155a3bd2997cad462532e284eff63f33ed4e378c042c9fbf347dfbc1ba81c703cf7f4e5999181b72114f7a41c0e748851dee9190f7abcc8d636cb98b3904cd0723a47eef21bf62ff8ba666fb2c164eeb5a22e92c51c3084b09e68352da005e5c85f4cfda9e1183a7027aa740250bb7e140ff263dc73ee4a37487809bb52ae19b37b10ff79a1a75c724e018b9dd9401a0c7b0102e9203328f0bdc71a8871722129bb07d098e958d4ceb2cbcd5eb26fde0ae8a9b5ed6571e5543ac894626098e70a9b217bfea092bed35ab82f022fbe9d7d6be80e8677201e661196de8c56e3120ce8db84809b09c27500e500d7432ec88622a7f04cce339b98700088da5f15d0789ee978b4af377b906d1227168608f5af79f34fcd63bdd5a1593e4c5bfd9e34ab3c074591752d6e2b2769a57f9a8cb336c28a423b49a823a185bd93f57d3cf3a7283c41c4f0a764e6d8835a38528a0313a5f78aac0528e8a57644222627b67f038ce1848cda90d5a2c81406210854765e4e2962c6dc1ae35cf022eaf4e3e0da0ffa1d59d494c0ca600f17c1bcb9ff124e4a35f6264cbb72f507368f36ed1b321198ff33df335d3e8060dab4360fb9f6a8ba86555dff2f4efcb311609ded000a629ff3dd4e45f28a2439d636c50ab31128f5fe66c9a29b" }, "src_ip": "203.45.1.75", "dst_port": 49236, "event_id": "evt-7fec59462c6e999bb50938c2", "src_port": 443, "tcp_stream": 80, "udp_stream": null, "frame_number": 6391, "timestamp_epoch": "1552962699.289970000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-74dd7d219dbbf4877737360c", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 6432, "timestamp_epoch": "1552962751.655579000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-10df71cc1bf4dd58959842b3", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 6500, "timestamp_epoch": "1552962871.665693000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-9c230439e4628167ae2cf250", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 6540, "timestamp_epoch": "1552962991.677206000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-72aec85526a71b48315f2872", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 6578, "timestamp_epoch": "1552963111.687823000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-4fbbf806391c18e0679af885", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 6616, "timestamp_epoch": "1552963231.700327000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-0900f29ba4f10a05130eca3e", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 6654, "timestamp_epoch": "1552963351.711335000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-d6b1b2e02ce900baad03f6bd", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 6692, "timestamp_epoch": "1552963471.722673000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-2c78aa1ef839e2033d21e518", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 6752, "timestamp_epoch": "1552963591.732421000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-4ff1fa4232338e36a4f21709", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 6790, "timestamp_epoch": "1552963711.743627000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-1044d86d8b3469a6e0ee465b", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 6828, "timestamp_epoch": "1552963831.753535000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-bf3e7888562cfb899a057337", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 6866, "timestamp_epoch": "1552963951.765842000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-534e29250765da5eb7ed08aa", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 6934, "timestamp_epoch": "1552964071.777409000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-d7a1c68a15b136ae137b740e", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 6969, "timestamp_epoch": "1552964191.786298000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-84c8dd32d9ea1386c71d0e25", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 7007, "timestamp_epoch": "1552964311.797847000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-9ff29c85e1533fae8e1834f4", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 7069, "timestamp_epoch": "1552964431.808036000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-a9b5eb212d94b4e87f64452e", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 7107, "timestamp_epoch": "1552964551.820542000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-e9dc59306e8fb170c6f8aa0b", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 7145, "timestamp_epoch": "1552964671.831964000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-11a596d025510c14f07235d0", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 7183, "timestamp_epoch": "1552964791.858470000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-58bcf1fd8298007e116d27e3", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 7221, "timestamp_epoch": "1552964911.868955000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-79ac3dd60842949b060fd74d", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 7261, "timestamp_epoch": "1552965031.879616000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-1b30096108b6000533b2eed4", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 7299, "timestamp_epoch": "1552965151.875928000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-bc669efb37993ca1464971d5", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 7365, "timestamp_epoch": "1552965271.887936000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-3fbb6fcf0101458504cd7d9e", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 7425, "timestamp_epoch": "1552965391.896623000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-4276717764760700020379a5", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 7463, "timestamp_epoch": "1552965511.909590000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-4de82ea0fca3810effd64c9d", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 7501, "timestamp_epoch": "1552965631.919957000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-d932addc9475b029bc2969e4", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 7662, "timestamp_epoch": "1552965751.929877000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-3dcc0a8d0125c2e24e8bcd5e", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 7803, "timestamp_epoch": "1552965871.940826000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-81340a183ac232243340eda0", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 7846, "timestamp_epoch": "1552965991.952912000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-9642fdd62706808851f621fe", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 7886, "timestamp_epoch": "1552966111.963630000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-6ca7b1f197bc3d6a0b48d8ca", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 7946, "timestamp_epoch": "1552966231.973594000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-e37ecf7db76dd7f339db35b3", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 7984, "timestamp_epoch": "1552966351.984183000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-ffab8344c34c9534df43f8b4", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 8022, "timestamp_epoch": "1552966471.998579000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-6826894e112d45860af44083", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 8088, "timestamp_epoch": "1552966592.006834000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-8ace0d309695c965d92833e2", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 8126, "timestamp_epoch": "1552966712.018654000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-4433a1b46ab2851b93f134b9", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 8164, "timestamp_epoch": "1552966832.029894000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49206, "event_id": "evt-c1042080249bb1da1bc019bf", "src_port": 135, "tcp_stream": 107, "udp_stream": null, "frame_number": 8172, "timestamp_epoch": "1552966854.055566000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49207, "event_id": "evt-ef764ba0c7a01df9c61994de", "src_port": 49155, "tcp_stream": 108, "udp_stream": null, "frame_number": 8173, "timestamp_epoch": "1552966854.055655000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49206, "event_id": "evt-db206afdb040ef43648e20bb", "src_port": 135, "tcp_stream": 107, "udp_stream": null, "frame_number": 8174, "timestamp_epoch": "1552966855.053865000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49207, "event_id": "evt-870e9ffb193c8393b1d89187", "src_port": 49155, "tcp_stream": 108, "udp_stream": null, "frame_number": 8175, "timestamp_epoch": "1552966855.053986000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49206, "event_id": "evt-189d136cfd1afb6b74f2b3a7", "src_port": 135, "tcp_stream": 107, "udp_stream": null, "frame_number": 8176, "timestamp_epoch": "1552966856.069006000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49207, "event_id": "evt-489b101fd6e3f2c9544669b5", "src_port": 49155, "tcp_stream": 108, "udp_stream": null, "frame_number": 8177, "timestamp_epoch": "1552966856.069100000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49206, "event_id": "evt-2eba7e2c218b0ba93c09de1e", "src_port": 135, "tcp_stream": 107, "udp_stream": null, "frame_number": 8181, "timestamp_epoch": "1552966857.067437000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49207, "event_id": "evt-f1c137723bcb7ca846828f53", "src_port": 49155, "tcp_stream": 108, "udp_stream": null, "frame_number": 8182, "timestamp_epoch": "1552966857.067531000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49206, "event_id": "evt-9b2a4382dc211447beb49164", "src_port": 135, "tcp_stream": 107, "udp_stream": null, "frame_number": 8183, "timestamp_epoch": "1552966858.067000000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49207, "event_id": "evt-691762b060f0710dde5b1617", "src_port": 49155, "tcp_stream": 108, "udp_stream": null, "frame_number": 8184, "timestamp_epoch": "1552966858.067095000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49206, "event_id": "evt-93b3e053a8654c6fa91c484d", "src_port": 135, "tcp_stream": 107, "udp_stream": null, "frame_number": 8185, "timestamp_epoch": "1552966859.079346000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49207, "event_id": "evt-e9c2f998f7c863aacaa554cc", "src_port": 49155, "tcp_stream": 108, "udp_stream": null, "frame_number": 8186, "timestamp_epoch": "1552966859.079441000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49206, "event_id": "evt-1205a9a532ce7b65bab04ddf", "src_port": 135, "tcp_stream": 107, "udp_stream": null, "frame_number": 8187, "timestamp_epoch": "1552966860.077596000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49207, "event_id": "evt-b362719b7e00469c09a40f48", "src_port": 49155, "tcp_stream": 108, "udp_stream": null, "frame_number": 8188, "timestamp_epoch": "1552966860.077720000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49206, "event_id": "evt-f8cc907984297934b62d2fab", "src_port": 135, "tcp_stream": 107, "udp_stream": null, "frame_number": 8189, "timestamp_epoch": "1552966861.076680000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49207, "event_id": "evt-b544b2ae4b864304a09fbb78", "src_port": 49155, "tcp_stream": 108, "udp_stream": null, "frame_number": 8190, "timestamp_epoch": "1552966861.076792000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49206, "event_id": "evt-d382310066af3721b7947fa0", "src_port": 135, "tcp_stream": 107, "udp_stream": null, "frame_number": 8191, "timestamp_epoch": "1552966862.075436000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49207, "event_id": "evt-72a1ce9941398470a76ac75b", "src_port": 49155, "tcp_stream": 108, "udp_stream": null, "frame_number": 8192, "timestamp_epoch": "1552966862.075526000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49206, "event_id": "evt-514a9b8cedf7858ff26d97d4", "src_port": 135, "tcp_stream": 107, "udp_stream": null, "frame_number": 8193, "timestamp_epoch": "1552966863.088668000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49207, "event_id": "evt-282ba308103df29a962feda5", "src_port": 49155, "tcp_stream": 108, "udp_stream": null, "frame_number": 8194, "timestamp_epoch": "1552966863.088760000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-38e38b0236df5bc80dbe2b90", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 8224, "timestamp_epoch": "1552966952.041850000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-9d1d5b1cb14c9cc3d1e275c5", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 8264, "timestamp_epoch": "1552967072.051397000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-e53c8b16e251a5f39401bffb", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 8324, "timestamp_epoch": "1552967192.048329000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-98f8c4177a111156cbf657fc", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 8362, "timestamp_epoch": "1552967312.058270000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-b494c3d52cb66fdec5f9f3c6", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 8400, "timestamp_epoch": "1552967432.054198000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-3fcf55c7afdae1a0662ed45e", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 8438, "timestamp_epoch": "1552967552.065440000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-a72af0c6be12d426d6366644", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 8504, "timestamp_epoch": "1552967672.074721000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-87918511702f05613556cff2", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 8542, "timestamp_epoch": "1552967792.087051000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-1f2c1904315d63671d8f4069", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 8580, "timestamp_epoch": "1552967912.098423000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-154df32b2ce108769f4f6e04", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 8642, "timestamp_epoch": "1552968032.107206000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-01b3702fc3a7de8cc9bf84e4", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 8682, "timestamp_epoch": "1552968152.120228000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-5ce9b2237d699bff3547d75f", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 8720, "timestamp_epoch": "1552968272.113636000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-957da8169db307694b803dee", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 8758, "timestamp_epoch": "1552968392.125463000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-dff65f8d33fc4c292a71bfe6", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 8796, "timestamp_epoch": "1552968512.137220000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-86f245a1dc3c11b72c428596", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 8834, "timestamp_epoch": "1552968632.147733000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-1eb9f15111da9dbf87b08c05", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 8872, "timestamp_epoch": "1552968752.159494000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-af6954b83c756731ae76f77d", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 8936, "timestamp_epoch": "1552968872.154584000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-a07d351bdb9eaffca3f065a4", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 8996, "timestamp_epoch": "1552968992.164605000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-ee4b13390fdedaf8602b570c", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 9034, "timestamp_epoch": "1552969112.175354000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-c5aca2d9758cd583d8261b50", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 9074, "timestamp_epoch": "1552969232.187342000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-d113eb240af4bfba402f20a7", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 9112, "timestamp_epoch": "1552969352.199589000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-18460d04d18ed453f8e86f03", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 9150, "timestamp_epoch": "1552969472.210961000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-c76cad9536c26d8bb20247a7", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 9188, "timestamp_epoch": "1552969592.220931000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-d91debec4b4e6c38f2978649", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 9226, "timestamp_epoch": "1552969712.216781000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-a6546d3d97efcfa60a710c0a", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 9286, "timestamp_epoch": "1552969832.226899000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-dadd5c63caaeafae2da2001f", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 9352, "timestamp_epoch": "1552969952.238664000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-5eba99813edd05f0b843b45b", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 9390, "timestamp_epoch": "1552970072.248799000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-9c16608a577f4a495817c1f9", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 9430, "timestamp_epoch": "1552970192.259040000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-689f99d7547087d2bcd6ddb3", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 9708, "timestamp_epoch": "1552970312.270135000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-aa6faa4ceb07040a830f8ce7", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 9746, "timestamp_epoch": "1552970432.267907000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-768419b2957d58b4d427d92f", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 9784, "timestamp_epoch": "1552970552.276492000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-3c0380aae1c0be5f10af8bd5", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 9822, "timestamp_epoch": "1552970672.287431000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-622cc9e5d41a72148495d9ad", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 9882, "timestamp_epoch": "1552970792.299415000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-f86cc78ca616663da29bd773", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 9980, "timestamp_epoch": "1552970912.309907000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-c9922121c7ebeed3d437aaed", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 10898, "timestamp_epoch": "1552971032.321828000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-f34a1c836d2bea0e165dfd25", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 10936, "timestamp_epoch": "1552971152.331195000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-d54728dfcc951f7e9c10e413", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 11028, "timestamp_epoch": "1552971272.342331000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "223a204e7aa70e5568b1c54a858fc45a71893abc605b8c9826bb2b47272c7af40ab6f185de46f3d9ae0851351fe404ea34e0083417c77fee11615baaae97e8cefda3ca2664977b676e5b7b4b10d0356ed1a85339974fb0f6a4122f313b6dd73aa2c1e1350bc1ba623ce20d7daddd422c4348eac44a1a091667c4d05737f16ddf4e2de5e6728da80f8290921ce90e90079276d0de2ce532bff6ef11adb89aeaabaa3ed56f982615b27db8b05aebb6820f769a5f3d88f3c4bcff9ad060ac12c156bdb2880a651736a42dfe915c495458ce948d81c917d968ddd22068a8148e4e0778a05a2be92a361222b1df329c3adc9ba6ff9d5683398ca3e44aa34dbbc8bc1ce974fe0c9a014579ddf97aa6fd22aacd992e7334ed8d190d3f975c525cea6edacf14f6f1a65460ee603b7438f849459bf270e81addd0ab0ad5907de547d08f941430b3012f8112fc5525a3e245c9055174c279755c620ba652913f59e5f5ed7b7c2295eb240573ba8a1190cc3855e33ec3959dfe8e2fdab21b9fcc7478f0415aa5dd2b891716f5f538045e06d0be276acd7ce4e00dffd61780cf309f69e7e0b15352f3d3395329df2d56c2a4ca7cd2887d0328cba9047f534d2b8413f120491f4f08df7527256f9ce1e3e5fedb06ab9bdf213275d8b2b21570abd94cc060308dd5c542dad1001e3c99445ee346d0c139a4f276062db790bff8e5abe5360ee178e0ef3e9caf3208dc34ed470fe14a1f05b23d286806814a473bf9068bb7607d5d0c430283346a557ab729c5ca48e7f2779d729701a3eda388917b5292470a35667dd6dd6c6e0255e8d99a25ae0356f8007aa1f771ee2bb7447b6b9df7da270180afae9b1f63a666e7f7ce078cad35a5bf0435aa43af8eb1849e79380d800064d1d8a5f9617f8b37910a55111b397ff407fe87637c7d0b16f1e512a2bbedca5f32bad1da342e82871f85fb224087debcea7c14cbab398bd577ef6b651925289f3264400a0c0361c5a5c30278b479ed7c36774c8b52e22f63654c1cd453a12873163ec46abbeb5d2b6ca038d1ac02a442628b976ef608b4a5da8b5d38fbae89c030e7167e6fea8fe57ba7cc5b90f32f771a42449f9780c6d84dfa888efbda0eaf6c186cb60631cb8d00f7c027ada33bd1840a5b6c066d82bab62d0cec123c8709242e87e528e5ee62638d5ca7bcf6704713deccac5f81e707bbcb5f0898a1b30dfd322d45f0f231c98a01daa0a00733b5875bdb4d1df7f5ab257c122502302e05a1df16819adec7a7c5bacf7e32fdfca0cd8ebf2379ae9a12fef5ebc9fb07012a15d505411bc40cc30a56300b64c4c33e52dce4c46d95b2b88aa0be8745db92f5b90c58cae68f7a3b942c9b00893151b1f1da504395cc91ff0c13616dc6057ceeb056cde5708d8b196631b3f4893b1f302e103961eb729ecf822e376c6a961cae4aa8a8123c7d6298f4c1cd9d623231ede76b734b9110c0396dcab4d3767671729162f849e59baf797bfc47396f8072e33e3b7e0d01966cbd87daf69143939a88579b0814dbfb3407cb85ee74616bb414ddc6fa25a33815a975b12e52c1b2b0d547e4cb64139f841b68485046c96d4b042fd2fca381d9457bba17a9a0aa57982acedf6d5b6314d765abb719947911d22576ee3d783e9185c1cd7ab4683562a968afa140931318904d00ec5a0c5ff0975f7a64c910d69a614ddcd33fd144df575142044bc2cf7330adbbd66c8220b959ccc47c4504cd06ed1ce6302d16db06139b4dcf7e998a17f594f21bbc89534afff34ab7b14e9b84cf539cac29078ad6e665aa913eaa3f341b8ddf62a0ec13482a8e5fb31e1a173d89916d7c97de39dad216766f39984b59ae5edd06db7b857031eba28f9257ac8543c4405c42f4c841dcef1a5476cc14da0b005d99f268b22d0f0b865ffa16adeb66b1348ebcafd6a52b8cba4f626a1e75e204a7e842cb8ea9e8bae118ed2422eacea1afe8cd2315e0cd64d8d4121026" }, "src_ip": "115.112.43.81", "dst_port": 49291, "event_id": "evt-85b10bcfd23b249558097536", "src_port": 443, "tcp_stream": 137, "udp_stream": null, "frame_number": 11083, "timestamp_epoch": "1552971279.380954000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "575c3f67394c2b9a1fba0673f495513486b85d2844058f690c3e5d256604353d837b511a10827e14964d967f00c2b258dd04ec72145916ed30cd2620937dc6d38f98724dfdbc961b04962b21dd54420e958b8489a1c42e9376e7d40153aac32424b08535fc56f1d51bd3c057c96c23cfa15ce623799002030d86915fc7656f52c7fc67bd8aa798489645f9c6a709f4e8018767f8615072d43a52099e55ca14ad" }, "src_ip": "115.112.43.81", "dst_port": 49294, "event_id": "evt-02c281a5fa0272a9548e7333", "src_port": 443, "tcp_stream": 140, "udp_stream": null, "frame_number": 12158, "timestamp_epoch": "1552971296.175632000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-ff720d17e1084199a296839d", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 12584, "timestamp_epoch": "1552971392.354003000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-442a4583011ea1ee31598d1d", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 12743, "timestamp_epoch": "1552971512.363880000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-fd30a880755f2fdb86f8ab20", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 12875, "timestamp_epoch": "1552971726.959033000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.90.215", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.90.9", "dst_port": 49227, "event_id": "evt-c50758065f29831969c069d8", "src_port": 445, "tcp_stream": 71, "udp_stream": null, "frame_number": 13155, "timestamp_epoch": "1552972221.853035000" } ], "directory_service": [ { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-8c476bf5da4de6e3b7c0a1f6", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 44, "timestamp_epoch": "1552959895.786307000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-95643daa556882ff8c97cdad", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 46, "timestamp_epoch": "1552959895.786550000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-ad8016476a758f40b76a790d", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 99, "timestamp_epoch": "1552959895.845945000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d7a12a4fe5bf8c40cec7e44b", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 107, "timestamp_epoch": "1552959895.847608000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": {}, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-fe8c74f47b79ac0df8cf9c0b", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 114, "timestamp_epoch": "1552959895.849409000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": {}, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-38bf7902e0594e8078072b21", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 115, "timestamp_epoch": "1552959895.849593000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": {}, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-e8c8f6432923eb8bec85504b", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 120, "timestamp_epoch": "1552959895.850303000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": {}, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-135e33293ebf6eab79d9bf85", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 123, "timestamp_epoch": "1552959895.850607000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": {}, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-f7ba877475885bb691b012d1", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 150, "timestamp_epoch": "1552959895.959317000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": {}, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-f056db252eb349869b30cca4", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 152, "timestamp_epoch": "1552959895.959683000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-7092394a57a1e313fb4215ec", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 161, "timestamp_epoch": "1552959896.032431000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c0414c57fe8b12a8c8ac60bd", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 163, "timestamp_epoch": "1552959896.032671000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-c653f13996e148a7b19f2676", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 178, "timestamp_epoch": "1552959896.039053000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-77441fce0fdaf2e3d1fbc836", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 180, "timestamp_epoch": "1552959896.039655000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-dacc09671d0187f8fca30fff", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 181, "timestamp_epoch": "1552959896.040792000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": {}, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-e643388a374f07929ad512f9", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 190, "timestamp_epoch": "1552959896.077860000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": {}, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-f40ba73858a2958b15bda977", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 193, "timestamp_epoch": "1552959896.078291000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": {}, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-d8e492dbaf9318c26d75237e", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 200, "timestamp_epoch": "1552959896.080361000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": {}, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-b838acb3888a2194c890eca0", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 201, "timestamp_epoch": "1552959896.080578000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": {}, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-a065f2d18e237399d9a1c1d6", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 206, "timestamp_epoch": "1552959896.088517000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": {}, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3a21a18f2d1c5089dda460cf", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 209, "timestamp_epoch": "1552959896.088867000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": {}, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-20cd9af35de47c4dd34c3aa2", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 210, "timestamp_epoch": "1552959896.089609000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": {}, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-fd3c9cc528857dc7c76a932c", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 211, "timestamp_epoch": "1552959896.089806000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": {}, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-e06c309a73ce04b1052e60a3", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 212, "timestamp_epoch": "1552959896.091578000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-8edc2a7835f2c04703fd00c8", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 245, "timestamp_epoch": "1552959896.404659000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7a9954219a5c5a61d0b6ae32", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 246, "timestamp_epoch": "1552959896.404885000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-ccbc89a7da384877ca6ff01d", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 247, "timestamp_epoch": "1552959896.405181000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-27d61eba5305f8ab224404d5", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 248, "timestamp_epoch": "1552959896.405467000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-3f40889a960d496113e06f6a", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 249, "timestamp_epoch": "1552959896.405803000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-a26198beb0091efb31373fa7", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 250, "timestamp_epoch": "1552959896.406043000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-cec701ed34941ec1907a2094", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 251, "timestamp_epoch": "1552959896.406187000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0e5686338bfb34c484bf3c13", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 252, "timestamp_epoch": "1552959896.406357000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-0b1021435dd67acd46270d54", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 264, "timestamp_epoch": "1552959896.987889000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-94d01b72cbbb10f2df9406ab", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 266, "timestamp_epoch": "1552959896.988174000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-537092b073ea3c256ade7aef", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 269, "timestamp_epoch": "1552959896.989874000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-192cfc22d1e433841120fd3b", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 271, "timestamp_epoch": "1552959896.990551000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=littletigers,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-fca8f9dc154e0c37de63e47a", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 284, "timestamp_epoch": "1552959897.003160000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-278a3bfe551d7c60535e378b", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 285, "timestamp_epoch": "1552959897.003428000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-0f4c8d30ce2bcd425c37ca34", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 290, "timestamp_epoch": "1552959897.007254000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-9b1bded0f9c88ae71c7b56e6", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 292, "timestamp_epoch": "1552959897.007798000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-be3834e4f11cc98a11822141", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 293, "timestamp_epoch": "1552959897.008335000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-78d8528cd94b71da75494162", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 294, "timestamp_epoch": "1552959897.008549000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=littletigers,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-174959a181eef0869bb30aa5", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 295, "timestamp_epoch": "1552959897.008805000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0abe4f4e612955e383db047d", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 296, "timestamp_epoch": "1552959897.009016000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=littletigers,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-26995f2aa99e3824f6d9aeb8", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 297, "timestamp_epoch": "1552959897.009305000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-02629cfc38872393d2beb65a", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 298, "timestamp_epoch": "1552959897.009545000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-b88faf5871b80bb5723df57f", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 367, "timestamp_epoch": "1552959897.022823000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-1f61357c6b2ee9fcfd78c01c", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 373, "timestamp_epoch": "1552959897.396390000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-acc3ed4708f88122f0fd828f", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 421, "timestamp_epoch": "1552959906.513461000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-feda2c0f050984623f3bdcb0", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 423, "timestamp_epoch": "1552959906.513734000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-e0b2d1cc1d1dc63dce12fde4", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 426, "timestamp_epoch": "1552959906.515880000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-b01395df52edd9f3ff1d6ee0", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 428, "timestamp_epoch": "1552959906.516502000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-21b1c9f4f343ec2818c6422a", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 429, "timestamp_epoch": "1552959906.517798000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-260269dc49eb56c4af54c5be", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 430, "timestamp_epoch": "1552959906.517979000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-12a7b988d28075e6c772105e", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 431, "timestamp_epoch": "1552959906.518186000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e2a019d6bd76ccc6f9146e10", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 432, "timestamp_epoch": "1552959906.518367000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=NTDS Settings,CN=LITTLETIGERS-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=littletigers,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-b57ee8fed5878252455bf79a", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 433, "timestamp_epoch": "1552959906.518576000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8d54c8590f1a70dd41f9e1f4", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 434, "timestamp_epoch": "1552959906.518813000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Public Key Services,CN=Services,CN=Configuration,DC=littletigers,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-9be92d705291bd1d8f743a95", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 435, "timestamp_epoch": "1552959906.518983000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-dc1306fc0e24e75b25df7c51", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 436, "timestamp_epoch": "1552959906.519211000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-8f2085e755d2fa28f4b5ea4e", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 441, "timestamp_epoch": "1552959906.529413000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3be5ec5273cc166fe8c5ea8d", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 443, "timestamp_epoch": "1552959906.530054000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-5f3ed6df1916d5ce3bda7920", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 444, "timestamp_epoch": "1552959906.530477000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8863bcc8a4e2bf75aa5b053d", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 445, "timestamp_epoch": "1552959906.530650000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=littletigers,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-64a20d4a154b5c9776d87580", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 476, "timestamp_epoch": "1552959906.553434000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-df7095a18ca53bd06062b3b4", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 477, "timestamp_epoch": "1552959906.553734000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-f0bf9d55da7f745bd55e938a", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 478, "timestamp_epoch": "1552959906.553968000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-37bbbeab8ea13dc0488382a5", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 480, "timestamp_epoch": "1552959906.554486000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-d951f6dd554c9c620461e538", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 579, "timestamp_epoch": "1552959980.762636000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-48d2c84785246849316a5d05", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 580, "timestamp_epoch": "1552959980.762848000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-5c70e13c4a42abc4bef09001", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 581, "timestamp_epoch": "1552959980.764767000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-cc65b6ad088c34e11af92b88", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 582, "timestamp_epoch": "1552959980.765115000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-df2a9cea6a7c1d923b304211", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 583, "timestamp_epoch": "1552959980.771590000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-5337b6b97a7f34e9cf8c2684", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 584, "timestamp_epoch": "1552959980.772028000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-013d42d842a0d3ddc4cbc403", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 585, "timestamp_epoch": "1552959980.773024000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-42e5278bb8423858a163cc95", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 586, "timestamp_epoch": "1552959980.773184000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-f9d815bb2fed3bfa89b409d0", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 652, "timestamp_epoch": "1552959981.300324000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0943c40fa584ed516ed9b388", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 654, "timestamp_epoch": "1552959981.300889000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=littletigers,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-f6d3701dc46f7bdc94bd983b", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 655, "timestamp_epoch": "1552959981.302787000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-727fc8dada0b04548e3012d0", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 656, "timestamp_epoch": "1552959981.303053000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-00bec3d6517fd65d309a0e36", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 661, "timestamp_epoch": "1552959981.305968000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-17d7c4f182ed1ccdd16d5045", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 663, "timestamp_epoch": "1552959981.306548000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-14ec0401528ac8093818cc54", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 664, "timestamp_epoch": "1552959981.306937000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-9f59525e8c0d316d8cf7fd4f", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 665, "timestamp_epoch": "1552959981.307106000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=littletigers,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-3d0dcbd97f6d27f16df2d0a9", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 666, "timestamp_epoch": "1552959981.307306000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-284f3b8c9910dad7d6d7bbf2", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 667, "timestamp_epoch": "1552959981.307520000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=littletigers,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-516764ee549bcae77f7b7fdd", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 668, "timestamp_epoch": "1552959981.307732000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-39ebc2129db4dd1c7cc92139", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 669, "timestamp_epoch": "1552959981.308018000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-1b58efc60f6c58aee1df89e3", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 688, "timestamp_epoch": "1552959981.314751000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-9da8ccb52af578ffc95a0a72", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 695, "timestamp_epoch": "1552959981.896609000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-be0371b3ed7a5366fe6b6b88", "src_port": null, "tcp_stream": 75, "udp_stream": null, "frame_number": 5321, "timestamp_epoch": "1552961469.417532000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c8bce5c6c0bf2b146441e291", "src_port": null, "tcp_stream": 75, "udp_stream": null, "frame_number": 5322, "timestamp_epoch": "1552961469.417775000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-84f403622c27afc432f0c300", "src_port": null, "tcp_stream": 75, "udp_stream": null, "frame_number": 5323, "timestamp_epoch": "1552961469.418048000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-eaddb1bc27387ab7cd49d30d", "src_port": null, "tcp_stream": 75, "udp_stream": null, "frame_number": 5324, "timestamp_epoch": "1552961469.418354000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-80dab09f732b90d9bc2b2c20", "src_port": null, "tcp_stream": 75, "udp_stream": null, "frame_number": 5325, "timestamp_epoch": "1552961469.418578000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-b3e2bc76413ccd046ed91aa4", "src_port": null, "tcp_stream": 75, "udp_stream": null, "frame_number": 5326, "timestamp_epoch": "1552961469.418826000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-b7aa3bc1b787e6bddde1bc6e", "src_port": null, "tcp_stream": 75, "udp_stream": null, "frame_number": 5327, "timestamp_epoch": "1552961469.419029000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-65c708668e464ced84ef7da0", "src_port": null, "tcp_stream": 75, "udp_stream": null, "frame_number": 5328, "timestamp_epoch": "1552961469.419257000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-b942af4be00d6908e73ffc72", "src_port": null, "tcp_stream": 75, "udp_stream": null, "frame_number": 5329, "timestamp_epoch": "1552961469.423440000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-662a093abe5ebb1310d69632", "src_port": null, "tcp_stream": 75, "udp_stream": null, "frame_number": 5330, "timestamp_epoch": "1552961469.423728000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-e9e00355825e02199d6aa61f", "src_port": null, "tcp_stream": 93, "udp_stream": null, "frame_number": 7547, "timestamp_epoch": "1552965682.140382000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-05683e1857822e07d21cf2a0", "src_port": null, "tcp_stream": 93, "udp_stream": null, "frame_number": 7548, "timestamp_epoch": "1552965682.140650000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-88f24cdeb2a593e64a716910", "src_port": null, "tcp_stream": 93, "udp_stream": null, "frame_number": 7549, "timestamp_epoch": "1552965682.140972000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3b7924cdf60037c9f1ae9f0f", "src_port": null, "tcp_stream": 93, "udp_stream": null, "frame_number": 7550, "timestamp_epoch": "1552965682.141330000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-ec7b8066cbd1df6fb8fbe65e", "src_port": null, "tcp_stream": 93, "udp_stream": null, "frame_number": 7551, "timestamp_epoch": "1552965682.141606000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e446ec2eadf067ec2fe2e903", "src_port": null, "tcp_stream": 93, "udp_stream": null, "frame_number": 7552, "timestamp_epoch": "1552965682.141800000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-1d0695e8ef44ebf299e3ba2e", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 7563, "timestamp_epoch": "1552965682.547897000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-02ca55a54b3edbd4e57510fa", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 7565, "timestamp_epoch": "1552965682.548145000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-25d1344d10bf4777f0794108", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 7568, "timestamp_epoch": "1552965682.549474000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1560d4ed251b44b61946b4be", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 7570, "timestamp_epoch": "1552965682.550027000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=littletigers,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-ca399eb9af0f442d5078eab4", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 7571, "timestamp_epoch": "1552965682.552936000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-13ae666c04083e9a6690b74b", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 7572, "timestamp_epoch": "1552965682.553220000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-b7e34447b09b71ae6aec1d43", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 7579, "timestamp_epoch": "1552965682.670156000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-db395abcd443a5c0d763d46c", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 7581, "timestamp_epoch": "1552965682.671009000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-f03f1dbb469c38a60ea82d1d", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 7582, "timestamp_epoch": "1552965682.671678000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c3451833521059996d764c9d", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 7583, "timestamp_epoch": "1552965682.671888000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=littletigers,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-b1427d72942dca73e823f6fb", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 7584, "timestamp_epoch": "1552965682.672132000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d94f0bac5f748a52eb545f8c", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 7585, "timestamp_epoch": "1552965682.672399000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=littletigers,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-0bf25eca2a5d6e566ed1318a", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 7586, "timestamp_epoch": "1552965682.672761000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-78f7ecc0280748977a487a6f", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 7587, "timestamp_epoch": "1552965682.673141000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-f40ec1bb1293ba72f144fcc7", "src_port": null, "tcp_stream": 95, "udp_stream": null, "frame_number": 7612, "timestamp_epoch": "1552965682.686236000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-7eef92ab6626369ddeaa7b0f", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 7616, "timestamp_epoch": "1552965683.199739000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-e8054c4700055711504759c3", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 7707, "timestamp_epoch": "1552965837.426619000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-9a89e1c6a3bca6305124c7ed", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 7708, "timestamp_epoch": "1552965837.426859000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-3b068d0709716253f8d23399", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 7709, "timestamp_epoch": "1552965837.427533000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-5c0aed703b897ba99c235688", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 7710, "timestamp_epoch": "1552965837.427889000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-9c8eff90c93b79a62f6319a8", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 7711, "timestamp_epoch": "1552965837.428162000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d061c69785c49ae98db05c6b", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 7712, "timestamp_epoch": "1552965837.428313000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-bd79b1a8bc69d5ecf02aca6e", "src_port": null, "tcp_stream": 99, "udp_stream": null, "frame_number": 7719, "timestamp_epoch": "1552965837.937986000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-bf03be0ecd14013c4ec2aa35", "src_port": null, "tcp_stream": 99, "udp_stream": null, "frame_number": 7721, "timestamp_epoch": "1552965837.938643000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=littletigers,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-23684ee647c84de173c13424", "src_port": null, "tcp_stream": 99, "udp_stream": null, "frame_number": 7722, "timestamp_epoch": "1552965837.946613000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-9fb5b8a0b7a205036c1d3146", "src_port": null, "tcp_stream": 99, "udp_stream": null, "frame_number": 7723, "timestamp_epoch": "1552965837.947061000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-332876b0bcc400248708b885", "src_port": null, "tcp_stream": 101, "udp_stream": null, "frame_number": 7734, "timestamp_epoch": "1552965837.950685000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-444a72bb5306d78b02fead81", "src_port": null, "tcp_stream": 101, "udp_stream": null, "frame_number": 7736, "timestamp_epoch": "1552965837.951264000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-ffec5d4eb9f0613de70b2169", "src_port": null, "tcp_stream": 101, "udp_stream": null, "frame_number": 7737, "timestamp_epoch": "1552965837.951667000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-f3957602efe55e71563c5dd2", "src_port": null, "tcp_stream": 101, "udp_stream": null, "frame_number": 7738, "timestamp_epoch": "1552965837.951814000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=littletigers,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-39b4dcdf60414c5563e6a688", "src_port": null, "tcp_stream": 101, "udp_stream": null, "frame_number": 7739, "timestamp_epoch": "1552965837.952001000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-c0f7b620345057ba417c0f75", "src_port": null, "tcp_stream": 101, "udp_stream": null, "frame_number": 7740, "timestamp_epoch": "1552965837.952179000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=littletigers,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-8e53998b7696709281c69bc5", "src_port": null, "tcp_stream": 99, "udp_stream": null, "frame_number": 7741, "timestamp_epoch": "1552965837.952412000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-daf131ce96dbea5e49301870", "src_port": null, "tcp_stream": 99, "udp_stream": null, "frame_number": 7742, "timestamp_epoch": "1552965837.952634000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-d4958977bae7bb72ed72cac6", "src_port": null, "tcp_stream": 101, "udp_stream": null, "frame_number": 7777, "timestamp_epoch": "1552965837.960490000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-86597347a19e884919043d92", "src_port": null, "tcp_stream": 99, "udp_stream": null, "frame_number": 7781, "timestamp_epoch": "1552965838.465469000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-2c7bf7f54cab674239a7c6b0", "src_port": null, "tcp_stream": 147, "udp_stream": null, "frame_number": 12628, "timestamp_epoch": "1552971443.321733000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-4c6314775a5d161018755e8b", "src_port": null, "tcp_stream": 147, "udp_stream": null, "frame_number": 12629, "timestamp_epoch": "1552971443.321980000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-d5c626f453833804c783819e", "src_port": null, "tcp_stream": 147, "udp_stream": null, "frame_number": 12630, "timestamp_epoch": "1552971443.322277000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-9e47c1641e5f6b8385a47a10", "src_port": null, "tcp_stream": 147, "udp_stream": null, "frame_number": 12631, "timestamp_epoch": "1552971443.322593000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-e03e903498767f14dfab9918", "src_port": null, "tcp_stream": 147, "udp_stream": null, "frame_number": 12632, "timestamp_epoch": "1552971443.322889000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e30d8cd7d7c56546c2e049e9", "src_port": null, "tcp_stream": 147, "udp_stream": null, "frame_number": 12633, "timestamp_epoch": "1552971443.323075000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-34eafabcb180ba17e2c2b5e6", "src_port": null, "tcp_stream": 148, "udp_stream": null, "frame_number": 12644, "timestamp_epoch": "1552971443.731967000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-08ba30c9701cac372c8dc308", "src_port": null, "tcp_stream": 148, "udp_stream": null, "frame_number": 12646, "timestamp_epoch": "1552971443.732226000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-bfc7b2502975ecf9df4f14ea", "src_port": null, "tcp_stream": 148, "udp_stream": null, "frame_number": 12649, "timestamp_epoch": "1552971443.733466000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3b9320bb9cbe74e9ce756294", "src_port": null, "tcp_stream": 148, "udp_stream": null, "frame_number": 12651, "timestamp_epoch": "1552971443.734069000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=littletigers,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-71afcfe4c4bedfdb24226f39", "src_port": null, "tcp_stream": 148, "udp_stream": null, "frame_number": 12652, "timestamp_epoch": "1552971443.737049000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-2251cc3e757aed6b0b96d748", "src_port": null, "tcp_stream": 148, "udp_stream": null, "frame_number": 12653, "timestamp_epoch": "1552971443.737333000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-2844a925137b1fc7c7e40929", "src_port": null, "tcp_stream": 149, "udp_stream": null, "frame_number": 12660, "timestamp_epoch": "1552971443.851500000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3c11d475ee2a7ec5d86ee022", "src_port": null, "tcp_stream": 149, "udp_stream": null, "frame_number": 12662, "timestamp_epoch": "1552971443.852189000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-75c6a463217c29a78fd6dbba", "src_port": null, "tcp_stream": 149, "udp_stream": null, "frame_number": 12663, "timestamp_epoch": "1552971443.852826000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-dcf5f2c34f7fe9a6b1a3d156", "src_port": null, "tcp_stream": 149, "udp_stream": null, "frame_number": 12664, "timestamp_epoch": "1552971443.853084000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=littletigers,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-f1870d09a96b1dabb513498e", "src_port": null, "tcp_stream": 149, "udp_stream": null, "frame_number": 12665, "timestamp_epoch": "1552971443.853316000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-81cf18174c91cc2ba034bbbb", "src_port": null, "tcp_stream": 149, "udp_stream": null, "frame_number": 12666, "timestamp_epoch": "1552971443.853558000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=littletigers,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-067188be1ebaa23f063e9b7b", "src_port": null, "tcp_stream": 148, "udp_stream": null, "frame_number": 12667, "timestamp_epoch": "1552971443.853790000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e79a9655c833a4734e1d03cb", "src_port": null, "tcp_stream": 148, "udp_stream": null, "frame_number": 12668, "timestamp_epoch": "1552971443.854159000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-59d2209b13fc10f8d10ae992", "src_port": null, "tcp_stream": 149, "udp_stream": null, "frame_number": 12693, "timestamp_epoch": "1552971443.865264000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-b65e38bcb70b573463719b24", "src_port": null, "tcp_stream": 148, "udp_stream": null, "frame_number": 12697, "timestamp_epoch": "1552971444.382531000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-b784ea8fb1db55466f205b06", "src_port": null, "tcp_stream": 152, "udp_stream": null, "frame_number": 12785, "timestamp_epoch": "1552971595.633716000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-1aedab7ea3cd10a308f855ab", "src_port": null, "tcp_stream": 152, "udp_stream": null, "frame_number": 12786, "timestamp_epoch": "1552971595.633945000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-7f6f7b68f53918b05efbaed6", "src_port": null, "tcp_stream": 152, "udp_stream": null, "frame_number": 12787, "timestamp_epoch": "1552971595.634132000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-8932b16bb4d311599e43628d", "src_port": null, "tcp_stream": 152, "udp_stream": null, "frame_number": 12788, "timestamp_epoch": "1552971595.634468000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-15eee54e431781be0fbab1ec", "src_port": null, "tcp_stream": 152, "udp_stream": null, "frame_number": 12789, "timestamp_epoch": "1552971595.634620000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-65227ff9f0d5cedfb21ca258", "src_port": null, "tcp_stream": 152, "udp_stream": null, "frame_number": 12790, "timestamp_epoch": "1552971595.634777000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-72f961816e3f527e071acfae", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 12911, "timestamp_epoch": "1552971778.501249000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-64319089d0909e9354d7a273", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 12912, "timestamp_epoch": "1552971778.501485000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-6bdb01451233459be2a0a69d", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 12913, "timestamp_epoch": "1552971778.501716000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-58a0c5668e7136d4e46d12e9", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 12914, "timestamp_epoch": "1552971778.502015000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-3858081b8942f5b8d6c1e75b", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 12915, "timestamp_epoch": "1552971778.502204000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-d276c6fc89906d1e99d55e69", "src_port": null, "tcp_stream": 155, "udp_stream": null, "frame_number": 12916, "timestamp_epoch": "1552971778.502378000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-5aa63c0b53344046dbdb1b89", "src_port": null, "tcp_stream": 156, "udp_stream": null, "frame_number": 12923, "timestamp_epoch": "1552971779.012324000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-f1668fc7aa25fc48711eb4a1", "src_port": null, "tcp_stream": 156, "udp_stream": null, "frame_number": 12925, "timestamp_epoch": "1552971779.013048000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=littletigers,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-e4852fe3c6def2240465cc2d", "src_port": null, "tcp_stream": 156, "udp_stream": null, "frame_number": 12928, "timestamp_epoch": "1552971779.117167000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-3439281ed934638cb51fc14b", "src_port": null, "tcp_stream": 156, "udp_stream": null, "frame_number": 12929, "timestamp_epoch": "1552971779.117608000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-3c0aaa2205317237013bce1a", "src_port": null, "tcp_stream": 157, "udp_stream": null, "frame_number": 12934, "timestamp_epoch": "1552971779.121318000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-7ad7a5b7698d5104d10bb1ef", "src_port": null, "tcp_stream": 157, "udp_stream": null, "frame_number": 12936, "timestamp_epoch": "1552971779.121877000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-6c1672e12047ac080d4cae2f", "src_port": null, "tcp_stream": 157, "udp_stream": null, "frame_number": 12937, "timestamp_epoch": "1552971779.122223000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-b3404511a4d1789bc92985d6", "src_port": null, "tcp_stream": 157, "udp_stream": null, "frame_number": 12938, "timestamp_epoch": "1552971779.122381000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=littletigers,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-06790d9aeb9e66a0d43b98ec", "src_port": null, "tcp_stream": 157, "udp_stream": null, "frame_number": 12939, "timestamp_epoch": "1552971779.122588000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-e30842ad8da0299b3bddd0ae", "src_port": null, "tcp_stream": 157, "udp_stream": null, "frame_number": 12940, "timestamp_epoch": "1552971779.122803000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=littletigers,DC=info", "ldap.protocolOp": "3" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-00d5a6dabe37232a41547f9b", "src_port": null, "tcp_stream": 156, "udp_stream": null, "frame_number": 12941, "timestamp_epoch": "1552971779.123018000" }, { "kind": "directory_service", "dst_ip": "10.0.90.215", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.90.9", "dst_port": null, "event_id": "evt-0ff1e8889409a3a42fc7c1e7", "src_port": null, "tcp_stream": 156, "udp_stream": null, "frame_number": 12942, "timestamp_epoch": "1552971779.123281000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-86826520a935ef9cb927e43d", "src_port": null, "tcp_stream": 157, "udp_stream": null, "frame_number": 12981, "timestamp_epoch": "1552971779.132600000" }, { "kind": "directory_service", "dst_ip": "10.0.90.9", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.90.215", "dst_port": null, "event_id": "evt-d683527a0640e04be3083bd1", "src_port": null, "tcp_stream": 156, "udp_stream": null, "frame_number": 12989, "timestamp_epoch": "1552971779.647425000" } ] }, "capture": { "format": "pcap-le-microsecond", "packet_count": 13186, "interface_ids": [], "source_sha256": "257ba51a573232f7c2a8b43b55e127e793abe0bf067bd55f40dbee398fde6520", "captured_bytes": 7563934, "protocol_counts": { "ip": 13186, "dns": 82, "eth": 13186, "ntp": 24, "smb": 32, "tcp": 12959, "tls": 887, "udp": 221, "data": 131, "dhcp": 16, "http": 8, "igmp": 12, "ldap": 140, "nbns": 49, "nbss": 382, "smb2": 362, "ssdp": 6, "cldap": 24, "llmnr": 8, "nbdgm": 12, "dcerpc": 170, "spnego": 150, "x509ce": 75, "browser": 12, "gss-api": 192, "x509sat": 268, "kerberos": 56, "ethertype": 13186, "spnego-krb5": 318, "iec60870_104": 2621, "iec60870_asdu": 248, "data-text-lines": 1 }, "duration_seconds": 12421.620792, "last_packet_epoch": "1552972317.257558", "source_size_bytes": 7774934, "first_packet_epoch": "1552959895.636766", "encapsulation_types": [ 1 ] }, "summary": "Decoded 13186 packets across 18 IP endpoints and 226 transport flows. Observed 82 DNS events, 10 HTTP requests, 26 TLS ClientHello events, and 4 recovered file/message object(s). Deterministic rules produced 7 finding(s): 0 high, 3 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "coverage": { "warnings": [], "limitations": [ "Encrypted application contents are not decrypted", "Protocol decoding and heuristic findings do not establish malware family or attribution", "No endpoint execution, persistence, or credential-theft proof without corresponding evidence" ], "event_limits": { "dns": { "returned": 82, "truncated": false }, "dhcp": { "returned": 16, "truncated": false }, "smtp": { "returned": 0, "truncated": false }, "identity": { "returned": 543, "truncated": false }, "http_request": { "returned": 10, "truncated": false }, "http_response": { "returned": 4, "truncated": false }, "tls_client_hello": { "returned": 26, "truncated": false }, "unclassified_tcp": { "returned": 121, "truncated": false }, "directory_service": { "returned": 190, "truncated": false } }, "http_objects": { "complete": true, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "hashed_bytes": 988168, "export_status": "completed", "unique_hashes": 4, "hashed_objects": 4, "compact_objects": 0, "detailed_objects": 4, "exported_objects": 4, "unhashed_objects": 0, "compact_hash_index": [], "omitted_unique_hashes": 0, "returned_unique_hashes": 4 }, "name_resolution": false, "supplemental_objects": { "scope": "bounded IMF, inert embedded base64 and complete contiguous HTTP response recovery", "returned": 0 }, "complete_within_profile": true, "encrypted_payload_visibility": "metadata-only" }, "findings": [ { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/test1.exe", "source": "209.141.34.8", "destination": "10.0.90.215", "content_type": "application/octet-stream", "response_count": 1, "declared_body_bytes": 811520 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 48, "frame_number": 754, "display_filter": "frame.number == 754", "timestamp_epoch": "1552960024.599220000" }, { "tcp_stream": 48, "frame_number": 1523, "display_filter": "frame.number == 1523", "timestamp_epoch": "1552960024.930842000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-bb2975e364354c73399c85c6", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/f4.exe", "source": "217.23.14.81", "destination": "10.0.90.215", "content_type": "application/octet-stream", "response_count": 1, "declared_body_bytes": 176128 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 50, "frame_number": 1553, "display_filter": "frame.number == 1553", "timestamp_epoch": "1552960186.057432000" }, { "tcp_stream": 50, "frame_number": 1713, "display_filter": "frame.number == 1713", "timestamp_epoch": "1552960186.860440000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-c205c2d47a5f745257bd49d6", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.0.90.215", "protocol": "drsuapi", "destination": "10.0.90.9", "event_count": 28, "operation_numbers": [ "0", "1", "12" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 17, "frame_number": 245, "display_filter": "frame.number == 245", "timestamp_epoch": "1552959896.404659000" }, { "tcp_stream": 17, "frame_number": 247, "display_filter": "frame.number == 247", "timestamp_epoch": "1552959896.405181000" }, { "tcp_stream": 17, "frame_number": 249, "display_filter": "frame.number == 249", "timestamp_epoch": "1552959896.405803000" }, { "tcp_stream": 17, "frame_number": 251, "display_filter": "frame.number == 251", "timestamp_epoch": "1552959896.406187000" }, { "tcp_stream": 38, "frame_number": 579, "display_filter": "frame.number == 579", "timestamp_epoch": "1552959980.762636000" }, { "tcp_stream": 38, "frame_number": 581, "display_filter": "frame.number == 581", "timestamp_epoch": "1552959980.764767000" }, { "tcp_stream": 38, "frame_number": 583, "display_filter": "frame.number == 583", "timestamp_epoch": "1552959980.771590000" }, { "tcp_stream": 38, "frame_number": 585, "display_filter": "frame.number == 585", "timestamp_epoch": "1552959980.773024000" }, { "tcp_stream": 75, "frame_number": 5321, "display_filter": "frame.number == 5321", "timestamp_epoch": "1552961469.417532000" }, { "tcp_stream": 75, "frame_number": 5323, "display_filter": "frame.number == 5323", "timestamp_epoch": "1552961469.418048000" }, { "tcp_stream": 75, "frame_number": 5325, "display_filter": "frame.number == 5325", "timestamp_epoch": "1552961469.418578000" }, { "tcp_stream": 75, "frame_number": 5327, "display_filter": "frame.number == 5327", "timestamp_epoch": "1552961469.419029000" }, { "tcp_stream": 75, "frame_number": 5329, "display_filter": "frame.number == 5329", "timestamp_epoch": "1552961469.423440000" }, { "tcp_stream": 93, "frame_number": 7547, "display_filter": "frame.number == 7547", "timestamp_epoch": "1552965682.140382000" }, { "tcp_stream": 93, "frame_number": 7549, "display_filter": "frame.number == 7549", "timestamp_epoch": "1552965682.140972000" }, { "tcp_stream": 93, "frame_number": 7551, "display_filter": "frame.number == 7551", "timestamp_epoch": "1552965682.141606000" }, { "tcp_stream": 98, "frame_number": 7707, "display_filter": "frame.number == 7707", "timestamp_epoch": "1552965837.426619000" }, { "tcp_stream": 98, "frame_number": 7709, "display_filter": "frame.number == 7709", "timestamp_epoch": "1552965837.427533000" }, { "tcp_stream": 98, "frame_number": 7711, "display_filter": "frame.number == 7711", "timestamp_epoch": "1552965837.428162000" }, { "tcp_stream": 147, "frame_number": 12628, "display_filter": "frame.number == 12628", "timestamp_epoch": "1552971443.321733000" }, { "tcp_stream": 147, "frame_number": 12630, "display_filter": "frame.number == 12630", "timestamp_epoch": "1552971443.322277000" }, { "tcp_stream": 147, "frame_number": 12632, "display_filter": "frame.number == 12632", "timestamp_epoch": "1552971443.322889000" }, { "tcp_stream": 152, "frame_number": 12785, "display_filter": "frame.number == 12785", "timestamp_epoch": "1552971595.633716000" }, { "tcp_stream": 152, "frame_number": 12787, "display_filter": "frame.number == 12787", "timestamp_epoch": "1552971595.634132000" }, { "tcp_stream": 152, "frame_number": 12789, "display_filter": "frame.number == 12789", "timestamp_epoch": "1552971595.634620000" }, { "tcp_stream": 155, "frame_number": 12911, "display_filter": "frame.number == 12911", "timestamp_epoch": "1552971778.501249000" }, { "tcp_stream": 155, "frame_number": 12913, "display_filter": "frame.number == 12913", "timestamp_epoch": "1552971778.501716000" }, { "tcp_stream": 155, "frame_number": 12915, "display_filter": "frame.number == 12915", "timestamp_epoch": "1552971778.502204000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-996d06a530124645b869ae41", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.0.90.215", "protocol": "ldap", "destination": "10.0.90.9", "event_count": 75, "operation_numbers": [ "", "0", "2", "3" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 3, "frame_number": 44, "display_filter": "frame.number == 44", "timestamp_epoch": "1552959895.786307000" }, { "tcp_stream": 3, "frame_number": 99, "display_filter": "frame.number == 99", "timestamp_epoch": "1552959895.845945000" }, { "tcp_stream": 3, "frame_number": 114, "display_filter": "frame.number == 114", "timestamp_epoch": "1552959895.849409000" }, { "tcp_stream": 3, "frame_number": 120, "display_filter": "frame.number == 120", "timestamp_epoch": "1552959895.850303000" }, { "tcp_stream": 3, "frame_number": 150, "display_filter": "frame.number == 150", "timestamp_epoch": "1552959895.959317000" }, { "tcp_stream": 12, "frame_number": 161, "display_filter": "frame.number == 161", "timestamp_epoch": "1552959896.032431000" }, { "tcp_stream": 12, "frame_number": 178, "display_filter": "frame.number == 178", "timestamp_epoch": "1552959896.039053000" }, { "tcp_stream": 12, "frame_number": 181, "display_filter": "frame.number == 181", "timestamp_epoch": "1552959896.040792000" }, { "tcp_stream": 3, "frame_number": 190, "display_filter": "frame.number == 190", "timestamp_epoch": "1552959896.077860000" }, { "tcp_stream": 3, "frame_number": 200, "display_filter": "frame.number == 200", "timestamp_epoch": "1552959896.080361000" }, { "tcp_stream": 3, "frame_number": 206, "display_filter": "frame.number == 206", "timestamp_epoch": "1552959896.088517000" }, { "tcp_stream": 3, "frame_number": 210, "display_filter": "frame.number == 210", "timestamp_epoch": "1552959896.089609000" }, { "tcp_stream": 3, "frame_number": 212, "display_filter": "frame.number == 212", "timestamp_epoch": "1552959896.091578000" }, { "tcp_stream": 19, "frame_number": 264, "display_filter": "frame.number == 264", "timestamp_epoch": "1552959896.987889000" }, { "tcp_stream": 19, "frame_number": 269, "display_filter": "frame.number == 269", "timestamp_epoch": "1552959896.989874000" }, { "tcp_stream": 19, "frame_number": 284, "display_filter": "frame.number == 284", "timestamp_epoch": "1552959897.003160000" }, { "tcp_stream": 21, "frame_number": 290, "display_filter": "frame.number == 290", "timestamp_epoch": "1552959897.007254000" }, { "tcp_stream": 21, "frame_number": 293, "display_filter": "frame.number == 293", "timestamp_epoch": "1552959897.008335000" }, { "tcp_stream": 21, "frame_number": 295, "display_filter": "frame.number == 295", "timestamp_epoch": "1552959897.008805000" }, { "tcp_stream": 19, "frame_number": 297, "display_filter": "frame.number == 297", "timestamp_epoch": "1552959897.009305000" }, { "tcp_stream": 21, "frame_number": 367, "display_filter": "frame.number == 367", "timestamp_epoch": "1552959897.022823000" }, { "tcp_stream": 19, "frame_number": 373, "display_filter": "frame.number == 373", "timestamp_epoch": "1552959897.396390000" }, { "tcp_stream": 28, "frame_number": 421, "display_filter": "frame.number == 421", "timestamp_epoch": "1552959906.513461000" }, { "tcp_stream": 28, "frame_number": 426, "display_filter": "frame.number == 426", "timestamp_epoch": "1552959906.515880000" }, { "tcp_stream": 28, "frame_number": 429, "display_filter": "frame.number == 429", "timestamp_epoch": "1552959906.517798000" }, { "tcp_stream": 28, "frame_number": 431, "display_filter": "frame.number == 431", "timestamp_epoch": "1552959906.518186000" }, { "tcp_stream": 28, "frame_number": 433, "display_filter": "frame.number == 433", "timestamp_epoch": "1552959906.518576000" }, { "tcp_stream": 28, "frame_number": 435, "display_filter": "frame.number == 435", "timestamp_epoch": "1552959906.518983000" }, { "tcp_stream": 29, "frame_number": 441, "display_filter": "frame.number == 441", "timestamp_epoch": "1552959906.529413000" }, { "tcp_stream": 29, "frame_number": 444, "display_filter": "frame.number == 444", "timestamp_epoch": "1552959906.530477000" }, { "tcp_stream": 29, "frame_number": 476, "display_filter": "frame.number == 476", "timestamp_epoch": "1552959906.553434000" }, { "tcp_stream": 29, "frame_number": 478, "display_filter": "frame.number == 478", "timestamp_epoch": "1552959906.553968000" }, { "tcp_stream": 28, "frame_number": 480, "display_filter": "frame.number == 480", "timestamp_epoch": "1552959906.554486000" }, { "tcp_stream": 43, "frame_number": 652, "display_filter": "frame.number == 652", "timestamp_epoch": "1552959981.300324000" }, { "tcp_stream": 43, "frame_number": 655, "display_filter": "frame.number == 655", "timestamp_epoch": "1552959981.302787000" }, { "tcp_stream": 45, "frame_number": 661, "display_filter": "frame.number == 661", "timestamp_epoch": "1552959981.305968000" }, { "tcp_stream": 45, "frame_number": 664, "display_filter": "frame.number == 664", "timestamp_epoch": "1552959981.306937000" }, { "tcp_stream": 45, "frame_number": 666, "display_filter": "frame.number == 666", "timestamp_epoch": "1552959981.307306000" }, { "tcp_stream": 43, "frame_number": 668, "display_filter": "frame.number == 668", "timestamp_epoch": "1552959981.307732000" }, { "tcp_stream": 45, "frame_number": 688, "display_filter": "frame.number == 688", "timestamp_epoch": "1552959981.314751000" }, { "tcp_stream": 43, "frame_number": 695, "display_filter": "frame.number == 695", "timestamp_epoch": "1552959981.896609000" }, { "tcp_stream": 94, "frame_number": 7563, "display_filter": "frame.number == 7563", "timestamp_epoch": "1552965682.547897000" }, { "tcp_stream": 94, "frame_number": 7568, "display_filter": "frame.number == 7568", "timestamp_epoch": "1552965682.549474000" }, { "tcp_stream": 94, "frame_number": 7571, "display_filter": "frame.number == 7571", "timestamp_epoch": "1552965682.552936000" }, { "tcp_stream": 95, "frame_number": 7579, "display_filter": "frame.number == 7579", "timestamp_epoch": "1552965682.670156000" }, { "tcp_stream": 95, "frame_number": 7582, "display_filter": "frame.number == 7582", "timestamp_epoch": "1552965682.671678000" }, { "tcp_stream": 95, "frame_number": 7584, "display_filter": "frame.number == 7584", "timestamp_epoch": "1552965682.672132000" }, { "tcp_stream": 94, "frame_number": 7586, "display_filter": "frame.number == 7586", "timestamp_epoch": "1552965682.672761000" }, { "tcp_stream": 95, "frame_number": 7612, "display_filter": "frame.number == 7612", "timestamp_epoch": "1552965682.686236000" }, { "tcp_stream": 94, "frame_number": 7616, "display_filter": "frame.number == 7616", "timestamp_epoch": "1552965683.199739000" }, { "tcp_stream": 99, "frame_number": 7719, "display_filter": "frame.number == 7719", "timestamp_epoch": "1552965837.937986000" }, { "tcp_stream": 99, "frame_number": 7722, "display_filter": "frame.number == 7722", "timestamp_epoch": "1552965837.946613000" }, { "tcp_stream": 101, "frame_number": 7734, "display_filter": "frame.number == 7734", "timestamp_epoch": "1552965837.950685000" }, { "tcp_stream": 101, "frame_number": 7737, "display_filter": "frame.number == 7737", "timestamp_epoch": "1552965837.951667000" }, { "tcp_stream": 101, "frame_number": 7739, "display_filter": "frame.number == 7739", "timestamp_epoch": "1552965837.952001000" }, { "tcp_stream": 99, "frame_number": 7741, "display_filter": "frame.number == 7741", "timestamp_epoch": "1552965837.952412000" }, { "tcp_stream": 101, "frame_number": 7777, "display_filter": "frame.number == 7777", "timestamp_epoch": "1552965837.960490000" }, { "tcp_stream": 99, "frame_number": 7781, "display_filter": "frame.number == 7781", "timestamp_epoch": "1552965838.465469000" }, { "tcp_stream": 148, "frame_number": 12644, "display_filter": "frame.number == 12644", "timestamp_epoch": "1552971443.731967000" }, { "tcp_stream": 148, "frame_number": 12649, "display_filter": "frame.number == 12649", "timestamp_epoch": "1552971443.733466000" }, { "tcp_stream": 148, "frame_number": 12652, "display_filter": "frame.number == 12652", "timestamp_epoch": "1552971443.737049000" }, { "tcp_stream": 149, "frame_number": 12660, "display_filter": "frame.number == 12660", "timestamp_epoch": "1552971443.851500000" }, { "tcp_stream": 149, "frame_number": 12663, "display_filter": "frame.number == 12663", "timestamp_epoch": "1552971443.852826000" }, { "tcp_stream": 149, "frame_number": 12665, "display_filter": "frame.number == 12665", "timestamp_epoch": "1552971443.853316000" }, { "tcp_stream": 148, "frame_number": 12667, "display_filter": "frame.number == 12667", "timestamp_epoch": "1552971443.853790000" }, { "tcp_stream": 149, "frame_number": 12693, "display_filter": "frame.number == 12693", "timestamp_epoch": "1552971443.865264000" }, { "tcp_stream": 148, "frame_number": 12697, "display_filter": "frame.number == 12697", "timestamp_epoch": "1552971444.382531000" }, { "tcp_stream": 156, "frame_number": 12923, "display_filter": "frame.number == 12923", "timestamp_epoch": "1552971779.012324000" }, { "tcp_stream": 156, "frame_number": 12928, "display_filter": "frame.number == 12928", "timestamp_epoch": "1552971779.117167000" }, { "tcp_stream": 157, "frame_number": 12934, "display_filter": "frame.number == 12934", "timestamp_epoch": "1552971779.121318000" }, { "tcp_stream": 157, "frame_number": 12937, "display_filter": "frame.number == 12937", "timestamp_epoch": "1552971779.122223000" }, { "tcp_stream": 157, "frame_number": 12939, "display_filter": "frame.number == 12939", "timestamp_epoch": "1552971779.122588000" }, { "tcp_stream": 156, "frame_number": 12941, "display_filter": "frame.number == 12941", "timestamp_epoch": "1552971779.123018000" }, { "tcp_stream": 157, "frame_number": 12981, "display_filter": "frame.number == 12981", "timestamp_epoch": "1552971779.132600000" }, { "tcp_stream": 156, "frame_number": 12989, "display_filter": "frame.number == 12989", "timestamp_epoch": "1552971779.647425000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-8e765d03c4fb3a618220f69b", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.0.90.9", "protocol": "drsuapi", "destination": "10.0.90.215", "event_count": 28, "operation_numbers": [ "0", "1", "12" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 17, "frame_number": 246, "display_filter": "frame.number == 246", "timestamp_epoch": "1552959896.404885000" }, { "tcp_stream": 17, "frame_number": 248, "display_filter": "frame.number == 248", "timestamp_epoch": "1552959896.405467000" }, { "tcp_stream": 17, "frame_number": 250, "display_filter": "frame.number == 250", "timestamp_epoch": "1552959896.406043000" }, { "tcp_stream": 17, "frame_number": 252, "display_filter": "frame.number == 252", "timestamp_epoch": "1552959896.406357000" }, { "tcp_stream": 38, "frame_number": 580, "display_filter": "frame.number == 580", "timestamp_epoch": "1552959980.762848000" }, { "tcp_stream": 38, "frame_number": 582, "display_filter": "frame.number == 582", "timestamp_epoch": "1552959980.765115000" }, { "tcp_stream": 38, "frame_number": 584, "display_filter": "frame.number == 584", "timestamp_epoch": "1552959980.772028000" }, { "tcp_stream": 38, "frame_number": 586, "display_filter": "frame.number == 586", "timestamp_epoch": "1552959980.773184000" }, { "tcp_stream": 75, "frame_number": 5322, "display_filter": "frame.number == 5322", "timestamp_epoch": "1552961469.417775000" }, { "tcp_stream": 75, "frame_number": 5324, "display_filter": "frame.number == 5324", "timestamp_epoch": "1552961469.418354000" }, { "tcp_stream": 75, "frame_number": 5326, "display_filter": "frame.number == 5326", "timestamp_epoch": "1552961469.418826000" }, { "tcp_stream": 75, "frame_number": 5328, "display_filter": "frame.number == 5328", "timestamp_epoch": "1552961469.419257000" }, { "tcp_stream": 75, "frame_number": 5330, "display_filter": "frame.number == 5330", "timestamp_epoch": "1552961469.423728000" }, { "tcp_stream": 93, "frame_number": 7548, "display_filter": "frame.number == 7548", "timestamp_epoch": "1552965682.140650000" }, { "tcp_stream": 93, "frame_number": 7550, "display_filter": "frame.number == 7550", "timestamp_epoch": "1552965682.141330000" }, { "tcp_stream": 93, "frame_number": 7552, "display_filter": "frame.number == 7552", "timestamp_epoch": "1552965682.141800000" }, { "tcp_stream": 98, "frame_number": 7708, "display_filter": "frame.number == 7708", "timestamp_epoch": "1552965837.426859000" }, { "tcp_stream": 98, "frame_number": 7710, "display_filter": "frame.number == 7710", "timestamp_epoch": "1552965837.427889000" }, { "tcp_stream": 98, "frame_number": 7712, "display_filter": "frame.number == 7712", "timestamp_epoch": "1552965837.428313000" }, { "tcp_stream": 147, "frame_number": 12629, "display_filter": "frame.number == 12629", "timestamp_epoch": "1552971443.321980000" }, { "tcp_stream": 147, "frame_number": 12631, "display_filter": "frame.number == 12631", "timestamp_epoch": "1552971443.322593000" }, { "tcp_stream": 147, "frame_number": 12633, "display_filter": "frame.number == 12633", "timestamp_epoch": "1552971443.323075000" }, { "tcp_stream": 152, "frame_number": 12786, "display_filter": "frame.number == 12786", "timestamp_epoch": "1552971595.633945000" }, { "tcp_stream": 152, "frame_number": 12788, "display_filter": "frame.number == 12788", "timestamp_epoch": "1552971595.634468000" }, { "tcp_stream": 152, "frame_number": 12790, "display_filter": "frame.number == 12790", "timestamp_epoch": "1552971595.634777000" }, { "tcp_stream": 155, "frame_number": 12912, "display_filter": "frame.number == 12912", "timestamp_epoch": "1552971778.501485000" }, { "tcp_stream": 155, "frame_number": 12914, "display_filter": "frame.number == 12914", "timestamp_epoch": "1552971778.502015000" }, { "tcp_stream": 155, "frame_number": 12916, "display_filter": "frame.number == 12916", "timestamp_epoch": "1552971778.502378000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-5d6cd53c5a16d13e00a5b5ed", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.0.90.9", "protocol": "ldap", "destination": "10.0.90.215", "event_count": 59, "operation_numbers": [ "", "1", "4,19,19,19,5", "4,5", "5" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 3, "frame_number": 46, "display_filter": "frame.number == 46", "timestamp_epoch": "1552959895.786550000" }, { "tcp_stream": 3, "frame_number": 107, "display_filter": "frame.number == 107", "timestamp_epoch": "1552959895.847608000" }, { "tcp_stream": 3, "frame_number": 115, "display_filter": "frame.number == 115", "timestamp_epoch": "1552959895.849593000" }, { "tcp_stream": 3, "frame_number": 123, "display_filter": "frame.number == 123", "timestamp_epoch": "1552959895.850607000" }, { "tcp_stream": 3, "frame_number": 152, "display_filter": "frame.number == 152", "timestamp_epoch": "1552959895.959683000" }, { "tcp_stream": 12, "frame_number": 163, "display_filter": "frame.number == 163", "timestamp_epoch": "1552959896.032671000" }, { "tcp_stream": 12, "frame_number": 180, "display_filter": "frame.number == 180", "timestamp_epoch": "1552959896.039655000" }, { "tcp_stream": 3, "frame_number": 193, "display_filter": "frame.number == 193", "timestamp_epoch": "1552959896.078291000" }, { "tcp_stream": 3, "frame_number": 201, "display_filter": "frame.number == 201", "timestamp_epoch": "1552959896.080578000" }, { "tcp_stream": 3, "frame_number": 209, "display_filter": "frame.number == 209", "timestamp_epoch": "1552959896.088867000" }, { "tcp_stream": 3, "frame_number": 211, "display_filter": "frame.number == 211", "timestamp_epoch": "1552959896.089806000" }, { "tcp_stream": 19, "frame_number": 266, "display_filter": "frame.number == 266", "timestamp_epoch": "1552959896.988174000" }, { "tcp_stream": 19, "frame_number": 271, "display_filter": "frame.number == 271", "timestamp_epoch": "1552959896.990551000" }, { "tcp_stream": 19, "frame_number": 285, "display_filter": "frame.number == 285", "timestamp_epoch": "1552959897.003428000" }, { "tcp_stream": 21, "frame_number": 292, "display_filter": "frame.number == 292", "timestamp_epoch": "1552959897.007798000" }, { "tcp_stream": 21, "frame_number": 294, "display_filter": "frame.number == 294", "timestamp_epoch": "1552959897.008549000" }, { "tcp_stream": 21, "frame_number": 296, "display_filter": "frame.number == 296", "timestamp_epoch": "1552959897.009016000" }, { "tcp_stream": 19, "frame_number": 298, "display_filter": "frame.number == 298", "timestamp_epoch": "1552959897.009545000" }, { "tcp_stream": 28, "frame_number": 423, "display_filter": "frame.number == 423", "timestamp_epoch": "1552959906.513734000" }, { "tcp_stream": 28, "frame_number": 428, "display_filter": "frame.number == 428", "timestamp_epoch": "1552959906.516502000" }, { "tcp_stream": 28, "frame_number": 430, "display_filter": "frame.number == 430", "timestamp_epoch": "1552959906.517979000" }, { "tcp_stream": 28, "frame_number": 432, "display_filter": "frame.number == 432", "timestamp_epoch": "1552959906.518367000" }, { "tcp_stream": 28, "frame_number": 434, "display_filter": "frame.number == 434", "timestamp_epoch": "1552959906.518813000" }, { "tcp_stream": 28, "frame_number": 436, "display_filter": "frame.number == 436", "timestamp_epoch": "1552959906.519211000" }, { "tcp_stream": 29, "frame_number": 443, "display_filter": "frame.number == 443", "timestamp_epoch": "1552959906.530054000" }, { "tcp_stream": 29, "frame_number": 445, "display_filter": "frame.number == 445", "timestamp_epoch": "1552959906.530650000" }, { "tcp_stream": 29, "frame_number": 477, "display_filter": "frame.number == 477", "timestamp_epoch": "1552959906.553734000" }, { "tcp_stream": 43, "frame_number": 654, "display_filter": "frame.number == 654", "timestamp_epoch": "1552959981.300889000" }, { "tcp_stream": 43, "frame_number": 656, "display_filter": "frame.number == 656", "timestamp_epoch": "1552959981.303053000" }, { "tcp_stream": 45, "frame_number": 663, "display_filter": "frame.number == 663", "timestamp_epoch": "1552959981.306548000" }, { "tcp_stream": 45, "frame_number": 665, "display_filter": "frame.number == 665", "timestamp_epoch": "1552959981.307106000" }, { "tcp_stream": 45, "frame_number": 667, "display_filter": "frame.number == 667", "timestamp_epoch": "1552959981.307520000" }, { "tcp_stream": 43, "frame_number": 669, "display_filter": "frame.number == 669", "timestamp_epoch": "1552959981.308018000" }, { "tcp_stream": 94, "frame_number": 7565, "display_filter": "frame.number == 7565", "timestamp_epoch": "1552965682.548145000" }, { "tcp_stream": 94, "frame_number": 7570, "display_filter": "frame.number == 7570", "timestamp_epoch": "1552965682.550027000" }, { "tcp_stream": 94, "frame_number": 7572, "display_filter": "frame.number == 7572", "timestamp_epoch": "1552965682.553220000" }, { "tcp_stream": 95, "frame_number": 7581, "display_filter": "frame.number == 7581", "timestamp_epoch": "1552965682.671009000" }, { "tcp_stream": 95, "frame_number": 7583, "display_filter": "frame.number == 7583", "timestamp_epoch": "1552965682.671888000" }, { "tcp_stream": 95, "frame_number": 7585, "display_filter": "frame.number == 7585", "timestamp_epoch": "1552965682.672399000" }, { "tcp_stream": 94, "frame_number": 7587, "display_filter": "frame.number == 7587", "timestamp_epoch": "1552965682.673141000" }, { "tcp_stream": 99, "frame_number": 7721, "display_filter": "frame.number == 7721", "timestamp_epoch": "1552965837.938643000" }, { "tcp_stream": 99, "frame_number": 7723, "display_filter": "frame.number == 7723", "timestamp_epoch": "1552965837.947061000" }, { "tcp_stream": 101, "frame_number": 7736, "display_filter": "frame.number == 7736", "timestamp_epoch": "1552965837.951264000" }, { "tcp_stream": 101, "frame_number": 7738, "display_filter": "frame.number == 7738", "timestamp_epoch": "1552965837.951814000" }, { "tcp_stream": 101, "frame_number": 7740, "display_filter": "frame.number == 7740", "timestamp_epoch": "1552965837.952179000" }, { "tcp_stream": 99, "frame_number": 7742, "display_filter": "frame.number == 7742", "timestamp_epoch": "1552965837.952634000" }, { "tcp_stream": 148, "frame_number": 12646, "display_filter": "frame.number == 12646", "timestamp_epoch": "1552971443.732226000" }, { "tcp_stream": 148, "frame_number": 12651, "display_filter": "frame.number == 12651", "timestamp_epoch": "1552971443.734069000" }, { "tcp_stream": 148, "frame_number": 12653, "display_filter": "frame.number == 12653", "timestamp_epoch": "1552971443.737333000" }, { "tcp_stream": 149, "frame_number": 12662, "display_filter": "frame.number == 12662", "timestamp_epoch": "1552971443.852189000" }, { "tcp_stream": 149, "frame_number": 12664, "display_filter": "frame.number == 12664", "timestamp_epoch": "1552971443.853084000" }, { "tcp_stream": 149, "frame_number": 12666, "display_filter": "frame.number == 12666", "timestamp_epoch": "1552971443.853558000" }, { "tcp_stream": 148, "frame_number": 12668, "display_filter": "frame.number == 12668", "timestamp_epoch": "1552971443.854159000" }, { "tcp_stream": 156, "frame_number": 12925, "display_filter": "frame.number == 12925", "timestamp_epoch": "1552971779.013048000" }, { "tcp_stream": 156, "frame_number": 12929, "display_filter": "frame.number == 12929", "timestamp_epoch": "1552971779.117608000" }, { "tcp_stream": 157, "frame_number": 12936, "display_filter": "frame.number == 12936", "timestamp_epoch": "1552971779.121877000" }, { "tcp_stream": 157, "frame_number": 12938, "display_filter": "frame.number == 12938", "timestamp_epoch": "1552971779.122381000" }, { "tcp_stream": 157, "frame_number": 12940, "display_filter": "frame.number == 12940", "timestamp_epoch": "1552971779.122803000" }, { "tcp_stream": 156, "frame_number": 12942, "display_filter": "frame.number == 12942", "timestamp_epoch": "1552971779.123281000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-9a92d80bd96fe252c458b732", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Sustained external TCP conversation outside decoded application coverage", "status": "candidate", "metrics": { "source": "10.0.90.215", "packets": 3886, "wire_bytes": 536481, "destination": "103.1.184.108", "destination_port": 2404, "duration_seconds": 12132.598 }, "rule_id": "unclassified-external-tcp", "evidence": [ { "tcp_stream": 49, "frame_number": 1537, "display_filter": "tcp.stream == 49", "timestamp_epoch": "1552960184.659413" } ], "severity": "medium", "confidence": 0.7, "finding_id": "finding-9181c2380707d2d0c00c13c3", "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.", "rule_version": "pcap-rules-v5" } ], "artifacts": [ { "md5": "f0882b09aebf9b37f740d9a42e3fa4bb", "sha1": "e1068da52875b055ec58d2c2b8110932e863f981", "type": "http-exported-object", "sha256": "2a9b0ed40f1f0bc0c13ff35d304689e9cadd633781cbcad1c2d2b92ced3f1c85", "evidence": [ { "tcp_stream": 48, "frame_number": 1523, "display_filter": "frame.number == 1523", "timestamp_epoch": "1552960024.930842000" } ], "filename": "test1.exe", "filenames": [ "test1.exe" ], "transfers": [ { "url": "http://209.141.34.8/test1.exe", "client_ip": "10.0.90.215", "server_ip": "209.141.34.8", "tcp_stream": 48, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 754, "response_frame": 1523 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 811520, "artifact_id": "artifact-0a0a4527e8ee1e79f9cdb1d2", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": "executable", "features": [], "content_kind": "pe", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "4ce94bdaa8b396d5d3a7204b55c10987", "sha1": "4bf599529acfaae6faa9190b6fcb0bd06af19984", "type": "http-exported-object", "sha256": "5865e801e6324166d6d05b39a14f2a8a798c6eb652831f78c2634f2b7a400eaf", "evidence": [ { "tcp_stream": 50, "frame_number": 1713, "display_filter": "frame.number == 1713", "timestamp_epoch": "1552960186.860440000" } ], "filename": "f4.exe", "filenames": [ "f4.exe" ], "transfers": [ { "url": "http://217.23.14.81/f4.exe", "client_ip": "10.0.90.215", "server_ip": "217.23.14.81", "tcp_stream": 50, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 1553, "response_frame": 1713 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 176128, "artifact_id": "artifact-ac09c3d76fae46bbebbe3b10", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 176128, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": "executable", "features": [], "content_kind": "pe", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 176128, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "a26dcbb948da05ec8af97885dbd149b0", "sha1": "cfa529c048ec394a1203853c0c9a5e28ea23f035", "type": "http-exported-object", "sha256": "3ceb4a8069b2b9e5fdf508ef67d5af5b9d3e6a7b417919953a89fa9773e16440", "evidence": [ { "tcp_stream": 56, "frame_number": 2073, "display_filter": "frame.number == 2073", "timestamp_epoch": "1552961003.830737000" } ], "filename": "CSPCA.crl", "filenames": [ "CSPCA.crl" ], "transfers": [ { "url": "http://crl.microsoft.com/pki/crl/products/CSPCA.crl", "client_ip": "10.0.90.215", "server_ip": "173.205.6.202", "tcp_stream": 56, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 2071, "response_frame": 2073 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 506, "artifact_id": "artifact-7546b343fdf9cbfc1dbf23d7", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 506, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 506, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "cd5a4d3fdd5bffc16bf959ef75cf37bc", "sha1": "33bf88d5b82df3723d5863c7d23445e345828904", "type": "http-exported-object", "sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "evidence": [ { "tcp_stream": 27, "frame_number": 410, "display_filter": "frame.number == 410", "timestamp_epoch": "1552959901.315002000" } ], "filename": "ncsi.txt", "filenames": [ "ncsi.txt" ], "transfers": [ { "url": "http://www.msftncsi.com/ncsi.txt", "client_ip": "10.0.90.215", "server_ip": "209.121.139.185", "tcp_stream": 27, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 408, "response_frame": 410 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/plain", "size_bytes": 14, "artifact_id": "artifact-0c0441d41c29a74d6054f51a", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 14, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false } ], "endpoints": [ { "ip": "10.0.90.215", "bytes_sent": 675197, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-3665f7ac22c709c0b536b459", "packets_sent": 4976, "mac_addresses": [ "64:32:a8:57:2b:42" ], "bytes_received": 6888737, "evidence_frames": [ 1, 2, 3, 4, 5 ], "last_seen_epoch": "1552972317.257558", "first_seen_epoch": "1552959895.636766", "packets_received": 8210 }, { "ip": "10.0.90.255", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-6ddb2d2d771da3cd41b4df28", "packets_sent": 0, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "bytes_received": 5836, "evidence_frames": [ 1, 2, 217, 220, 221 ], "last_seen_epoch": "1552971246.8825", "first_seen_epoch": "1552959895.636766", "packets_received": 53 }, { "ip": "10.0.90.9", "bytes_sent": 177025, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-4511b3c7e46ae3ceca6f2897", "packets_sent": 885, "mac_addresses": [ "a4:1f:72:c2:09:6a" ], "bytes_received": 269901, "evidence_frames": [ 3, 4, 5, 6, 7 ], "last_seen_epoch": "1552972221.85329", "first_seen_epoch": "1552959895.654616", "packets_received": 1022 }, { "ip": "103.1.184.108", "bytes_sent": 349542, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-01dcbadf9a04cd2b3d8dbd92", "packets_sent": 2602, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 186939, "evidence_frames": [ 1537, 1538, 1539, 1540, 1541 ], "last_seen_epoch": "1552972317.257558", "first_seen_epoch": "1552960184.659413", "packets_received": 1284 }, { "ip": "109.230.231.176", "bytes_sent": 216, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5ecd6298e3580657694f8979", "packets_sent": 4, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 776, "evidence_frames": [ 1982, 1987, 1999, 2004, 2009 ], "last_seen_epoch": "1552970942.428014", "first_seen_epoch": "1552960839.958388", "packets_received": 12 }, { "ip": "115.112.43.81", "bytes_sent": 1449267, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-2c1ab01f2d804322d895df4b", "packets_sent": 1069, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 34191, "evidence_frames": [ 11030, 11031, 11032, 11033, 11034 ], "last_seen_epoch": "1552971315.485718", "first_seen_epoch": "1552971272.393421", "packets_received": 427 }, { "ip": "173.205.6.202", "bytes_sent": 1114, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-de4ff58ec3b562b3c45a50d8", "packets_sent": 3, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 509, "evidence_frames": [ 2068, 2069, 2070, 2071, 2072 ], "last_seen_epoch": "1552961004.546221", "first_seen_epoch": "1552961003.774019", "packets_received": 5 }, { "ip": "189.189.64.242", "bytes_sent": 54, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-583c69b56912bc55b6fbdba3", "packets_sent": 1, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 194, "evidence_frames": [ 11015, 11016, 11020, 12562 ], "last_seen_epoch": "1552971324.749904", "first_seen_epoch": "1552971249.33712", "packets_received": 3 }, { "ip": "203.45.1.75", "bytes_sent": 2571753, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-49a46f664e129421c57d7730", "packets_sent": 1971, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 95360, "evidence_frames": [ 3033, 3034, 3035, 3036, 3037 ], "last_seen_epoch": "1552971247.329812", "first_seen_epoch": "1552961296.002587", "packets_received": 1094 }, { "ip": "209.121.139.185", "bytes_sent": 399, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-4dadf2b09fa7618e26c3252c", "packets_sent": 4, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 379, "evidence_frames": [ 405, 406, 407, 408, 409 ], "last_seen_epoch": "1552959901.31538", "first_seen_epoch": "1552959901.303487", "packets_received": 5 }, { "ip": "209.141.34.8", "bytes_sent": 843796, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-70c68aaa1a57fb0ec8e538fc", "packets_sent": 592, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 10310, "evidence_frames": [ 751, 752, 753, 754, 755 ], "last_seen_epoch": "1552960041.094708", "first_seen_epoch": "1552960024.558889", "packets_received": 185 }, { "ip": "217.23.14.81", "bytes_sent": 183472, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-87f70478a6448b7d0f74f5d6", "packets_sent": 130, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2369, "evidence_frames": [ 1549, 1551, 1552, 1553, 1554 ], "last_seen_epoch": "1552960305.884802", "first_seen_epoch": "1552960185.90093", "packets_received": 38 }, { "ip": "224.0.0.22", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-25d03b0d04014469e680621e", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:16" ], "bytes_received": 324, "evidence_frames": [ 11, 381, 382, 392, 735 ], "last_seen_epoch": "1552960016.675273", "first_seen_epoch": "1552959895.677549", "packets_received": 6 }, { "ip": "224.0.0.252", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-560600c3b441baaa2773edf9", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:fc" ], "bytes_received": 532, "evidence_frames": [ 383, 388, 389, 390, 1981 ], "last_seen_epoch": "1552970846.304934", "first_seen_epoch": "1552959898.677281", "packets_received": 8 }, { "ip": "239.255.255.250", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-454973fd38a2ee6797ca3ca0", "packets_sent": 0, "mac_addresses": [ "01:00:5e:7f:ff:fa" ], "bytes_received": 1050, "evidence_frames": [ 736, 738, 739, 740, 746 ], "last_seen_epoch": "1552960022.728006", "first_seen_epoch": "1552960016.262103", "packets_received": 6 }, { "ip": "255.255.255.255", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-a1475a438504224bba507e38", "packets_sent": 0, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "bytes_received": 2736, "evidence_frames": [ 384, 749, 1547, 1978, 2058 ], "last_seen_epoch": "1552971245.360596", "first_seen_epoch": "1552959898.681594", "packets_received": 8 }, { "ip": "31.22.4.176", "bytes_sent": 1309766, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1a9573c289059b70a99e2473", "packets_sent": 939, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 60972, "evidence_frames": [ 2075, 2076, 2077, 2078, 2079 ], "last_seen_epoch": "1552971022.016159", "first_seen_epoch": "1552961004.038145", "packets_received": 809 }, { "ip": "46.105.131.77", "bytes_sent": 2333, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-14bfc51963d604b57aedfc9a", "packets_sent": 10, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2819, "evidence_frames": [ 12510, 12511, 12512, 12513, 12514 ], "last_seen_epoch": "1552971311.19119", "first_seen_epoch": "1552971310.312942", "packets_received": 11 } ], "identities": [ { "type": "account", "value": "bobby-tiger-pc$", "bindings": [ { "account": "", "owner_ip": "10.0.90.215", "frame_number": 51, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.9", "conversation_src": "10.0.90.215" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 59, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.9", "conversation_src": "10.0.90.215" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 67, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.9", "conversation_src": "10.0.90.215" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 69, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.215", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 79, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.9", "conversation_src": "10.0.90.215" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 85, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.215", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 89, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.215", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 106, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.215", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 122, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.215", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 172, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.215", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 234, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.215", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 279, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.215", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 310, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.215", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 331, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.215", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 345, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.215", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 449, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.9", "conversation_src": "10.0.90.215" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 457, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.9", "conversation_src": "10.0.90.215" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 459, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.215", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 471, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.215", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 7757, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.215", "conversation_src": "10.0.90.9" } ], "evidence": [ { "tcp_stream": 4, "frame_number": 51, "display_filter": "frame.number == 51", "timestamp_epoch": "1552959895.793065000" }, { "tcp_stream": 5, "frame_number": 59, "display_filter": "frame.number == 59", "timestamp_epoch": "1552959895.807560000" }, { "tcp_stream": 6, "frame_number": 67, "display_filter": "frame.number == 67", "timestamp_epoch": "1552959895.817997000" }, { "tcp_stream": 6, "frame_number": 69, "display_filter": "frame.number == 69", "timestamp_epoch": "1552959895.819258000" }, { "tcp_stream": 7, "frame_number": 79, "display_filter": "frame.number == 79", "timestamp_epoch": "1552959895.840289000" }, { "tcp_stream": 7, "frame_number": 85, "display_filter": "frame.number == 85", "timestamp_epoch": "1552959895.841273000" }, { "tcp_stream": 8, "frame_number": 89, "display_filter": "frame.number == 89", "timestamp_epoch": "1552959895.842209000" }, { "tcp_stream": 9, "frame_number": 106, "display_filter": "frame.number == 106", "timestamp_epoch": "1552959895.847321000" }, { "tcp_stream": 10, "frame_number": 122, "display_filter": "frame.number == 122", "timestamp_epoch": "1552959895.850380000" }, { "tcp_stream": 13, "frame_number": 172, "display_filter": "frame.number == 172", "timestamp_epoch": "1552959896.037321000" }, { "tcp_stream": 18, "frame_number": 234, "display_filter": "frame.number == 234", "timestamp_epoch": "1552959896.402702000" }, { "tcp_stream": 20, "frame_number": 279, "display_filter": "frame.number == 279", "timestamp_epoch": "1552959897.000197000" }, { "tcp_stream": 22, "frame_number": 310, "display_filter": "frame.number == 310", "timestamp_epoch": "1552959897.013007000" }, { "tcp_stream": 25, "frame_number": 331, "display_filter": "frame.number == 331", "timestamp_epoch": "1552959897.015310000" }, { "tcp_stream": 26, "frame_number": 345, "display_filter": "frame.number == 345", "timestamp_epoch": "1552959897.016353000" }, { "tcp_stream": 30, "frame_number": 449, "display_filter": "frame.number == 449", "timestamp_epoch": "1552959906.532302000" }, { "tcp_stream": 31, "frame_number": 457, "display_filter": "frame.number == 457", "timestamp_epoch": "1552959906.548130000" }, { "tcp_stream": 31, "frame_number": 459, "display_filter": "frame.number == 459", "timestamp_epoch": "1552959906.548583000" }, { "tcp_stream": 32, "frame_number": 471, "display_filter": "frame.number == 471", "timestamp_epoch": "1552959906.550771000" }, { "tcp_stream": 100, "frame_number": 7757, "display_filter": "frame.number == 7757", "timestamp_epoch": "1552965837.958626000" } ], "raw_values": [ "BOBBY-TIGER-PC$", "bobby-tiger-pc$" ], "identity_id": "identity-7f15c55aaa7b4dae55509316", "ip_addresses": [ "10.0.90.215" ], "mac_addresses": [ "64:32:a8:57:2b:42" ] }, { "type": "account", "value": "bobby.tiger", "bindings": [ { "account": "", "owner_ip": "10.0.90.215", "frame_number": 524, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.9", "conversation_src": "10.0.90.215" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 532, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.9", "conversation_src": "10.0.90.215" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 534, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.215", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 546, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.215", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 568, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.215", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 601, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.215", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 613, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.215", "conversation_src": "10.0.90.9" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 646, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.90.215", "conversation_src": "10.0.90.9" } ], "evidence": [ { "tcp_stream": 34, "frame_number": 524, "display_filter": "frame.number == 524", "timestamp_epoch": "1552959980.212307000" }, { "tcp_stream": 35, "frame_number": 532, "display_filter": "frame.number == 532", "timestamp_epoch": "1552959980.223025000" }, { "tcp_stream": 35, "frame_number": 534, "display_filter": "frame.number == 534", "timestamp_epoch": "1552959980.223613000" }, { "tcp_stream": 36, "frame_number": 546, "display_filter": "frame.number == 546", "timestamp_epoch": "1552959980.225143000" }, { "tcp_stream": 39, "frame_number": 568, "display_filter": "frame.number == 568", "timestamp_epoch": "1552959980.760200000" }, { "tcp_stream": 41, "frame_number": 601, "display_filter": "frame.number == 601", "timestamp_epoch": "1552959980.794709000" }, { "tcp_stream": 42, "frame_number": 613, "display_filter": "frame.number == 613", "timestamp_epoch": "1552959980.795550000" }, { "tcp_stream": 44, "frame_number": 646, "display_filter": "frame.number == 646", "timestamp_epoch": "1552959981.299598000" } ], "raw_values": [ "bobby.tiger" ], "identity_id": "identity-53c02616b1b7ab4c7ed2ee14", "ip_addresses": [ "10.0.90.215" ], "mac_addresses": [ "64:32:a8:57:2b:42" ] }, { "type": "hostname", "value": "Bobby-Tiger-PC", "bindings": [ { "account": "", "owner_ip": "0.0.0.0", "frame_number": 384, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.0.90.215" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 749, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.0.90.215" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 1547, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.0.90.215" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 1978, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.0.90.215" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 2058, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.0.90.215" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 3043, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.0.90.215" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 9937, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.0.90.215" }, { "account": "", "owner_ip": "0.0.0.0", "frame_number": 10975, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.0.90.215" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 1, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.215" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 217, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.215" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 221, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.215" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 256, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.215" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 369, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.215" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 377, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.215" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 379, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.215" }, { "account": "", "owner_ip": "10.0.90.215", "frame_number": 380, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.215" } ], "evidence": [ { "udp_stream": 14, "frame_number": 384, "display_filter": "frame.number == 384", "timestamp_epoch": "1552959898.681594000" }, { "udp_stream": 14, "frame_number": 749, "display_filter": "frame.number == 749", "timestamp_epoch": "1552960024.528666000" }, { "udp_stream": 14, "frame_number": 1547, "display_filter": "frame.number == 1547", "timestamp_epoch": "1552960185.893185000" }, { "udp_stream": 14, "frame_number": 1978, "display_filter": "frame.number == 1978", "timestamp_epoch": "1552960839.947329000" }, { "udp_stream": 14, "frame_number": 2058, "display_filter": "frame.number == 2058", "timestamp_epoch": "1552960999.162850000" }, { "udp_stream": 14, "frame_number": 3043, "display_filter": "frame.number == 3043", "timestamp_epoch": "1552961296.484040000" }, { "udp_stream": 14, "frame_number": 9937, "display_filter": "frame.number == 9937", "timestamp_epoch": "1552970846.191937000" }, { "udp_stream": 14, "frame_number": 10975, "display_filter": "frame.number == 10975", "timestamp_epoch": "1552971245.360596000" }, { "udp_stream": 0, "frame_number": 1, "display_filter": "frame.number == 1", "timestamp_epoch": "1552959895.636766000" }, { "udp_stream": 0, "frame_number": 217, "display_filter": "frame.number == 217", "timestamp_epoch": "1552959896.166022000" }, { "udp_stream": 0, "frame_number": 221, "display_filter": "frame.number == 221", "timestamp_epoch": "1552959896.382174000" }, { "udp_stream": 0, "frame_number": 256, "display_filter": "frame.number == 256", "timestamp_epoch": "1552959896.922304000" }, { "udp_stream": 0, "frame_number": 369, "display_filter": "frame.number == 369", "timestamp_epoch": "1552959897.131799000" }, { "udp_stream": 0, "frame_number": 377, "display_filter": "frame.number == 377", "timestamp_epoch": "1552959897.672284000" }, { "udp_stream": 0, "frame_number": 379, "display_filter": "frame.number == 379", "timestamp_epoch": "1552959897.881656000" }, { "udp_stream": 0, "frame_number": 380, "display_filter": "frame.number == 380", "timestamp_epoch": "1552959898.421689000" } ], "raw_values": [ "BOBBY-TIGER-PC<00>,BOBBY-TIGER-PC<00> (Workstation/Redirector)", "BOBBY-TIGER-PC<20>,BOBBY-TIGER-PC<20> (Server service)", "Bobby-Tiger-PC" ], "identity_id": "identity-44bb048d33715df6c60da072", "ip_addresses": [ "10.0.90.215" ], "mac_addresses": [ "64:32:a8:57:2b:42", "64:32:a8:57:2b:42,64:32:a8:57:2b:42" ] }, { "type": "netbios-group", "value": "LITTLETIGERS", "bindings": [ { "account": "", "owner_ip": null, "frame_number": 2, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.215" }, { "account": "", "owner_ip": null, "frame_number": 220, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.215" }, { "account": "", "owner_ip": null, "frame_number": 370, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.215" }, { "account": "", "owner_ip": null, "frame_number": 378, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.0.90.255", "conversation_src": "10.0.90.215" } ], "evidence": [ { "udp_stream": 0, "frame_number": 2, "display_filter": "frame.number == 2", "timestamp_epoch": "1552959895.636976000" }, { "udp_stream": 0, "frame_number": 220, "display_filter": "frame.number == 220", "timestamp_epoch": "1552959896.382036000" }, { "udp_stream": 0, "frame_number": 370, "display_filter": "frame.number == 370", "timestamp_epoch": "1552959897.131908000" }, { "udp_stream": 0, "frame_number": 378, "display_filter": "frame.number == 378", "timestamp_epoch": "1552959897.881536000" } ], "raw_values": [ "LITTLETIGERS<00>,LITTLETIGERS<00> (Workstation/Redirector)" ], "identity_id": "identity-4930b91bdbd2071e3271e0f3", "ip_addresses": [], "mac_addresses": [] } ], "actor_leads": [], "observables": [ { "type": "domain", "roles": [ "dns-query" ], "value": "9.90.0.10.in-addr.arpa", "evidence": [ { "udp_stream": 31, "frame_number": 1955, "display_filter": "frame.number == 1955", "timestamp_epoch": "1552960833.509194000" }, { "udp_stream": 31, "frame_number": 1956, "display_filter": "frame.number == 1956", "timestamp_epoch": "1552960833.517887000" }, { "udp_stream": 51, "frame_number": 9915, "display_filter": "frame.number == 9915", "timestamp_epoch": "1552970839.756274000" }, { "udp_stream": 51, "frame_number": 9916, "display_filter": "frame.number == 9916", "timestamp_epoch": "1552970839.763635000" } ], "is_private": null, "observable_id": "observable-7274b6f256ec730b1eb4b572", "last_seen_epoch": "1552970839.763635000", "enrichment_state": "not_requested", "first_seen_epoch": "1552960833.509194000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "bobby-tiger-pc.littletigers.info", "evidence": [ { "udp_stream": 23, "frame_number": 414, "display_filter": "frame.number == 414", "timestamp_epoch": "1552959903.684782000" }, { "udp_stream": 23, "frame_number": 415, "display_filter": "frame.number == 415", "timestamp_epoch": "1552959903.685091000" } ], "is_private": null, "observable_id": "observable-b835801caf6d7ccbcac9959c", "last_seen_epoch": "1552959903.685091000", "enrichment_state": "not_requested", "first_seen_epoch": "1552959903.684782000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "crl.microsoft.com", "evidence": [ { "udp_stream": 42, "frame_number": 2066, "display_filter": "frame.number == 2066", "timestamp_epoch": "1552961003.744888000" }, { "udp_stream": 42, "frame_number": 2067, "display_filter": "frame.number == 2067", "timestamp_epoch": "1552961003.770222000" }, { "tcp_stream": 56, "frame_number": 2071, "display_filter": "frame.number == 2071", "timestamp_epoch": "1552961003.800356000" } ], "is_private": null, "observable_id": "observable-fbae365cd7b437c79d8f5ae7", "last_seen_epoch": "1552961003.800356000", "enrichment_state": "not_requested", "first_seen_epoch": "1552961003.744888000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "dns.msftncsi.com", "evidence": [ { "udp_stream": 27, "frame_number": 694, "display_filter": "frame.number == 694", "timestamp_epoch": "1552959981.893723000" }, { "udp_stream": 27, "frame_number": 697, "display_filter": "frame.number == 697", "timestamp_epoch": "1552959981.918924000" }, { "udp_stream": 28, "frame_number": 698, "display_filter": "frame.number == 698", "timestamp_epoch": "1552959981.919944000" }, { "udp_stream": 28, "frame_number": 699, "display_filter": "frame.number == 699", "timestamp_epoch": "1552959981.923353000" }, { "udp_stream": 40, "frame_number": 2005, "display_filter": "frame.number == 2005", "timestamp_epoch": "1552960861.985463000" }, { "udp_stream": 40, "frame_number": 2006, "display_filter": "frame.number == 2006", "timestamp_epoch": "1552960862.010975000" }, { "udp_stream": 41, "frame_number": 2007, "display_filter": "frame.number == 2007", "timestamp_epoch": "1552960862.011541000" }, { "udp_stream": 41, "frame_number": 2008, "display_filter": "frame.number == 2008", "timestamp_epoch": "1552960862.014785000" }, { "udp_stream": 57, "frame_number": 11024, "display_filter": "frame.number == 11024", "timestamp_epoch": "1552971272.000839000" }, { "udp_stream": 57, "frame_number": 11025, "display_filter": "frame.number == 11025", "timestamp_epoch": "1552971272.025011000" }, { "udp_stream": 58, "frame_number": 11026, "display_filter": "frame.number == 11026", "timestamp_epoch": "1552971272.025596000" }, { "udp_stream": 58, "frame_number": 11027, "display_filter": "frame.number == 11027", "timestamp_epoch": "1552971272.029527000" } ], "is_private": null, "observable_id": "observable-69ba7e97cfeb70e5c285de2c", "last_seen_epoch": "1552971272.029527000", "enrichment_state": "not_requested", "first_seen_epoch": "1552959981.893723000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "isatap.littletigers.info", "evidence": [ { "udp_stream": 19, "frame_number": 395, "display_filter": "frame.number == 395", "timestamp_epoch": "1552959899.185167000" }, { "udp_stream": 19, "frame_number": 396, "display_filter": "frame.number == 396", "timestamp_epoch": "1552959899.185384000" } ], "is_private": null, "observable_id": "observable-d73885e4dbe7444c1e0c82fc", "last_seen_epoch": "1552959899.185384000", "enrichment_state": "not_requested", "first_seen_epoch": "1552959899.185167000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "isatap.localdomain", "evidence": [ { "udp_stream": 20, "frame_number": 397, "display_filter": "frame.number == 397", "timestamp_epoch": "1552959899.318803000" }, { "udp_stream": 20, "frame_number": 398, "display_filter": "frame.number == 398", "timestamp_epoch": "1552959899.319065000" } ], "is_private": null, "observable_id": "observable-cfc78f46c2df90579cccf2ae", "last_seen_epoch": "1552959899.319065000", "enrichment_state": "not_requested", "first_seen_epoch": "1552959899.318803000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "littletigers-dc.littletigers.info", "evidence": [ { "udp_stream": 2, "frame_number": 5, "display_filter": "frame.number == 5", "timestamp_epoch": "1552959895.657290000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1552959895.657459000" }, { "udp_stream": 18, "frame_number": 393, "display_filter": "frame.number == 393", "timestamp_epoch": "1552959899.178940000" }, { "udp_stream": 18, "frame_number": 394, "display_filter": "frame.number == 394", "timestamp_epoch": "1552959899.179202000" }, { "udp_stream": 43, "frame_number": 7036, "display_filter": "frame.number == 7036", "timestamp_epoch": "1552964396.361279000" }, { "udp_stream": 43, "frame_number": 7037, "display_filter": "frame.number == 7037", "timestamp_epoch": "1552964396.361774000" }, { "udp_stream": 49, "frame_number": 8606, "display_filter": "frame.number == 8606", "timestamp_epoch": "1552967996.473551000" }, { "udp_stream": 49, "frame_number": 8607, "display_filter": "frame.number == 8607", "timestamp_epoch": "1552967996.474098000" }, { "udp_stream": 63, "frame_number": 12798, "display_filter": "frame.number == 12798", "timestamp_epoch": "1552971596.579796000" }, { "udp_stream": 63, "frame_number": 12799, "display_filter": "frame.number == 12799", "timestamp_epoch": "1552971596.580063000" } ], "is_private": null, "observable_id": "observable-9dd8a1797fa08ae0aa756092", "last_seen_epoch": "1552971596.580063000", "enrichment_state": "not_requested", "first_seen_epoch": "1552959895.657290000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "littletigers.info", "evidence": [ { "udp_stream": 24, "frame_number": 416, "display_filter": "frame.number == 416", "timestamp_epoch": "1552959903.687090000" }, { "udp_stream": 24, "frame_number": 417, "display_filter": "frame.number == 417", "timestamp_epoch": "1552959903.687704000" }, { "udp_stream": 33, "frame_number": 1959, "display_filter": "frame.number == 1959", "timestamp_epoch": "1552960833.519839000" }, { "udp_stream": 33, "frame_number": 1960, "display_filter": "frame.number == 1960", "timestamp_epoch": "1552960833.520015000" }, { "udp_stream": 53, "frame_number": 9919, "display_filter": "frame.number == 9919", "timestamp_epoch": "1552970839.764925000" }, { "udp_stream": 53, "frame_number": 9920, "display_filter": "frame.number == 9920", "timestamp_epoch": "1552970839.765126000" } ], "is_private": null, "observable_id": "observable-878e94a680efe75149e48539", "last_seen_epoch": "1552970839.765126000", "enrichment_state": "not_requested", "first_seen_epoch": "1552959903.687090000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "littletigers.info.littletigers.info", "evidence": [ { "udp_stream": 32, "frame_number": 1957, "display_filter": "frame.number == 1957", "timestamp_epoch": "1552960833.518948000" }, { "udp_stream": 32, "frame_number": 1958, "display_filter": "frame.number == 1958", "timestamp_epoch": "1552960833.519146000" }, { "udp_stream": 52, "frame_number": 9917, "display_filter": "frame.number == 9917", "timestamp_epoch": "1552970839.764241000" }, { "udp_stream": 52, "frame_number": 9918, "display_filter": "frame.number == 9918", "timestamp_epoch": "1552970839.764461000" } ], "is_private": null, "observable_id": "observable-4070438450d354fb10157917", "last_seen_epoch": "1552970839.764461000", "enrichment_state": "not_requested", "first_seen_epoch": "1552960833.518948000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "toptoptop1.online", "evidence": [ { "udp_stream": 30, "frame_number": 1535, "display_filter": "frame.number == 1535", "timestamp_epoch": "1552960184.555643000" }, { "udp_stream": 30, "frame_number": 1536, "display_filter": "frame.number == 1536", "timestamp_epoch": "1552960184.652960000" } ], "is_private": null, "observable_id": "observable-c59bd3e59637606ad2d76dcf", "last_seen_epoch": "1552960184.652960000", "enrichment_state": "not_requested", "first_seen_epoch": "1552960184.555643000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "wpad.littletigers.info", "evidence": [ { "udp_stream": 16, "frame_number": 386, "display_filter": "frame.number == 386", "timestamp_epoch": "1552959898.685117000" }, { "udp_stream": 16, "frame_number": 387, "display_filter": "frame.number == 387", "timestamp_epoch": "1552959898.685365000" }, { "udp_stream": 37, "frame_number": 1975, "display_filter": "frame.number == 1975", "timestamp_epoch": "1552960839.945738000" }, { "udp_stream": 37, "frame_number": 1976, "display_filter": "frame.number == 1976", "timestamp_epoch": "1552960839.946004000" }, { "udp_stream": 54, "frame_number": 9934, "display_filter": "frame.number == 9934", "timestamp_epoch": "1552970846.190608000" }, { "udp_stream": 54, "frame_number": 9935, "display_filter": "frame.number == 9935", "timestamp_epoch": "1552970846.190869000" } ], "is_private": null, "observable_id": "observable-cb73785ca4a1ec5d233c0f7c", "last_seen_epoch": "1552970846.190869000", "enrichment_state": "not_requested", "first_seen_epoch": "1552959898.685117000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "wpad.localdomain", "evidence": [ { "udp_stream": 38, "frame_number": 1977, "display_filter": "frame.number == 1977", "timestamp_epoch": "1552960839.946326000" }, { "udp_stream": 38, "frame_number": 1980, "display_filter": "frame.number == 1980", "timestamp_epoch": "1552960839.954638000" }, { "udp_stream": 55, "frame_number": 9936, "display_filter": "frame.number == 9936", "timestamp_epoch": "1552970846.191269000" }, { "udp_stream": 55, "frame_number": 9939, "display_filter": "frame.number == 9939", "timestamp_epoch": "1552970846.197493000" } ], "is_private": null, "observable_id": "observable-52a2e8b8ab2b7e256580677f", "last_seen_epoch": "1552970846.197493000", "enrichment_state": "not_requested", "first_seen_epoch": "1552960839.946326000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "www.msftncsi.com", "evidence": [ { "udp_stream": 22, "frame_number": 403, "display_filter": "frame.number == 403", "timestamp_epoch": "1552959901.255609000" }, { "udp_stream": 22, "frame_number": 404, "display_filter": "frame.number == 404", "timestamp_epoch": "1552959901.298914000" }, { "tcp_stream": 27, "frame_number": 408, "display_filter": "frame.number == 408", "timestamp_epoch": "1552959901.306324000" } ], "is_private": null, "observable_id": "observable-b77b79c53dce9106b4814716", "last_seen_epoch": "1552959901.306324000", "enrichment_state": "not_requested", "first_seen_epoch": "1552959901.255609000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "10.0.90.215", "evidence": [ { "udp_stream": 24, "frame_number": 416, "display_filter": "frame.number == 416", "timestamp_epoch": "1552959903.687090000" }, { "udp_stream": 24, "frame_number": 417, "display_filter": "frame.number == 417", "timestamp_epoch": "1552959903.687704000" } ], "is_private": true, "observable_id": "observable-c928dc34dca1868ea10ddabe", "last_seen_epoch": "1552959903.687704000", "enrichment_state": "not_requested", "first_seen_epoch": "1552959903.687090000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "10.0.90.255", "evidence": [], "is_private": true, "observable_id": "observable-71f732d9ede20cd3c195e0fe", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "10.0.90.9", "evidence": [ { "udp_stream": 1, "frame_number": 4, "display_filter": "frame.number == 4", "timestamp_epoch": "1552959895.655060000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1552959895.657459000" }, { "udp_stream": 5, "frame_number": 134, "display_filter": "frame.number == 134", "timestamp_epoch": "1552959895.853768000" }, { "udp_stream": 7, "frame_number": 142, "display_filter": "frame.number == 142", "timestamp_epoch": "1552959895.922616000" }, { "udp_stream": 9, "frame_number": 154, "display_filter": "frame.number == 154", "timestamp_epoch": "1552959895.962000000" }, { "udp_stream": 18, "frame_number": 394, "display_filter": "frame.number == 394", "timestamp_epoch": "1552959899.179202000" }, { "udp_stream": 23, "frame_number": 415, "display_filter": "frame.number == 415", "timestamp_epoch": "1552959903.685091000" }, { "udp_stream": 33, "frame_number": 1960, "display_filter": "frame.number == 1960", "timestamp_epoch": "1552960833.520015000" }, { "udp_stream": 33, "frame_number": 1960, "display_filter": "frame.number == 1960", "timestamp_epoch": "1552960833.520015000" }, { "udp_stream": 43, "frame_number": 7037, "display_filter": "frame.number == 7037", "timestamp_epoch": "1552964396.361774000" }, { "udp_stream": 49, "frame_number": 8607, "display_filter": "frame.number == 8607", "timestamp_epoch": "1552967996.474098000" }, { "udp_stream": 53, "frame_number": 9920, "display_filter": "frame.number == 9920", "timestamp_epoch": "1552970839.765126000" }, { "udp_stream": 53, "frame_number": 9920, "display_filter": "frame.number == 9920", "timestamp_epoch": "1552970839.765126000" }, { "udp_stream": 63, "frame_number": 12799, "display_filter": "frame.number == 12799", "timestamp_epoch": "1552971596.580063000" } ], "is_private": true, "observable_id": "observable-2d0a9ac9c23fc3cf43e6405e", "last_seen_epoch": "1552971596.580063000", "enrichment_state": "not_requested", "first_seen_epoch": "1552959895.655060000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "103.1.184.108", "evidence": [ { "udp_stream": 30, "frame_number": 1536, "display_filter": "frame.number == 1536", "timestamp_epoch": "1552960184.652960000" } ], "is_private": false, "observable_id": "observable-33657c5fddf15abc0bcb66c3", "last_seen_epoch": "1552960184.652960000", "enrichment_state": "not_requested", "first_seen_epoch": "1552960184.652960000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "109.230.231.176", "evidence": [], "is_private": false, "observable_id": "observable-95af83621a066e1c73ef43ff", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "115.112.43.81", "evidence": [], "is_private": false, "observable_id": "observable-eec6fbb0bbc5733a7db9a45b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "131.107.255.255", "evidence": [ { "udp_stream": 27, "frame_number": 697, "display_filter": "frame.number == 697", "timestamp_epoch": "1552959981.918924000" }, { "udp_stream": 40, "frame_number": 2006, "display_filter": "frame.number == 2006", "timestamp_epoch": "1552960862.010975000" }, { "udp_stream": 57, "frame_number": 11025, "display_filter": "frame.number == 11025", "timestamp_epoch": "1552971272.025011000" } ], "is_private": false, "observable_id": "observable-3ca3b0866e0461bd3bbe7485", "last_seen_epoch": "1552971272.025011000", "enrichment_state": "not_requested", "first_seen_epoch": "1552959981.918924000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "173.205.6.155", "evidence": [ { "udp_stream": 42, "frame_number": 2067, "display_filter": "frame.number == 2067", "timestamp_epoch": "1552961003.770222000" } ], "is_private": false, "observable_id": "observable-ab3fa40602302f283aef45d6", "last_seen_epoch": "1552961003.770222000", "enrichment_state": "not_requested", "first_seen_epoch": "1552961003.770222000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "173.205.6.202", "evidence": [ { "udp_stream": 42, "frame_number": 2067, "display_filter": "frame.number == 2067", "timestamp_epoch": "1552961003.770222000" } ], "is_private": false, "observable_id": "observable-fe82edc34b84bd982858c640", "last_seen_epoch": "1552961003.770222000", "enrichment_state": "not_requested", "first_seen_epoch": "1552961003.770222000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "189.189.64.242", "evidence": [], "is_private": false, "observable_id": "observable-1bbd05974ed993a3ed99991b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "203.45.1.75", "evidence": [], "is_private": false, "observable_id": "observable-39971126fd70b299f4dced7f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "209.121.139.185", "evidence": [ { "udp_stream": 22, "frame_number": 404, "display_filter": "frame.number == 404", "timestamp_epoch": "1552959901.298914000" } ], "is_private": false, "observable_id": "observable-fb60852ad4e6dfd1c4cfa78d", "last_seen_epoch": "1552959901.298914000", "enrichment_state": "not_requested", "first_seen_epoch": "1552959901.298914000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "209.121.139.187", "evidence": [ { "udp_stream": 22, "frame_number": 404, "display_filter": "frame.number == 404", "timestamp_epoch": "1552959901.298914000" } ], "is_private": false, "observable_id": "observable-74cf3a55070694f99ca62411", "last_seen_epoch": "1552959901.298914000", "enrichment_state": "not_requested", "first_seen_epoch": "1552959901.298914000" }, { "type": "ipv4", "roles": [ "http-host", "network-endpoint" ], "value": "209.141.34.8", "evidence": [ { "tcp_stream": 48, "frame_number": 754, "display_filter": "frame.number == 754", "timestamp_epoch": "1552960024.599220000" } ], "is_private": false, "observable_id": "observable-cf3737eda412480d6a0b727f", "last_seen_epoch": "1552960024.599220000", "enrichment_state": "not_requested", "first_seen_epoch": "1552960024.599220000" }, { "type": "ipv4", "roles": [ "http-host", "network-endpoint" ], "value": "217.23.14.81", "evidence": [ { "tcp_stream": 50, "frame_number": 1553, "display_filter": "frame.number == 1553", "timestamp_epoch": "1552960186.057432000" } ], "is_private": false, "observable_id": "observable-e0cbf9917bae95b482c3cf01", "last_seen_epoch": "1552960186.057432000", "enrichment_state": "not_requested", "first_seen_epoch": "1552960186.057432000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.22", "evidence": [], "is_private": false, "observable_id": "observable-3de1252358ba89925cb915d9", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.252", "evidence": [], "is_private": false, "observable_id": "observable-aa07a2000b2be0e2d1220d10", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "http-host", "network-endpoint" ], "value": "239.255.255.250", "evidence": [ { "frame_number": 736, "display_filter": "frame.number == 736", "timestamp_epoch": "1552960016.262103000" }, { "frame_number": 738, "display_filter": "frame.number == 738", "timestamp_epoch": "1552960016.716756000" }, { "frame_number": 739, "display_filter": "frame.number == 739", "timestamp_epoch": "1552960019.264886000" }, { "frame_number": 740, "display_filter": "frame.number == 740", "timestamp_epoch": "1552960019.717449000" }, { "frame_number": 746, "display_filter": "frame.number == 746", "timestamp_epoch": "1552960022.275623000" }, { "frame_number": 747, "display_filter": "frame.number == 747", "timestamp_epoch": "1552960022.728006000" } ], "is_private": false, "observable_id": "observable-bbcbb053b49485539d8c05fc", "last_seen_epoch": "1552960022.728006000", "enrichment_state": "not_requested", "first_seen_epoch": "1552960016.262103000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "255.255.255.255", "evidence": [], "is_private": true, "observable_id": "observable-f32d8a00daea4eeb912aba61", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "31.22.4.176", "evidence": [], "is_private": false, "observable_id": "observable-f4a9d32c269a61cb37646c88", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "46.105.131.77", "evidence": [], "is_private": false, "observable_id": "observable-9d6732980574d0c856238189", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "6734f37431670b3ab4292b8f60f29984", "evidence": [ { "tcp_stream": 58, "frame_number": 2106, "display_filter": "frame.number == 2106", "timestamp_epoch": "1552961006.219930000" }, { "tcp_stream": 59, "frame_number": 2918, "display_filter": "frame.number == 2918", "timestamp_epoch": "1552961009.324785000" }, { "tcp_stream": 60, "frame_number": 2935, "display_filter": "frame.number == 2935", "timestamp_epoch": "1552961014.877072000" }, { "tcp_stream": 68, "frame_number": 4148, "display_filter": "frame.number == 4148", "timestamp_epoch": "1552961322.758145000" }, { "tcp_stream": 70, "frame_number": 5202, "display_filter": "frame.number == 5202", "timestamp_epoch": "1552961360.165766000" }, { "tcp_stream": 73, "frame_number": 5281, "display_filter": "frame.number == 5281", "timestamp_epoch": "1552961463.973937000" }, { "tcp_stream": 79, "frame_number": 5780, "display_filter": "frame.number == 5780", "timestamp_epoch": "1552962675.268663000" }, { "tcp_stream": 81, "frame_number": 6401, "display_filter": "frame.number == 6401", "timestamp_epoch": "1552962699.520895000" }, { "tcp_stream": 83, "frame_number": 6455, "display_filter": "frame.number == 6455", "timestamp_epoch": "1552962782.353047000" }, { "tcp_stream": 86, "frame_number": 6909, "display_filter": "frame.number == 6909", "timestamp_epoch": "1552964046.570150000" }, { "tcp_stream": 89, "frame_number": 7337, "display_filter": "frame.number == 7337", "timestamp_epoch": "1552965224.997984000" }, { "tcp_stream": 106, "frame_number": 8057, "display_filter": "frame.number == 8057", "timestamp_epoch": "1552966544.321444000" }, { "tcp_stream": 111, "frame_number": 8461, "display_filter": "frame.number == 8461", "timestamp_epoch": "1552967584.210126000" }, { "tcp_stream": 114, "frame_number": 8910, "display_filter": "frame.number == 8910", "timestamp_epoch": "1552968837.840283000" }, { "tcp_stream": 118, "frame_number": 9318, "display_filter": "frame.number == 9318", "timestamp_epoch": "1552969891.696646000" }, { "tcp_stream": 125, "frame_number": 10044, "display_filter": "frame.number == 10044", "timestamp_epoch": "1552971012.444040000" }, { "tcp_stream": 126, "frame_number": 10861, "display_filter": "frame.number == 10861", "timestamp_epoch": "1552971015.800625000" }, { "tcp_stream": 127, "frame_number": 10881, "display_filter": "frame.number == 10881", "timestamp_epoch": "1552971021.360251000" }, { "tcp_stream": 141, "frame_number": 12187, "display_filter": "frame.number == 12187", "timestamp_epoch": "1552971296.995377000" }, { "tcp_stream": 144, "frame_number": 12543, "display_filter": "frame.number == 12543", "timestamp_epoch": "1552971313.278154000" } ], "is_private": null, "observable_id": "observable-c814f9fbf6339f8420dd8bf1", "last_seen_epoch": "1552971313.278154000", "enrichment_state": "not_requested", "first_seen_epoch": "1552961006.219930000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "74927e242d6c3febf8cb9cab10a7f889", "evidence": [ { "tcp_stream": 57, "frame_number": 2078, "display_filter": "frame.number == 2078", "timestamp_epoch": "1552961004.196634000" }, { "tcp_stream": 62, "frame_number": 3048, "display_filter": "frame.number == 3048", "timestamp_epoch": "1552961296.692913000" }, { "tcp_stream": 124, "frame_number": 10017, "display_filter": "frame.number == 10017", "timestamp_epoch": "1552971010.444374000" }, { "tcp_stream": 129, "frame_number": 10980, "display_filter": "frame.number == 10980", "timestamp_epoch": "1552971245.605865000" }, { "tcp_stream": 135, "frame_number": 11042, "display_filter": "frame.number == 11042", "timestamp_epoch": "1552971273.544551000" }, { "tcp_stream": 142, "frame_number": 12513, "display_filter": "frame.number == 12513", "timestamp_epoch": "1552971310.452040000" } ], "is_private": null, "observable_id": "observable-4c7d252df7ea8e0c2fa87b63", "last_seen_epoch": "1552971310.452040000", "enrichment_state": "not_requested", "first_seen_epoch": "1552961004.196634000" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "2a9b0ed40f1f0bc0c13ff35d304689e9cadd633781cbcad1c2d2b92ced3f1c85", "evidence": [], "is_private": null, "observable_id": "observable-2dea715d809f50a3c83aeb9f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "3ceb4a8069b2b9e5fdf508ef67d5af5b9d3e6a7b417919953a89fa9773e16440", "evidence": [], "is_private": null, "observable_id": "observable-b905e5c9aab70fdbb0a669e4", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "5865e801e6324166d6d05b39a14f2a8a798c6eb652831f78c2634f2b7a400eaf", "evidence": [], "is_private": null, "observable_id": "observable-77b1ebbed3a963a5e9e5240c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "evidence": [], "is_private": null, "observable_id": "observable-b77b3822ef44d3fe1e34f312", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "url", "roles": [ "http-request" ], "value": "http://209.141.34.8/test1.exe", "evidence": [ { "tcp_stream": 48, "frame_number": 754, "display_filter": "frame.number == 754", "timestamp_epoch": "1552960024.599220000" } ], "is_private": null, "observable_id": "observable-f13fe7b409ddde55b76b27f0", "last_seen_epoch": "1552960024.599220000", "enrichment_state": "not_requested", "first_seen_epoch": "1552960024.599220000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://217.23.14.81/f4.exe", "evidence": [ { "tcp_stream": 50, "frame_number": 1553, "display_filter": "frame.number == 1553", "timestamp_epoch": "1552960186.057432000" } ], "is_private": null, "observable_id": "observable-0381abd094044515377eb8d0", "last_seen_epoch": "1552960186.057432000", "enrichment_state": "not_requested", "first_seen_epoch": "1552960186.057432000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://239.255.255.250:1900*", "evidence": [ { "frame_number": 736, "display_filter": "frame.number == 736", "timestamp_epoch": "1552960016.262103000" }, { "frame_number": 738, "display_filter": "frame.number == 738", "timestamp_epoch": "1552960016.716756000" }, { "frame_number": 739, "display_filter": "frame.number == 739", "timestamp_epoch": "1552960019.264886000" }, { "frame_number": 740, "display_filter": "frame.number == 740", "timestamp_epoch": "1552960019.717449000" }, { "frame_number": 746, "display_filter": "frame.number == 746", "timestamp_epoch": "1552960022.275623000" }, { "frame_number": 747, "display_filter": "frame.number == 747", "timestamp_epoch": "1552960022.728006000" } ], "is_private": null, "observable_id": "observable-e5a0ce0f75f362ab1c043bef", "last_seen_epoch": "1552960022.728006000", "enrichment_state": "not_requested", "first_seen_epoch": "1552960016.262103000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://crl.microsoft.com/pki/crl/products/CSPCA.crl", "evidence": [ { "tcp_stream": 56, "frame_number": 2071, "display_filter": "frame.number == 2071", "timestamp_epoch": "1552961003.800356000" } ], "is_private": null, "observable_id": "observable-d84b738e0a5029b057258378", "last_seen_epoch": "1552961003.800356000", "enrichment_state": "not_requested", "first_seen_epoch": "1552961003.800356000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.msftncsi.com/ncsi.txt", "evidence": [ { "tcp_stream": 27, "frame_number": 408, "display_filter": "frame.number == 408", "timestamp_epoch": "1552959901.306324000" } ], "is_private": null, "observable_id": "observable-623cf4103212b755a148ad5a", "last_seen_epoch": "1552959901.306324000", "enrichment_state": "not_requested", "first_seen_epoch": "1552959901.306324000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Microsoft NCSI", "evidence": [ { "tcp_stream": 27, "frame_number": 408, "display_filter": "frame.number == 408", "timestamp_epoch": "1552959901.306324000" } ], "is_private": null, "observable_id": "observable-09c18c790221efef385e2e59", "last_seen_epoch": "1552959901.306324000", "enrichment_state": "not_requested", "first_seen_epoch": "1552959901.306324000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Microsoft-CryptoAPI/6.1", "evidence": [ { "tcp_stream": 56, "frame_number": 2071, "display_filter": "frame.number == 2071", "timestamp_epoch": "1552961003.800356000" } ], "is_private": null, "observable_id": "observable-bc5daf488fab79ea2824c924", "last_seen_epoch": "1552961003.800356000", "enrichment_state": "not_requested", "first_seen_epoch": "1552961003.800356000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "evidence": [ { "tcp_stream": 48, "frame_number": 754, "display_filter": "frame.number == 754", "timestamp_epoch": "1552960024.599220000" }, { "tcp_stream": 50, "frame_number": 1553, "display_filter": "frame.number == 1553", "timestamp_epoch": "1552960186.057432000" } ], "is_private": null, "observable_id": "observable-37380f82ab0d832225cb2c72", "last_seen_epoch": "1552960186.057432000", "enrichment_state": "not_requested", "first_seen_epoch": "1552960024.599220000" } ], "schema_version": "pcap-analysis-v1", "semantic_sha256": "9a1a4d3498dd5afb35f8698f4b731d20e3366895114aea266e43304aad3d1bba", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "attack_candidates": [ { "name": "Ingress Tool Transfer", "status": "suggested", "tactic": "command-and-control", "evidence": [ { "tcp_stream": 48, "frame_number": 1523, "display_filter": "frame.number == 1523", "timestamp_epoch": "1552960024.930842000" }, { "tcp_stream": 50, "frame_number": 1553, "display_filter": "frame.number == 1553", "timestamp_epoch": "1552960186.057432000" }, { "tcp_stream": 50, "frame_number": 1713, "display_filter": "frame.number == 1713", "timestamp_epoch": "1552960186.860440000" }, { "tcp_stream": 48, "frame_number": 754, "display_filter": "frame.number == 754", "timestamp_epoch": "1552960024.599220000" } ], "attack_id": "T1105", "confidence": 0.8, "finding_ids": [ "finding-bb2975e364354c73399c85c6", "finding-c205c2d47a5f745257bd49d6" ], "mapping_basis": "versioned-deterministic-rule" } ], "analysis_key_material": { "source_sha256": "257ba51a573232f7c2a8b43b55e127e793abe0bf067bd55f40dbee398fde6520", "rulepack_version": "pcap-rules-v5", "analyzer_manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0" } }, "context": { "mode": "local-only", "matches": [], "coverage": { "truncated": false, "no_exact_match": 48, "observable_limit": 5000, "observables_total": 48, "matched_observables": 0, "observables_checked": 48, "prior_cases_checked": 50, "prior_case_limit_reached": true }, "created_at": "2026-09-22T16:08:33.933892+00:00", "session_id": "34e6e987-f88c-42f0-87de-920ae403aace", "techniques": [ { "url": "https://attack.mitre.org/techniques/T1105", "name": "Ingress Tool Transfer", "status": "catalog-context-not-validation-of-behavior", "attack_id": "T1105", "detection": "", "platforms": [ "ESXi", "Linux", "macOS", "Network Devices", "Windows" ], "data_sources": [ "WinEventLog:Sysmon", "auditd:SYSCALL", "iptables:LOG", "macos:endpointsecurity", "macos:unifiedlog", "esxi:hostd", "esxi:vmkernel", "NSM:Flow", "snmp:syslog" ], "catalog_version_id": 851, "detection_strategies": [ { "name": "Detect Ingress Tool Transfers via Behavioral Chain", "stix_id": "x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554", "attack_id": "DET0060" } ], "detection_links_truncated": false } ], "interpretation": "No match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.", "schema_version": "pcap-context-v1", "snapshot_sha256": "7a94345ce0dbb444a54c8d78dbd93700806aaf04a6f21c90fdeab53782487de2", "source_actor_links": [], "external_enrichment": { "reason": "Requires explicit provider consent and privacy review", "status": "not-requested", "requests": 0 }, "source_semantic_sha256": "9a1a4d3498dd5afb35f8698f4b731d20e3366895114aea266e43304aad3d1bba", "cross_case_correlations": [ { "shared_count": 8, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 8, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 9, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 9, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 3, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 3, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." } ] }, "assessment": { "policy_version": "pcap-assessment-v3", "source_semantic_sha256": "9a1a4d3498dd5afb35f8698f4b731d20e3366895114aea266e43304aad3d1bba", "items": [ { "observable_id": "observable-7274b6f256ec730b1eb4b572", "type": "domain", "value": "9.90.0.10.in-addr.arpa", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 31, "frame_number": 1955, "display_filter": "frame.number == 1955", "timestamp_epoch": "1552960833.509194000" }, { "udp_stream": 31, "frame_number": 1956, "display_filter": "frame.number == 1956", "timestamp_epoch": "1552960833.517887000" }, { "udp_stream": 51, "frame_number": 9915, "display_filter": "frame.number == 9915", "timestamp_epoch": "1552970839.756274000" }, { "udp_stream": 51, "frame_number": 9916, "display_filter": "frame.number == 9916", "timestamp_epoch": "1552970839.763635000" } ], "roles": [ "dns-query" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b835801caf6d7ccbcac9959c", "type": "domain", "value": "bobby-tiger-pc.littletigers.info", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:12.520389+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:12.355162+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:12.353000+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 23, "frame_number": 414, "display_filter": "frame.number == 414", "timestamp_epoch": "1552959903.684782000" }, { "udp_stream": 23, "frame_number": 415, "display_filter": "frame.number == 415", "timestamp_epoch": "1552959903.685091000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:12.350849+00:00" }, { "observable_id": "observable-fbae365cd7b437c79d8f5ae7", "type": "domain", "value": "crl.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:12.343867+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:12.176626+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:12.174515+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 42, "frame_number": 2066, "display_filter": "frame.number == 2066", "timestamp_epoch": "1552961003.744888000" }, { "udp_stream": 42, "frame_number": 2067, "display_filter": "frame.number == 2067", "timestamp_epoch": "1552961003.770222000" }, { "tcp_stream": 56, "frame_number": 2071, "display_filter": "frame.number == 2071", "timestamp_epoch": "1552961003.800356000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:12.172690+00:00" }, { "observable_id": "observable-69ba7e97cfeb70e5c285de2c", "type": "domain", "value": "dns.msftncsi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 27, "frame_number": 694, "display_filter": "frame.number == 694", "timestamp_epoch": "1552959981.893723000" }, { "udp_stream": 27, "frame_number": 697, "display_filter": "frame.number == 697", "timestamp_epoch": "1552959981.918924000" }, { "udp_stream": 28, "frame_number": 698, "display_filter": "frame.number == 698", "timestamp_epoch": "1552959981.919944000" }, { "udp_stream": 28, "frame_number": 699, "display_filter": "frame.number == 699", "timestamp_epoch": "1552959981.923353000" }, { "udp_stream": 40, "frame_number": 2005, "display_filter": "frame.number == 2005", "timestamp_epoch": "1552960861.985463000" }, { "udp_stream": 40, "frame_number": 2006, "display_filter": "frame.number == 2006", "timestamp_epoch": "1552960862.010975000" }, { "udp_stream": 41, "frame_number": 2007, "display_filter": "frame.number == 2007", "timestamp_epoch": "1552960862.011541000" }, { "udp_stream": 41, "frame_number": 2008, "display_filter": "frame.number == 2008", "timestamp_epoch": "1552960862.014785000" }, { "udp_stream": 57, "frame_number": 11024, "display_filter": "frame.number == 11024", "timestamp_epoch": "1552971272.000839000" }, { "udp_stream": 57, "frame_number": 11025, "display_filter": "frame.number == 11025", "timestamp_epoch": "1552971272.025011000" }, { "udp_stream": 58, "frame_number": 11026, "display_filter": "frame.number == 11026", "timestamp_epoch": "1552971272.025596000" }, { "udp_stream": 58, "frame_number": 11027, "display_filter": "frame.number == 11027", "timestamp_epoch": "1552971272.029527000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d73885e4dbe7444c1e0c82fc", "type": "domain", "value": "isatap.littletigers.info", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 19, "frame_number": 395, "display_filter": "frame.number == 395", "timestamp_epoch": "1552959899.185167000" }, { "udp_stream": 19, "frame_number": 396, "display_filter": "frame.number == 396", "timestamp_epoch": "1552959899.185384000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cfc78f46c2df90579cccf2ae", "type": "domain", "value": "isatap.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 20, "frame_number": 397, "display_filter": "frame.number == 397", "timestamp_epoch": "1552959899.318803000" }, { "udp_stream": 20, "frame_number": 398, "display_filter": "frame.number == 398", "timestamp_epoch": "1552959899.319065000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9dd8a1797fa08ae0aa756092", "type": "domain", "value": "littletigers-dc.littletigers.info", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:12.696423+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:12.529953+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:12.525770+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 2, "frame_number": 5, "display_filter": "frame.number == 5", "timestamp_epoch": "1552959895.657290000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1552959895.657459000" }, { "udp_stream": 18, "frame_number": 393, "display_filter": "frame.number == 393", "timestamp_epoch": "1552959899.178940000" }, { "udp_stream": 18, "frame_number": 394, "display_filter": "frame.number == 394", "timestamp_epoch": "1552959899.179202000" }, { "udp_stream": 43, "frame_number": 7036, "display_filter": "frame.number == 7036", "timestamp_epoch": "1552964396.361279000" }, { "udp_stream": 43, "frame_number": 7037, "display_filter": "frame.number == 7037", "timestamp_epoch": "1552964396.361774000" }, { "udp_stream": 49, "frame_number": 8606, "display_filter": "frame.number == 8606", "timestamp_epoch": "1552967996.473551000" }, { "udp_stream": 49, "frame_number": 8607, "display_filter": "frame.number == 8607", "timestamp_epoch": "1552967996.474098000" }, { "udp_stream": 63, "frame_number": 12798, "display_filter": "frame.number == 12798", "timestamp_epoch": "1552971596.579796000" }, { "udp_stream": 63, "frame_number": 12799, "display_filter": "frame.number == 12799", "timestamp_epoch": "1552971596.580063000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:12.520467+00:00" }, { "observable_id": "observable-878e94a680efe75149e48539", "type": "domain", "value": "littletigers.info", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:12.884332+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:12.705205+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:12.701070+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 24, "frame_number": 416, "display_filter": "frame.number == 416", "timestamp_epoch": "1552959903.687090000" }, { "udp_stream": 24, "frame_number": 417, "display_filter": "frame.number == 417", "timestamp_epoch": "1552959903.687704000" }, { "udp_stream": 33, "frame_number": 1959, "display_filter": "frame.number == 1959", "timestamp_epoch": "1552960833.519839000" }, { "udp_stream": 33, "frame_number": 1960, "display_filter": "frame.number == 1960", "timestamp_epoch": "1552960833.520015000" }, { "udp_stream": 53, "frame_number": 9919, "display_filter": "frame.number == 9919", "timestamp_epoch": "1552970839.764925000" }, { "udp_stream": 53, "frame_number": 9920, "display_filter": "frame.number == 9920", "timestamp_epoch": "1552970839.765126000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:12.696489+00:00" }, { "observable_id": "observable-4070438450d354fb10157917", "type": "domain", "value": "littletigers.info.littletigers.info", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 1957, "display_filter": "frame.number == 1957", "timestamp_epoch": "1552960833.518948000" }, { "udp_stream": 32, "frame_number": 1958, "display_filter": "frame.number == 1958", "timestamp_epoch": "1552960833.519146000" }, { "udp_stream": 52, "frame_number": 9917, "display_filter": "frame.number == 9917", "timestamp_epoch": "1552970839.764241000" }, { "udp_stream": 52, "frame_number": 9918, "display_filter": "frame.number == 9918", "timestamp_epoch": "1552970839.764461000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c59bd3e59637606ad2d76dcf", "type": "domain", "value": "toptoptop1.online", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 30, "frame_number": 1535, "display_filter": "frame.number == 1535", "timestamp_epoch": "1552960184.555643000" }, { "udp_stream": 30, "frame_number": 1536, "display_filter": "frame.number == 1536", "timestamp_epoch": "1552960184.652960000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cb73785ca4a1ec5d233c0f7c", "type": "domain", "value": "wpad.littletigers.info", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 16, "frame_number": 386, "display_filter": "frame.number == 386", "timestamp_epoch": "1552959898.685117000" }, { "udp_stream": 16, "frame_number": 387, "display_filter": "frame.number == 387", "timestamp_epoch": "1552959898.685365000" }, { "udp_stream": 37, "frame_number": 1975, "display_filter": "frame.number == 1975", "timestamp_epoch": "1552960839.945738000" }, { "udp_stream": 37, "frame_number": 1976, "display_filter": "frame.number == 1976", "timestamp_epoch": "1552960839.946004000" }, { "udp_stream": 54, "frame_number": 9934, "display_filter": "frame.number == 9934", "timestamp_epoch": "1552970846.190608000" }, { "udp_stream": 54, "frame_number": 9935, "display_filter": "frame.number == 9935", "timestamp_epoch": "1552970846.190869000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-52a2e8b8ab2b7e256580677f", "type": "domain", "value": "wpad.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 38, "frame_number": 1977, "display_filter": "frame.number == 1977", "timestamp_epoch": "1552960839.946326000" }, { "udp_stream": 38, "frame_number": 1980, "display_filter": "frame.number == 1980", "timestamp_epoch": "1552960839.954638000" }, { "udp_stream": 55, "frame_number": 9936, "display_filter": "frame.number == 9936", "timestamp_epoch": "1552970846.191269000" }, { "udp_stream": 55, "frame_number": 9939, "display_filter": "frame.number == 9939", "timestamp_epoch": "1552970846.197493000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b77b79c53dce9106b4814716", "type": "domain", "value": "www.msftncsi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:12.350818+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:46:30.477224+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:12.346666+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 22, "frame_number": 403, "display_filter": "frame.number == 403", "timestamp_epoch": "1552959901.255609000" }, { "udp_stream": 22, "frame_number": 404, "display_filter": "frame.number == 404", "timestamp_epoch": "1552959901.298914000" }, { "tcp_stream": 27, "frame_number": 408, "display_filter": "frame.number == 408", "timestamp_epoch": "1552959901.306324000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:12.343926+00:00" }, { "observable_id": "observable-c928dc34dca1868ea10ddabe", "type": "ipv4", "value": "10.0.90.215", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 24, "frame_number": 416, "display_filter": "frame.number == 416", "timestamp_epoch": "1552959903.687090000" }, { "udp_stream": 24, "frame_number": 417, "display_filter": "frame.number == 417", "timestamp_epoch": "1552959903.687704000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-71f732d9ede20cd3c195e0fe", "type": "ipv4", "value": "10.0.90.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2d0a9ac9c23fc3cf43e6405e", "type": "ipv4", "value": "10.0.90.9", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 1, "frame_number": 4, "display_filter": "frame.number == 4", "timestamp_epoch": "1552959895.655060000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1552959895.657459000" }, { "udp_stream": 5, "frame_number": 134, "display_filter": "frame.number == 134", "timestamp_epoch": "1552959895.853768000" }, { "udp_stream": 7, "frame_number": 142, "display_filter": "frame.number == 142", "timestamp_epoch": "1552959895.922616000" }, { "udp_stream": 9, "frame_number": 154, "display_filter": "frame.number == 154", "timestamp_epoch": "1552959895.962000000" }, { "udp_stream": 18, "frame_number": 394, "display_filter": "frame.number == 394", "timestamp_epoch": "1552959899.179202000" }, { "udp_stream": 23, "frame_number": 415, "display_filter": "frame.number == 415", "timestamp_epoch": "1552959903.685091000" }, { "udp_stream": 33, "frame_number": 1960, "display_filter": "frame.number == 1960", "timestamp_epoch": "1552960833.520015000" }, { "udp_stream": 33, "frame_number": 1960, "display_filter": "frame.number == 1960", "timestamp_epoch": "1552960833.520015000" }, { "udp_stream": 43, "frame_number": 7037, "display_filter": "frame.number == 7037", "timestamp_epoch": "1552964396.361774000" }, { "udp_stream": 49, "frame_number": 8607, "display_filter": "frame.number == 8607", "timestamp_epoch": "1552967996.474098000" }, { "udp_stream": 53, "frame_number": 9920, "display_filter": "frame.number == 9920", "timestamp_epoch": "1552970839.765126000" }, { "udp_stream": 53, "frame_number": 9920, "display_filter": "frame.number == 9920", "timestamp_epoch": "1552970839.765126000" }, { "udp_stream": 63, "frame_number": 12799, "display_filter": "frame.number == 12799", "timestamp_epoch": "1552971596.580063000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-33657c5fddf15abc0bcb66c3", "type": "ipv4", "value": "103.1.184.108", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 30, "frame_number": 1536, "display_filter": "frame.number == 1536", "timestamp_epoch": "1552960184.652960000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-95af83621a066e1c73ef43ff", "type": "ipv4", "value": "109.230.231.176", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-eec6fbb0bbc5733a7db9a45b", "type": "ipv4", "value": "115.112.43.81", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:13.088280+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:12.892704+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:12.888340+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:12.884391+00:00" }, { "observable_id": "observable-3ca3b0866e0461bd3bbe7485", "type": "ipv4", "value": "131.107.255.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 27, "frame_number": 697, "display_filter": "frame.number == 697", "timestamp_epoch": "1552959981.918924000" }, { "udp_stream": 40, "frame_number": 2006, "display_filter": "frame.number == 2006", "timestamp_epoch": "1552960862.010975000" }, { "udp_stream": 57, "frame_number": 11025, "display_filter": "frame.number == 11025", "timestamp_epoch": "1552971272.025011000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ab3fa40602302f283aef45d6", "type": "ipv4", "value": "173.205.6.155", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 42, "frame_number": 2067, "display_filter": "frame.number == 2067", "timestamp_epoch": "1552961003.770222000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fe82edc34b84bd982858c640", "type": "ipv4", "value": "173.205.6.202", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:13.163511+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:13.161314+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 42, "frame_number": 2067, "display_filter": "frame.number == 2067", "timestamp_epoch": "1552961003.770222000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:13.157584+00:00" }, { "observable_id": "observable-1bbd05974ed993a3ed99991b", "type": "ipv4", "value": "189.189.64.242", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-39971126fd70b299f4dced7f", "type": "ipv4", "value": "203.45.1.75", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:13.336706+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:13.334146+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:13.331985+00:00" }, { "observable_id": "observable-fb60852ad4e6dfd1c4cfa78d", "type": "ipv4", "value": "209.121.139.185", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:13.621008+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:13.615251+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 22, "frame_number": 404, "display_filter": "frame.number == 404", "timestamp_epoch": "1552959901.298914000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:13.607114+00:00" }, { "observable_id": "observable-74cf3a55070694f99ca62411", "type": "ipv4", "value": "209.121.139.187", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 22, "frame_number": 404, "display_filter": "frame.number == 404", "timestamp_epoch": "1552959901.298914000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cf3737eda412480d6a0b727f", "type": "ipv4", "value": "209.141.34.8", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:11.956612+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:11.752317+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:11.749509+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 48, "frame_number": 754, "display_filter": "frame.number == 754", "timestamp_epoch": "1552960024.599220000" } ], "roles": [ "http-host", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:11.744526+00:00" }, { "observable_id": "observable-e0cbf9917bae95b482c3cf01", "type": "ipv4", "value": "217.23.14.81", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:12.172650+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:11.971123+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:11.964041+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 50, "frame_number": 1553, "display_filter": "frame.number == 1553", "timestamp_epoch": "1552960186.057432000" } ], "roles": [ "http-host", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:11.956707+00:00" }, { "observable_id": "observable-3de1252358ba89925cb915d9", "type": "ipv4", "value": "224.0.0.22", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-aa07a2000b2be0e2d1220d10", "type": "ipv4", "value": "224.0.0.252", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bbcbb053b49485539d8c05fc", "type": "ipv4", "value": "239.255.255.250", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "frame_number": 736, "display_filter": "frame.number == 736", "timestamp_epoch": "1552960016.262103000" }, { "frame_number": 738, "display_filter": "frame.number == 738", "timestamp_epoch": "1552960016.716756000" }, { "frame_number": 739, "display_filter": "frame.number == 739", "timestamp_epoch": "1552960019.264886000" }, { "frame_number": 740, "display_filter": "frame.number == 740", "timestamp_epoch": "1552960019.717449000" }, { "frame_number": 746, "display_filter": "frame.number == 746", "timestamp_epoch": "1552960022.275623000" }, { "frame_number": 747, "display_filter": "frame.number == 747", "timestamp_epoch": "1552960022.728006000" } ], "roles": [ "http-host", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f32d8a00daea4eeb912aba61", "type": "ipv4", "value": "255.255.255.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f4a9d32c269a61cb37646c88", "type": "ipv4", "value": "31.22.4.176", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:13.842617+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:13.837476+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:13.832877+00:00" }, { "observable_id": "observable-9d6732980574d0c856238189", "type": "ipv4", "value": "46.105.131.77", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:14.044744+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:14.039882+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:14.034873+00:00" }, { "observable_id": "observable-2dea715d809f50a3c83aeb9f", "type": "sha256", "value": "2a9b0ed40f1f0bc0c13ff35d304689e9cadd633781cbcad1c2d2b92ced3f1c85", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:10.848899+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:10.646529+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:10.643526+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:10.638525+00:00" }, { "observable_id": "observable-b905e5c9aab70fdbb0a669e4", "type": "sha256", "value": "3ceb4a8069b2b9e5fdf508ef67d5af5b9d3e6a7b417919953a89fa9773e16440", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "Provider context only; relationships and threat names do not establish target maliciousness", "actors": [], "source": "otx", "status": "ok", "verdict": "context-only", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T18:01:23.430420+00:00", "technique_ids": [ "T1071", "T1105", "T1003", "T1031", "T1045", "T1053", "T1060", "T1082", "T1096", "T1112", "T1129", "T1143", "T1055", "T1056", "T1110", "T1119" ], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [ { "tier": 1, "source": "3ceb4a8069b2b9e5fdf508ef67d5af5b9d3e6a7b417919953a89fa9773e16440", "target": "credit scoreblue [Medical Campus - Aurora, Co | Recheck]", "evidence": "OTX pulse", "target_type": "collection", "evidence_source": "otx" }, { "tier": 1, "source": "3ceb4a8069b2b9e5fdf508ef67d5af5b9d3e6a7b417919953a89fa9773e16440", "target": "credit scoreblue [Medical Campus - Aurora, Co | Recheck]", "evidence": "OTX pulse", "target_type": "collection", "evidence_source": "otx" }, { "tier": 1, "source": "3ceb4a8069b2b9e5fdf508ef67d5af5b9d3e6a7b417919953a89fa9773e16440", "target": "Medical Campus - Aurora, Co | Recheck", "evidence": "OTX pulse", "target_type": "collection", "evidence_source": "otx" } ] }, { "basis": "No verdict: error", "actors": [], "source": "virustotal", "status": "error", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T18:06:23.428002+00:00", "cache_hit": false, "queried_at": "2026-09-22T18:01:22.456022+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T18:01:22.453960+00:00" }, { "observable_id": "observable-77b1ebbed3a963a5e9e5240c", "type": "sha256", "value": "5865e801e6324166d6d05b39a14f2a8a798c6eb652831f78c2634f2b7a400eaf", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:11.402386+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:11.206791+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:11.204517+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:11.201774+00:00" }, { "observable_id": "observable-b77b3822ef44d3fe1e34f312", "type": "sha256", "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f13fe7b409ddde55b76b27f0", "type": "url", "value": "http://209.141.34.8/test1.exe", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 48, "frame_number": 754, "display_filter": "frame.number == 754", "timestamp_epoch": "1552960024.599220000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0381abd094044515377eb8d0", "type": "url", "value": "http://217.23.14.81/f4.exe", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 50, "frame_number": 1553, "display_filter": "frame.number == 1553", "timestamp_epoch": "1552960186.057432000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e5a0ce0f75f362ab1c043bef", "type": "url", "value": "http://239.255.255.250:1900*", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "frame_number": 736, "display_filter": "frame.number == 736", "timestamp_epoch": "1552960016.262103000" }, { "frame_number": 738, "display_filter": "frame.number == 738", "timestamp_epoch": "1552960016.716756000" }, { "frame_number": 739, "display_filter": "frame.number == 739", "timestamp_epoch": "1552960019.264886000" }, { "frame_number": 740, "display_filter": "frame.number == 740", "timestamp_epoch": "1552960019.717449000" }, { "frame_number": 746, "display_filter": "frame.number == 746", "timestamp_epoch": "1552960022.275623000" }, { "frame_number": 747, "display_filter": "frame.number == 747", "timestamp_epoch": "1552960022.728006000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d84b738e0a5029b057258378", "type": "url", "value": "http://crl.microsoft.com/pki/crl/products/CSPCA.crl", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 56, "frame_number": 2071, "display_filter": "frame.number == 2071", "timestamp_epoch": "1552961003.800356000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-623cf4103212b755a148ad5a", "type": "url", "value": "http://www.msftncsi.com/ncsi.txt", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 27, "frame_number": 408, "display_filter": "frame.number == 408", "timestamp_epoch": "1552959901.306324000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null } ], "counts": { "observed": 43 }, "ioc_candidate_count": 0, "summary": "43 typed observations; 0 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.", "limitations": [ "No detections, no record, missing credentials and provider errors do not mean benign.", "Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.", "A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.", "Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure." ], "enrichment_plan": { "policy": "evidence-priority-v2", "items": [ { "observable_id": "observable-b77b3822ef44d3fe1e34f312", "type": "sha256", "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-69ba7e97cfeb70e5c285de2c", "type": "domain", "value": "dns.msftncsi.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d73885e4dbe7444c1e0c82fc", "type": "domain", "value": "isatap.littletigers.info", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cfc78f46c2df90579cccf2ae", "type": "domain", "value": "isatap.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4070438450d354fb10157917", "type": "domain", "value": "littletigers.info.littletigers.info", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c59bd3e59637606ad2d76dcf", "type": "domain", "value": "toptoptop1.online", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cb73785ca4a1ec5d233c0f7c", "type": "domain", "value": "wpad.littletigers.info", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-52a2e8b8ab2b7e256580677f", "type": "domain", "value": "wpad.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-33657c5fddf15abc0bcb66c3", "type": "ipv4", "value": "103.1.184.108", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-95af83621a066e1c73ef43ff", "type": "ipv4", "value": "109.230.231.176", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3ca3b0866e0461bd3bbe7485", "type": "ipv4", "value": "131.107.255.255", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ab3fa40602302f283aef45d6", "type": "ipv4", "value": "173.205.6.155", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1bbd05974ed993a3ed99991b", "type": "ipv4", "value": "189.189.64.242", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-74cf3a55070694f99ca62411", "type": "ipv4", "value": "209.121.139.187", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2dea715d809f50a3c83aeb9f", "type": "sha256", "value": "2a9b0ed40f1f0bc0c13ff35d304689e9cadd633781cbcad1c2d2b92ced3f1c85", "priority": 95, "reasons": [ "recovered-pe-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-77b1ebbed3a963a5e9e5240c", "type": "sha256", "value": "5865e801e6324166d6d05b39a14f2a8a798c6eb652831f78c2634f2b7a400eaf", "priority": 95, "reasons": [ "recovered-pe-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cf3737eda412480d6a0b727f", "type": "ipv4", "value": "209.141.34.8", "priority": 80, "reasons": [ "http_request-peer", "served-inspectable-file-not-transitive-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e0cbf9917bae95b482c3cf01", "type": "ipv4", "value": "217.23.14.81", "priority": 80, "reasons": [ "http_request-peer", "served-inspectable-file-not-transitive-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fbae365cd7b437c79d8f5ae7", "type": "domain", "value": "crl.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b77b79c53dce9106b4814716", "type": "domain", "value": "www.msftncsi.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b835801caf6d7ccbcac9959c", "type": "domain", "value": "bobby-tiger-pc.littletigers.info", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9dd8a1797fa08ae0aa756092", "type": "domain", "value": "littletigers-dc.littletigers.info", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-878e94a680efe75149e48539", "type": "domain", "value": "littletigers.info", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-eec6fbb0bbc5733a7db9a45b", "type": "ipv4", "value": "115.112.43.81", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fe82edc34b84bd982858c640", "type": "ipv4", "value": "173.205.6.202", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-39971126fd70b299f4dced7f", "type": "ipv4", "value": "203.45.1.75", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fb60852ad4e6dfd1c4cfa78d", "type": "ipv4", "value": "209.121.139.185", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f4a9d32c269a61cb37646c88", "type": "ipv4", "value": "31.22.4.176", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9d6732980574d0c856238189", "type": "ipv4", "value": "46.105.131.77", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b905e5c9aab70fdbb0a669e4", "type": "sha256", "value": "3ceb4a8069b2b9e5fdf508ef67d5af5b9d3e6a7b417919953a89fa9773e16440", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false } ], "eligible_count": 30, "next_batch": [ "observable-b77b3822ef44d3fe1e34f312", "observable-69ba7e97cfeb70e5c285de2c", "observable-d73885e4dbe7444c1e0c82fc", "observable-cfc78f46c2df90579cccf2ae", "observable-4070438450d354fb10157917", "observable-c59bd3e59637606ad2d76dcf", "observable-cb73785ca4a1ec5d233c0f7c", "observable-52a2e8b8ab2b7e256580677f", "observable-33657c5fddf15abc0bcb66c3", "observable-95af83621a066e1c73ef43ff" ], "scope": "Query recommendations, not IOC verdicts. Partial provider coverage stays pending; cooldowns/credential failures are not completed checks. Checked means completed attempted direct providers, not all available providers. Review before external disclosure." }, "assessment_sha256": "8e7e1f827e8c9c462260aa4ea3ab0bd4dd2e30311845b6615fad688090ff15a4" }, "enrichment": { "items": [ { "type": "sha256", "value": "3ceb4a8069b2b9e5fdf508ef67d5af5b9d3e6a7b417919953a89fa9773e16440", "signals": [ { "basis": "Provider context only; relationships and threat names do not establish target maliciousness", "actors": [], "source": "otx", "status": "ok", "verdict": "context-only", "cache_hit": false, "queried_at": "2026-09-22T18:01:23.430420+00:00", "technique_ids": [ "T1071", "T1105", "T1003", "T1031", "T1045", "T1053", "T1060", "T1082", "T1096", "T1112", "T1129", "T1143", "T1055", "T1056", "T1110", "T1119" ], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [ { "tier": 1, "source": "3ceb4a8069b2b9e5fdf508ef67d5af5b9d3e6a7b417919953a89fa9773e16440", "target": "credit scoreblue [Medical Campus - Aurora, Co | Recheck]", "evidence": "OTX pulse", "target_type": "collection", "evidence_source": "otx" }, { "tier": 1, "source": "3ceb4a8069b2b9e5fdf508ef67d5af5b9d3e6a7b417919953a89fa9773e16440", "target": "credit scoreblue [Medical Campus - Aurora, Co | Recheck]", "evidence": "OTX pulse", "target_type": "collection", "evidence_source": "otx" }, { "tier": 1, "source": "3ceb4a8069b2b9e5fdf508ef67d5af5b9d3e6a7b417919953a89fa9773e16440", "target": "Medical Campus - Aurora, Co | Recheck", "evidence": "OTX pulse", "target_type": "collection", "evidence_source": "otx" } ], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: error", "actors": [], "source": "virustotal", "status": "error", "verdict": "unknown", "retry_at": "2026-09-22T18:06:23.428002+00:00", "cache_hit": false, "queried_at": "2026-09-22T18:01:22.456022+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T18:01:22.453960+00:00", "observable_id": "observable-b905e5c9aab70fdbb0a669e4" }, { "type": "ipv4", "value": "46.105.131.77", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:14.044744+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:14.039882+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:14.034873+00:00", "observable_id": "observable-9d6732980574d0c856238189" }, { "type": "ipv4", "value": "31.22.4.176", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:13.842617+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:13.837476+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:13.832877+00:00", "observable_id": "observable-f4a9d32c269a61cb37646c88" }, { "type": "ipv4", "value": "209.121.139.185", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:13.621008+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:13.615251+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:13.607114+00:00", "observable_id": "observable-fb60852ad4e6dfd1c4cfa78d" }, { "type": "ipv4", "value": "203.45.1.75", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:13.336706+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:13.334146+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:13.331985+00:00", "observable_id": "observable-39971126fd70b299f4dced7f" }, { "type": "ipv4", "value": "173.205.6.202", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:13.163511+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:13.161314+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:13.157584+00:00", "observable_id": "observable-fe82edc34b84bd982858c640" }, { "type": "ipv4", "value": "115.112.43.81", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:13.088280+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:12.892704+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:12.888340+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:12.884391+00:00", "observable_id": "observable-eec6fbb0bbc5733a7db9a45b" }, { "type": "domain", "value": "littletigers.info", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:12.884332+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:12.705205+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:12.701070+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:12.696489+00:00", "observable_id": "observable-878e94a680efe75149e48539" }, { "type": "domain", "value": "littletigers-dc.littletigers.info", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:12.696423+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:12.529953+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:12.525770+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:12.520467+00:00", "observable_id": "observable-9dd8a1797fa08ae0aa756092" }, { "type": "domain", "value": "bobby-tiger-pc.littletigers.info", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:12.520389+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:12.355162+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:12.353000+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:12.350849+00:00", "observable_id": "observable-b835801caf6d7ccbcac9959c" }, { "type": "domain", "value": "www.msftncsi.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:12.350818+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:46:30.477224+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:12.346666+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:12.343926+00:00", "observable_id": "observable-b77b79c53dce9106b4814716" }, { "type": "domain", "value": "crl.microsoft.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:12.343867+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:12.176626+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:12.174515+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:12.172690+00:00", "observable_id": "observable-fbae365cd7b437c79d8f5ae7" }, { "type": "ipv4", "value": "217.23.14.81", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:12.172650+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:11.971123+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:11.964041+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:11.956707+00:00", "observable_id": "observable-e0cbf9917bae95b482c3cf01" }, { "type": "ipv4", "value": "209.141.34.8", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:11.956612+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:11.752317+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:11.749509+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:11.744526+00:00", "observable_id": "observable-cf3737eda412480d6a0b727f" }, { "type": "sha256", "value": "5865e801e6324166d6d05b39a14f2a8a798c6eb652831f78c2634f2b7a400eaf", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:11.402386+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:11.206791+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:11.204517+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:11.201774+00:00", "observable_id": "observable-77b1ebbed3a963a5e9e5240c" }, { "type": "sha256", "value": "2a9b0ed40f1f0bc0c13ff35d304689e9cadd633781cbcad1c2d2b92ced3f1c85", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:10.848899+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:10.646529+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:10.643526+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:10.638525+00:00", "observable_id": "observable-2dea715d809f50a3c83aeb9f" } ], "coverage": { "cache_hits": 0, "active_scans": 0, "batch_results": [ { "status": "error", "provider": "virustotal", "observable_id": "observable-b905e5c9aab70fdbb0a669e4" }, { "status": "ok", "provider": "otx", "observable_id": "observable-b905e5c9aab70fdbb0a669e4" } ], "batch_targets": 1, "payload_uploads": 0, "targets_omitted": 0, "retained_targets": 16, "full_urls_disclosed": 0, "provider_lookups_started": 2 }, "updated_at": "2026-09-22T18:01:23.738084+00:00", "schema_version": "pcap-reputation-v1", "snapshot_sha256": "b702997fe3617c4d29f91f5befac71744967cfd248d392d7894135ced8131b25", "source_semantic_sha256": "9a1a4d3498dd5afb35f8698f4b731d20e3366895114aea266e43304aad3d1bba", "previous_snapshot_sha256": "30f0cdbe163a2afde797df276991b570b81a447fa629bd72992526ff151779f1" }, "artifact_download_available": true, "source_tlp": "TLP:CLEAR", "techniques": [ { "attack_id": "T1105", "name": "Ingress Tool Transfer", "tactic": "command-and-control", "confidence": 0.8, "evidence": "T1105 Ingress Tool Transfer", "review_status": "suggested", "evidence_start": 4859, "evidence_end": 4886, "evidence_source": "source-text", "llm_verified": true, "review_note": null, "reviewer": null, "reviewed_at": null } ], "apt_matches": [ { "group_attack_id": "G0123", "group_name": "Volatile Cedar", "similarity": 0.2, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0044", "group_name": "Winnti Group", "similarity": 0.1667, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0130", "group_name": "Ajax Security Team", "similarity": 0.1667, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0136", "group_name": "IndigoZebra", "similarity": 0.1429, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0133", "group_name": "Nomadic Octopus", "similarity": 0.1429, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G1013", "group_name": "Metador", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0107", "group_name": "Whitefly", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0066", "group_name": "Elderwood", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0075", "group_name": "Rancor", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0120", "group_name": "Evilnum", "similarity": 0.0909, "shared_count": 1, "shared_techniques": [ "T1105" ] } ], "public_note": "Public derivative: full packet extraction retained; provider evidence bounded; other-session details omitted. Original snapshot hashes do not hash this serialized derivative." }