{ "analysis_id": "d4027bcf-0ef6-4e3c-a68a-68dfe35adb33", "session_id": "6356080a-6fd5-4a14-96b2-dedff3fa917d", "status": "completed", "filename": "2019-05-02-traffic-analysis-exercise.pcap", "source_sha256": "41c9c4db17a58581eed3fc7f0bbebfe93c68034e2457afe131503c1a9eafac56", "source_size_bytes": 5835639, "schema_version": "pcap-analysis-v1", "semantic_sha256": "30110b47eb7722b407caa6084fdbb6cbde0f12e5f8e17009e0f0244d32719fb9", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "summary": "Decoded 8763 packets across 12 IP endpoints and 97 transport flows. Observed 46 DNS events, 8 HTTP requests, 0 TLS ClientHello events, and 2 recovered file/message object(s). Deterministic rules produced 7 finding(s): 0 high, 3 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2019-05-02-traffic-analysis-exercise.pcap\nCapture SHA-256: `41c9c4db17a58581eed3fc7f0bbebfe93c68034e2457afe131503c1a9eafac56`\nSemantic result SHA-256: `30110b47eb7722b407caa6084fdbb6cbde0f12e5f8e17009e0f0244d32719fb9`\nAnalyzer manifest SHA-256: `1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0`\n\n## Executive summary\n\nDecoded 8763 packets across 12 IP endpoints and 97 transport flows. Observed 46 DNS events, 8 HTTP requests, 0 TLS ClientHello events, and 2 recovered file/message object(s). Deterministic rules produced 7 finding(s): 0 high, 3 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 8763\n- Duration: 1816.717914 seconds\n- Captured bytes: 5695407\n- Endpoints: 12\n- Flows: 97\n\n## Deterministic findings\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 272 / TCP stream 17, frame 274 / TCP stream 17, frame 276 / TCP stream 17, frame 278 / TCP stream 17, frame 621 / TCP stream 17.\n\nMetrics: `{\"destination\":\"10.0.0.227\",\"event_count\":8,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.0.0.10\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 39 / TCP stream 2, frame 74 / TCP stream 2, frame 76 / TCP stream 2, frame 78 / TCP stream 2, frame 152 / TCP stream 2.\n\nMetrics: `{\"destination\":\"10.0.0.227\",\"event_count\":33,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.0.0.10\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 271 / TCP stream 17, frame 273 / TCP stream 17, frame 275 / TCP stream 17, frame 277 / TCP stream 17, frame 620 / TCP stream 17.\n\nMetrics: `{\"destination\":\"10.0.0.10\",\"event_count\":8,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.0.0.227\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 37 / TCP stream 2, frame 72 / TCP stream 2, frame 75 / TCP stream 2, frame 77 / TCP stream 2, frame 149 / TCP stream 2.\n\nMetrics: `{\"destination\":\"10.0.0.10\",\"event_count\":41,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.0.0.227\"}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v5`; confidence: 0.7; evidence: frame 712 / TCP stream 50.\n\nMetrics: `{\"destination\":\"145.14.145.4\",\"destination_port\":21,\"duration_seconds\":99.972,\"packets\":35,\"source\":\"10.0.0.227\",\"wire_bytes\":2598}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v5`; confidence: 0.7; evidence: frame 836 / TCP stream 55.\n\nMetrics: `{\"destination\":\"145.14.144.10\",\"destination_port\":21,\"duration_seconds\":56.919,\"packets\":46,\"source\":\"10.0.0.227\",\"wire_bytes\":3452}`\n\n### MEDIUM — Sustained external TCP conversation outside decoded application coverage\n\nThe flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\n\nRule: `unclassified-external-tcp@pcap-rules-v5`; confidence: 0.7; evidence: frame 5256 / TCP stream 59.\n\nMetrics: `{\"destination\":\"145.14.145.99\",\"destination_port\":21,\"duration_seconds\":101.445,\"packets\":47,\"source\":\"10.0.0.227\",\"wire_bytes\":3506}`\n\n## ATT&CK candidates\n\n- No deterministic ATT&CK candidates.\n\n## Identities\n\n- account: `adriana.breaux`; client IPs: 10.0.0.227; frames: 517, 525, 527, 539, 567\n- account: `breaux-win7-pc$`; client IPs: 10.0.0.227; frames: 44, 52, 54, 66, 93\n- hostname: `Breaux-Win7-PC`; client IPs: 10.0.0.227; frames: 227, 1, 214, 217, 218\n- netbios-group: `BEGUILESOFT`; client IPs: unbound subject; frames: 2, 216, 219, 223\n\n## Observed network and file inventory — not an IOC verdict\n\n- domain: `beguilesoft-dc.beguilesoft.com`; roles: dns-query\n- domain: `beguilesoft.com`; roles: dns-query\n- domain: `breaux-win7-pc.beguilesoft.com`; roles: dns-query\n- domain: `dns.msftncsi.com`; roles: dns-query\n- domain: `files.000webhost.com`; roles: dns-query\n- domain: `isatap.beguilesoft.com`; roles: dns-query\n- domain: `isatap.localdomain`; roles: dns-query\n- domain: `us-east-1.route-1000.000webhost.awex.io`; roles: dns-cname\n- domain: `whatismyipaddress.com`; roles: dns-query, http-host\n- domain: `wpad.beguilesoft.com`; roles: dns-query\n- domain: `www.msftncsi.com`; roles: dns-query, http-host\n- ipv4: `10.0.0.10`; roles: dns-answer, network-endpoint\n- ipv4: `10.0.0.227`; roles: dns-answer, network-endpoint\n- ipv4: `10.0.0.255`; roles: network-endpoint\n- ipv4: `104.16.154.36`; roles: dns-answer, network-endpoint\n- ipv4: `104.16.155.36`; roles: dns-answer\n- ipv4: `131.107.255.255`; roles: dns-answer\n- ipv4: `145.14.144.10`; roles: dns-answer, network-endpoint\n- ipv4: `145.14.145.4`; roles: dns-answer, network-endpoint\n- ipv4: `145.14.145.99`; roles: dns-answer, network-endpoint\n- ipv4: `204.2.193.137`; roles: dns-answer, network-endpoint\n- ipv4: `204.2.193.138`; roles: dns-answer\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `239.255.255.250`; roles: http-host, network-endpoint\n- ipv4: `255.255.255.255`; roles: network-endpoint\n- ipv6: `fd3e:4f5a:5b81::1`; roles: dns-answer\n- sha256: `071837b8164d0d54c84e6e2af06f06335db5cfef64ee391934660caec70f2f6f`; roles: exported-object\n- sha256: `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; roles: exported-object\n- url: `http://239.255.255.250:1900*`; roles: http-request\n- url: `http://whatismyipaddress.com/`; roles: http-request\n- url: `http://www.msftncsi.com/ncsi.txt`; roles: http-request\n- user_agent: `Microsoft NCSI`; roles: http-client\n- exported object `%2f`; SHA-256 `071837b8164d0d54c84e6e2af06f06335db5cfef64ee391934660caec70f2f6f`; size 100 bytes\n SHA-1: `5b58ecf46de1e15747b2014d6a7692c0f58c72df`; MD5: `176e0d32a9bb512e83b3d30067a6a121`; completeness: unknown; transfers: `[{\"client_ip\":\"10.0.0.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":694,\"response_frame\":696,\"server_ip\":\"104.16.154.36\",\"status_code\":\"403\",\"tcp_stream\":49,\"url\":\"http://whatismyipaddress.com/\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":100,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ncsi.txt`; SHA-256 `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; size 14 bytes\n SHA-1: `33bf88d5b82df3723d5863c7d23445e345828904`; MD5: `cd5a4d3fdd5bffc16bf959ef75cf37bc`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.0.0.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":414,\"response_frame\":416,\"server_ip\":\"204.2.193.137\",\"status_code\":\"200\",\"tcp_stream\":27,\"url\":\"http://www.msftncsi.com/ncsi.txt\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":14,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n\n## Actor similarity leads\n\n- No actor lead was calculated.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `9747aa796c7a1832b3297c8265b6d84a782e30ff3bdd924db961a7acd74f03d4`; recorded 2026-09-22T16:04:31.432754+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":33,\"observable_limit\":5000,\"observables_checked\":33,\"observables_total\":33,\"prior_case_limit_reached\":true,\"prior_cases_checked\":50,\"truncated\":false}`\n\n- Prior analysis `8879e360-655c-4073-beb9-68018699a4d4` shares 8 observations. This does not establish a common campaign.\n- Prior analysis `961bdc9a-7460-440f-a246-f55748149bcc` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `1c2e6d58-c62a-4009-939b-3aa82de281a2` shares 8 observations. This does not establish a common campaign.\n- Prior analysis `76f521c2-4e4a-41d5-95ad-a44fd9887dd8` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `fa0da8be-03fb-404d-a526-6c99c6b4f000` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `05851801-c224-489b-b9da-9e5d035c60b4` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `d9aa0de8-e06d-40b7-bffc-2e1af3c53ea0` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `246dbce6-c561-4434-bedb-dd496ba758d2` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `c66676ab-7276-4989-8c27-65017a63c2ba` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `476c88cb-8e1a-42e4-a8bd-e2ad2e63b0cd` shares 1 observations. This does not establish a common campaign.\n- Prior analysis `044c22d0-fd65-4c60-8644-c22ff5e1b31c` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `73129515-519f-4544-905f-145c9d2de3d8` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `5ddffc9a-7544-4749-b7bc-17ad98beaadb` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `fc2de8b3-a6ce-4024-9d9b-5602034db53d` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `b12014b8-9e64-4e70-bdb8-90620d23ac22` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `ada03a66-9d3d-4c08-b448-f9758ac8bac5` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `0b13588f-0835-4e15-9f97-8a9411ad7f7f` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `92de15ed-01f0-4a43-8105-a56b60130430` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `fdf1584a-1c2d-4a49-92b2-8dcb98436eb0` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `fab22e38-ca53-4105-924e-f5722b5f53fe` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `b60c4dbb-eb8f-46a7-89b9-24606fd43e46` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `8174eaa7-e189-467f-b05e-fb7397bfcf16` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `e37603cf-d241-45ee-95ec-bcf92a063147` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `7c54479c-cce3-4570-80c9-69d03571a645` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `21da2cda-3a07-4c03-b352-af8740c84bc0` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `9923b3d5-8d06-4f6a-b1f1-810507712be3` shares 7 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":2,\"export_status\":\"completed\",\"exported_objects\":2,\"hashed_bytes\":114,\"hashed_objects\":2,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":2,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":2}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 7/7, identities 4/4, observables 33/33, artifacts 2/2. Full returned inventory is in the JSON result.\n\n## Evidence-backed IOC assessment\n\n32 typed observations; 0 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.\n\nPolicy: `pcap-assessment-v3`; assessment SHA-256: `c94f4413652191d9dd45f234048c98c9db6760f4f217769a26a4a53e6aadc739`.\n\n\nOrdinary observations remain in the capture inventory; they are not declared malicious IOCs.\n\nReputation snapshot: `27f952687490fdb3149a06846c14b430c36d0dbce0b3d67b5f26ba793ed9b610`; updated 2026-09-22T17:47:03.934734+00:00. Each target retains its query time. Coverage: `{\"active_scans\":0,\"batch_results\":[{\"observable_id\":\"observable-8f170c819042eb58ad6f9492\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-8f170c819042eb58ad6f9492\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-54cbb0a2eeb7da8963da0203\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-54cbb0a2eeb7da8963da0203\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-b7260f33743c6cd748c31fab\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-b7260f33743c6cd748c31fab\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-eba7a4950c1589d99a9389b5\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-eba7a4950c1589d99a9389b5\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-e3428aad446f708e95e28927\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-e3428aad446f708e95e28927\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-62e1577b3aa3c866b80beaaf\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-62e1577b3aa3c866b80beaaf\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-0396d27a1cf0b819fcaaa608\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-0396d27a1cf0b819fcaaa608\",\"provider\":\"threatfox\",\"status\":\"not_found\"}],\"batch_targets\":7,\"cache_hits\":1,\"full_urls_disclosed\":0,\"payload_uploads\":0,\"provider_lookups_started\":6,\"retained_targets\":7,\"targets_omitted\":0}`.\n- No detections, no record, missing credentials and provider errors do not mean benign.\n- Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.\n- A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.\n- Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure.\n", "result": { "flows": [ { "bytes": 1964, "stream": 0, "flow_id": "flow-476ffd6b0998fc54573aa8a9", "packets": 19, "transport": "udp", "last_frame": 550, "first_frame": 1, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.255", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 1964, "last_seen_epoch": "1556832971.001741", "responder_bytes": 0, "first_seen_epoch": "1556832918.583678" }, { "bytes": 320, "stream": 1, "flow_id": "flow-697fcc1c7c570f65f4a56647", "packets": 2, "transport": "udp", "last_frame": 4, "first_frame": 3, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 55136, "responder_port": 53, "initiator_bytes": 127, "last_seen_epoch": "1556832918.610302", "responder_bytes": 193, "first_seen_epoch": "1556832918.609168" }, { "bytes": 196, "stream": 2, "flow_id": "flow-de8a2de35838eb851fe575ac", "packets": 2, "transport": "udp", "last_frame": 6, "first_frame": 5, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 64512, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1556832918.614024", "responder_bytes": 106, "first_seen_epoch": "1556832918.613709" }, { "bytes": 493, "stream": 3, "flow_id": "flow-909d8017e5af792e9c9b7cda", "packets": 2, "transport": "udp", "last_frame": 8, "first_frame": 7, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 64514, "responder_port": 389, "initiator_bytes": 257, "last_seen_epoch": "1556832918.634619", "responder_bytes": 236, "first_seen_epoch": "1556832918.634057" }, { "bytes": 450, "stream": 4, "flow_id": "flow-8654416afd6efbe968ed9a80", "packets": 2, "transport": "udp", "last_frame": 10, "first_frame": 9, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 64515, "responder_port": 389, "initiator_bytes": 214, "last_seen_epoch": "1556832918.650182", "responder_bytes": 236, "first_seen_epoch": "1556832918.649815" }, { "bytes": 1878, "stream": 0, "flow_id": "flow-e0fd76cd1fda8546af266272", "packets": 15, "transport": "tcp", "last_frame": 496, "first_frame": 12, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49155, "responder_port": 135, "initiator_bytes": 994, "last_seen_epoch": "1556832946.931208", "responder_bytes": 884, "first_seen_epoch": "1556832918.746712" }, { "bytes": 4510, "stream": 1, "flow_id": "flow-7b8dd76a2ee924e7550ed450", "packets": 20, "transport": "tcp", "last_frame": 499, "first_frame": 19, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49156, "responder_port": 49158, "initiator_bytes": 2628, "last_seen_epoch": "1556832946.931579", "responder_bytes": 1882, "first_seen_epoch": "1556832918.752764" }, { "bytes": 9024, "stream": 2, "flow_id": "flow-79048ed605f11da236205a57", "packets": 28, "transport": "tcp", "last_frame": 213, "first_frame": 34, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49157, "responder_port": 389, "initiator_bytes": 4385, "last_seen_epoch": "1556832919.040259", "responder_bytes": 4639, "first_seen_epoch": "1556832918.765117" }, { "bytes": 995, "stream": 3, "flow_id": "flow-4ad521808fba6c6fbd7569eb", "packets": 8, "transport": "tcp", "last_frame": 48, "first_frame": 41, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49158, "responder_port": 88, "initiator_bytes": 473, "last_seen_epoch": "1556832918.773443", "responder_bytes": 522, "first_seen_epoch": "1556832918.770962" }, { "bytes": 2505, "stream": 4, "flow_id": "flow-c871bbd14f93e90d0a706e7a", "packets": 10, "transport": "tcp", "last_frame": 58, "first_frame": 49, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49159, "responder_port": 88, "initiator_bytes": 607, "last_seen_epoch": "1556832918.794363", "responder_bytes": 1898, "first_seen_epoch": "1556832918.79091" }, { "bytes": 3924, "stream": 5, "flow_id": "flow-23600306a14aa9b3432e77a3", "packets": 12, "transport": "tcp", "last_frame": 70, "first_frame": 59, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49160, "responder_port": 88, "initiator_bytes": 1972, "last_seen_epoch": "1556832918.797392", "responder_bytes": 1952, "first_seen_epoch": "1556832918.795345" }, { "bytes": 330, "stream": 5, "flow_id": "flow-439a576d158f9e00fa5df314", "packets": 2, "transport": "udp", "last_frame": 80, "first_frame": 79, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 59407, "responder_port": 53, "initiator_bytes": 132, "last_seen_epoch": "1556832918.80372", "responder_bytes": 198, "first_seen_epoch": "1556832918.80346" }, { "bytes": 435, "stream": 6, "flow_id": "flow-ed8d568d5f486420c14d93de", "packets": 2, "transport": "udp", "last_frame": 82, "first_frame": 81, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 59408, "responder_port": 389, "initiator_bytes": 192, "last_seen_epoch": "1556832918.806416", "responder_bytes": 243, "first_seen_epoch": "1556832918.806153" }, { "bytes": 6846, "stream": 6, "flow_id": "flow-0c4deb34883438c33bd8f20d", "packets": 25, "transport": "tcp", "last_frame": 489, "first_frame": 83, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49161, "responder_port": 445, "initiator_bytes": 4862, "last_seen_epoch": "1556832935.308949", "responder_bytes": 1984, "first_seen_epoch": "1556832918.845257" }, { "bytes": 996, "stream": 7, "flow_id": "flow-ea2fa549e47299124f6a2144", "packets": 8, "transport": "tcp", "last_frame": 97, "first_frame": 90, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49162, "responder_port": 88, "initiator_bytes": 473, "last_seen_epoch": "1556832918.858369", "responder_bytes": 523, "first_seen_epoch": "1556832918.856647" }, { "bytes": 2505, "stream": 8, "flow_id": "flow-43419a8cc463e585a4ed32a8", "packets": 10, "transport": "tcp", "last_frame": 107, "first_frame": 98, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49163, "responder_port": 88, "initiator_bytes": 607, "last_seen_epoch": "1556832918.881653", "responder_bytes": 1898, "first_seen_epoch": "1556832918.877931" }, { "bytes": 3924, "stream": 9, "flow_id": "flow-fe58737215eeb04614c12ed0", "packets": 12, "transport": "tcp", "last_frame": 121, "first_frame": 108, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49164, "responder_port": 88, "initiator_bytes": 1972, "last_seen_epoch": "1556832918.887178", "responder_bytes": 1952, "first_seen_epoch": "1556832918.88259" }, { "bytes": 300, "stream": 7, "flow_id": "flow-f08507b83343d25706bfc5ee", "packets": 2, "transport": "udp", "last_frame": 118, "first_frame": 117, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 62718, "responder_port": 53, "initiator_bytes": 117, "last_seen_epoch": "1556832918.88698", "responder_bytes": 183, "first_seen_epoch": "1556832918.886742" }, { "bytes": 3623, "stream": 10, "flow_id": "flow-bceabc66d96c07c41df8fbd8", "packets": 12, "transport": "tcp", "last_frame": 135, "first_frame": 122, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49165, "responder_port": 88, "initiator_bytes": 1805, "last_seen_epoch": "1556832918.889534", "responder_bytes": 1818, "first_seen_epoch": "1556832918.887565" }, { "bytes": 450, "stream": 8, "flow_id": "flow-cdf48c3e28f595d49a48d392", "packets": 2, "transport": "udp", "last_frame": 131, "first_frame": 130, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 62719, "responder_port": 389, "initiator_bytes": 214, "last_seen_epoch": "1556832918.889011", "responder_bytes": 236, "first_seen_epoch": "1556832918.888768" }, { "bytes": 348, "stream": 11, "flow_id": "flow-58b946c8704047e59408a861", "packets": 6, "transport": "tcp", "last_frame": 151, "first_frame": 145, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49166, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1556832918.90815", "responder_bytes": 174, "first_seen_epoch": "1556832918.906333" }, { "bytes": 330, "stream": 9, "flow_id": "flow-3431ee2519668bc43bb574c0", "packets": 2, "transport": "udp", "last_frame": 154, "first_frame": 153, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 59277, "responder_port": 53, "initiator_bytes": 132, "last_seen_epoch": "1556832918.910589", "responder_bytes": 198, "first_seen_epoch": "1556832918.910299" }, { "bytes": 435, "stream": 10, "flow_id": "flow-136d1496f1f80a529a1cdbf5", "packets": 2, "transport": "udp", "last_frame": 156, "first_frame": 155, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 59278, "responder_port": 389, "initiator_bytes": 192, "last_seen_epoch": "1556832918.9204", "responder_bytes": 243, "first_seen_epoch": "1556832918.920179" }, { "bytes": 5500, "stream": 12, "flow_id": "flow-37299c9139533caf5d6c4b5f", "packets": 14, "transport": "tcp", "last_frame": 184, "first_frame": 159, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49167, "responder_port": 389, "initiator_bytes": 2601, "last_seen_epoch": "1556832919.001147", "responder_bytes": 2899, "first_seen_epoch": "1556832918.990207" }, { "bytes": 3954, "stream": 13, "flow_id": "flow-9744150a92c30d21ba24f673", "packets": 12, "transport": "tcp", "last_frame": 177, "first_frame": 166, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49168, "responder_port": 88, "initiator_bytes": 1989, "last_seen_epoch": "1556832918.997035", "responder_bytes": 1965, "first_seen_epoch": "1556832918.99485" }, { "bytes": 348, "stream": 14, "flow_id": "flow-1ee7801203af0d192bc7aab3", "packets": 6, "transport": "tcp", "last_frame": 191, "first_frame": 185, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49169, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1556832919.031801", "responder_bytes": 174, "first_seen_epoch": "1556832919.029428" }, { "bytes": 348, "stream": 15, "flow_id": "flow-7411ee3bafbff1b913c2a214", "packets": 6, "transport": "tcp", "last_frame": 199, "first_frame": 193, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49170, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1556832919.034533", "responder_bytes": 174, "first_seen_epoch": "1556832919.03264" }, { "bytes": 348, "stream": 16, "flow_id": "flow-e841c6a3d8e140d1fc1e14b2", "packets": 6, "transport": "tcp", "last_frame": 206, "first_frame": 201, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49171, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1556832919.037152", "responder_bytes": 174, "first_seen_epoch": "1556832919.035873" }, { "bytes": 148, "stream": 11, "flow_id": "flow-c7f2cfa71eeff4eeab4d6b0c", "packets": 2, "transport": "udp", "last_frame": 232, "first_frame": 226, "initiator_ip": "10.0.0.227", "responder_ip": "224.0.0.252", "initiator_port": 57232, "responder_port": 5355, "initiator_bytes": 148, "last_seen_epoch": "1556832921.283914", "responder_bytes": 0, "first_seen_epoch": "1556832921.188271" }, { "bytes": 342, "stream": 12, "flow_id": "flow-fdb36cad140b3fd9a107b090", "packets": 1, "transport": "udp", "last_frame": 227, "first_frame": 227, "initiator_ip": "10.0.0.227", "responder_ip": "255.255.255.255", "initiator_port": 68, "responder_port": 67, "initiator_bytes": 342, "last_seen_epoch": "1556832921.19347", "responder_bytes": 0, "first_seen_epoch": "1556832921.19347" }, { "bytes": 342, "stream": 13, "flow_id": "flow-09cf8e59c0dcb5e846f101dd", "packets": 1, "transport": "udp", "last_frame": 228, "first_frame": 228, "initiator_ip": "10.0.0.10", "responder_ip": "10.0.0.227", "initiator_port": 67, "responder_port": 68, "initiator_bytes": 342, "last_seen_epoch": "1556832921.193897", "responder_bytes": 0, "first_seen_epoch": "1556832921.193897" }, { "bytes": 237, "stream": 14, "flow_id": "flow-6e8788f6449fcefe3106fb73", "packets": 2, "transport": "udp", "last_frame": 230, "first_frame": 229, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 54339, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1556832921.198017", "responder_bytes": 157, "first_seen_epoch": "1556832921.197758" }, { "bytes": 128, "stream": 15, "flow_id": "flow-fd2e8728b7dc5156c9fd9310", "packets": 2, "transport": "udp", "last_frame": 233, "first_frame": 231, "initiator_ip": "10.0.0.227", "responder_ip": "224.0.0.252", "initiator_port": 59823, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1556832921.293654", "responder_bytes": 0, "first_seen_epoch": "1556832921.198507" }, { "bytes": 196, "stream": 16, "flow_id": "flow-0fd7da631c210429db0595f6", "packets": 2, "transport": "udp", "last_frame": 238, "first_frame": 237, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 53008, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1556832922.070887", "responder_bytes": 106, "first_seen_epoch": "1556832922.070554" }, { "bytes": 241, "stream": 17, "flow_id": "flow-91302b41870c43e0c39086b3", "packets": 2, "transport": "udp", "last_frame": 240, "first_frame": 239, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 52682, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1556832922.07103", "responder_bytes": 159, "first_seen_epoch": "1556832922.070903" }, { "bytes": 440, "stream": 18, "flow_id": "flow-129222de78df6c42795e97ec", "packets": 4, "transport": "udp", "last_frame": 5243, "first_frame": 243, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 123, "responder_port": 123, "initiator_bytes": 220, "last_seen_epoch": "1556833947.579558", "responder_bytes": 220, "first_seen_epoch": "1556832923.580703" }, { "bytes": 10804, "stream": 17, "flow_id": "flow-1ad8112d3ae16a087431f61b", "packets": 37, "transport": "tcp", "last_frame": 766, "first_frame": 250, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49173, "responder_port": 49155, "initiator_bytes": 7020, "last_seen_epoch": "1556833006.924072", "responder_bytes": 3784, "first_seen_epoch": "1556832923.772898" }, { "bytes": 3954, "stream": 18, "flow_id": "flow-181a61af8c01ba31c19f628e", "packets": 12, "transport": "tcp", "last_frame": 264, "first_frame": 253, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49174, "responder_port": 88, "initiator_bytes": 1989, "last_seen_epoch": "1556832923.775833", "responder_bytes": 1965, "first_seen_epoch": "1556832923.773794" }, { "bytes": 231, "stream": 19, "flow_id": "flow-28c90cb03f9f3f456de72dac", "packets": 2, "transport": "udp", "last_frame": 280, "first_frame": 279, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 62720, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1556832923.882075", "responder_bytes": 153, "first_seen_epoch": "1556832923.858883" }, { "bytes": 341, "stream": 20, "flow_id": "flow-e619ff3d9444bec762cbc0c8", "packets": 2, "transport": "udp", "last_frame": 285, "first_frame": 284, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 56348, "responder_port": 53, "initiator_bytes": 132, "last_seen_epoch": "1556832924.375724", "responder_bytes": 209, "first_seen_epoch": "1556832924.37539" }, { "bytes": 279, "stream": 21, "flow_id": "flow-e5df47f150873b7293ef069a", "packets": 2, "transport": "udp", "last_frame": 287, "first_frame": 286, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 63630, "responder_port": 53, "initiator_bytes": 101, "last_seen_epoch": "1556832924.37639", "responder_bytes": 178, "first_seen_epoch": "1556832924.3761" }, { "bytes": 8182, "stream": 19, "flow_id": "flow-c639a580d961e24f83ea96e6", "packets": 20, "transport": "tcp", "last_frame": 403, "first_frame": 288, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49175, "responder_port": 389, "initiator_bytes": 3398, "last_seen_epoch": "1556832924.802283", "responder_bytes": 4784, "first_seen_epoch": "1556832924.37738" }, { "bytes": 3859, "stream": 20, "flow_id": "flow-04d6ce6636399328d11661bd", "packets": 12, "transport": "tcp", "last_frame": 310, "first_frame": 299, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49176, "responder_port": 88, "initiator_bytes": 1951, "last_seen_epoch": "1556832924.38945", "responder_bytes": 1908, "first_seen_epoch": "1556832924.387203" }, { "bytes": 3434, "stream": 21, "flow_id": "flow-07861dc9b69853466b6ec479", "packets": 14, "transport": "tcp", "last_frame": 396, "first_frame": 313, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49177, "responder_port": 389, "initiator_bytes": 2580, "last_seen_epoch": "1556832924.413356", "responder_bytes": 854, "first_seen_epoch": "1556832924.392806" }, { "bytes": 8714, "stream": 22, "flow_id": "flow-74cc304df31cf57a42891a83", "packets": 34, "transport": "tcp", "last_frame": 509, "first_frame": 326, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49178, "responder_port": 445, "initiator_bytes": 5896, "last_seen_epoch": "1556832959.30281", "responder_bytes": 2818, "first_seen_epoch": "1556832924.399205" }, { "bytes": 3924, "stream": 23, "flow_id": "flow-eefc551f21c1a069256cdf73", "packets": 12, "transport": "tcp", "last_frame": 342, "first_frame": 331, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49179, "responder_port": 88, "initiator_bytes": 1972, "last_seen_epoch": "1556832924.401673", "responder_bytes": 1952, "first_seen_epoch": "1556832924.40032" }, { "bytes": 3623, "stream": 24, "flow_id": "flow-8289c2e209e657dde3eed53b", "packets": 12, "transport": "tcp", "last_frame": 355, "first_frame": 343, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49180, "responder_port": 88, "initiator_bytes": 1805, "last_seen_epoch": "1556832924.40293", "responder_bytes": 1818, "first_seen_epoch": "1556832924.401756" }, { "bytes": 3645, "stream": 25, "flow_id": "flow-cd99b12af19ba44035006935", "packets": 12, "transport": "tcp", "last_frame": 373, "first_frame": 359, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49181, "responder_port": 88, "initiator_bytes": 1810, "last_seen_epoch": "1556832924.40514", "responder_bytes": 1835, "first_seen_epoch": "1556832924.403397" }, { "bytes": 3308, "stream": 26, "flow_id": "flow-0bb5897e80f4714429bf1d1c", "packets": 10, "transport": "tcp", "last_frame": 384, "first_frame": 374, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49182, "responder_port": 88, "initiator_bytes": 2883, "last_seen_epoch": "1556832924.407458", "responder_bytes": 425, "first_seen_epoch": "1556832924.405355" }, { "bytes": 258, "stream": 22, "flow_id": "flow-9dce2206183eccebb951bcbe", "packets": 2, "transport": "udp", "last_frame": 410, "first_frame": 405, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 57454, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1556832926.23091", "responder_bytes": 182, "first_seen_epoch": "1556832926.060635" }, { "bytes": 258, "stream": 23, "flow_id": "flow-754198263d7d9c5578d682fe", "packets": 2, "transport": "udp", "last_frame": 407, "first_frame": 406, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 57320, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1556832926.199805", "responder_bytes": 168, "first_seen_epoch": "1556832926.199445" }, { "bytes": 314, "stream": 24, "flow_id": "flow-51184e9286694c41083b4c1c", "packets": 2, "transport": "udp", "last_frame": 409, "first_frame": 408, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 63924, "responder_port": 53, "initiator_bytes": 157, "last_seen_epoch": "1556832926.20248", "responder_bytes": 157, "first_seen_epoch": "1556832926.201223" }, { "bytes": 778, "stream": 27, "flow_id": "flow-98846bb0d7d87ef76e7fb669", "packets": 9, "transport": "tcp", "last_frame": 419, "first_frame": 411, "initiator_ip": "10.0.0.227", "responder_ip": "204.2.193.137", "initiator_port": 49183, "responder_port": 80, "initiator_bytes": 379, "last_seen_epoch": "1556832926.296833", "responder_bytes": 399, "first_seen_epoch": "1556832926.233526" }, { "bytes": 7197, "stream": 28, "flow_id": "flow-342e0481de95aec6d5da0391", "packets": 21, "transport": "tcp", "last_frame": 483, "first_frame": 420, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49185, "responder_port": 389, "initiator_bytes": 3404, "last_seen_epoch": "1556832929.505245", "responder_bytes": 3793, "first_seen_epoch": "1556832929.457082" }, { "bytes": 4165, "stream": 29, "flow_id": "flow-a03c446bd3fe904ae5e89c22", "packets": 13, "transport": "tcp", "last_frame": 481, "first_frame": 439, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49186, "responder_port": 389, "initiator_bytes": 3351, "last_seen_epoch": "1556832929.504798", "responder_bytes": 814, "first_seen_epoch": "1556832929.469418" }, { "bytes": 996, "stream": 30, "flow_id": "flow-b6eab1a6d96a709c272708c6", "packets": 8, "transport": "tcp", "last_frame": 455, "first_frame": 448, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49187, "responder_port": 88, "initiator_bytes": 473, "last_seen_epoch": "1556832929.480625", "responder_bytes": 523, "first_seen_epoch": "1556832929.478541" }, { "bytes": 2505, "stream": 31, "flow_id": "flow-bd1deef372a115643f9184fd", "packets": 10, "transport": "tcp", "last_frame": 465, "first_frame": 456, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49188, "responder_port": 88, "initiator_bytes": 607, "last_seen_epoch": "1556832929.499433", "responder_bytes": 1898, "first_seen_epoch": "1556832929.498005" }, { "bytes": 3797, "stream": 32, "flow_id": "flow-ac854a39292bd40a58709c89", "packets": 12, "transport": "tcp", "last_frame": 477, "first_frame": 466, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49189, "responder_port": 88, "initiator_bytes": 1917, "last_seen_epoch": "1556832929.501694", "responder_bytes": 1880, "first_seen_epoch": "1556832929.500246" }, { "bytes": 385, "stream": 33, "flow_id": "flow-b3c8d66e17f7f72de5b4ae9c", "packets": 7, "transport": "tcp", "last_frame": 544, "first_frame": 503, "initiator_ip": "10.0.0.10", "responder_ip": "10.0.0.227", "initiator_port": 445, "responder_port": 49194, "initiator_bytes": 385, "last_seen_epoch": "1556832969.19459", "responder_bytes": 0, "first_seen_epoch": "1556832957.167146" }, { "bytes": 934, "stream": 34, "flow_id": "flow-2d20e2e7adeaa2792b3d7caa", "packets": 8, "transport": "tcp", "last_frame": 521, "first_frame": 514, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49190, "responder_port": 88, "initiator_bytes": 464, "last_seen_epoch": "1556832968.929702", "responder_bytes": 470, "first_seen_epoch": "1556832968.927737" }, { "bytes": 2498, "stream": 35, "flow_id": "flow-a45a84ffbac0e6341a4ae4f7", "packets": 10, "transport": "tcp", "last_frame": 531, "first_frame": 522, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49191, "responder_port": 88, "initiator_bytes": 598, "last_seen_epoch": "1556832968.942002", "responder_bytes": 1900, "first_seen_epoch": "1556832968.94001" }, { "bytes": 3706, "stream": 36, "flow_id": "flow-d9bd719cb7cc7aeff2692c38", "packets": 12, "transport": "tcp", "last_frame": 543, "first_frame": 532, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49192, "responder_port": 88, "initiator_bytes": 1838, "last_seen_epoch": "1556832968.943678", "responder_bytes": 1868, "first_seen_epoch": "1556832968.942294" }, { "bytes": 186, "stream": 37, "flow_id": "flow-3d29ff6185ea2aaea621690f", "packets": 3, "transport": "tcp", "last_frame": 547, "first_frame": 545, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49193, "responder_port": 135, "initiator_bytes": 120, "last_seen_epoch": "1556832969.366061", "responder_bytes": 66, "first_seen_epoch": "1556832969.365646" }, { "bytes": 120, "stream": 38, "flow_id": "flow-f227d47b7befb463a57c18bf", "packets": 2, "transport": "tcp", "last_frame": 549, "first_frame": 548, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49194, "responder_port": 445, "initiator_bytes": 120, "last_seen_epoch": "1556832969.916964", "responder_bytes": 0, "first_seen_epoch": "1556832969.916544" }, { "bytes": 104, "stream": 25, "flow_id": "flow-be07a4a80a32f27901bf8d77", "packets": 1, "transport": "udp", "last_frame": 551, "first_frame": 551, "initiator_ip": "10.0.0.10", "responder_ip": "10.0.0.227", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 104, "last_seen_epoch": "1556832971.002052", "responder_bytes": 0, "first_seen_epoch": "1556832971.002052" }, { "bytes": 9149, "stream": 39, "flow_id": "flow-c5f7f875a03869851a76ff6e", "packets": 59, "transport": "tcp", "last_frame": 8741, "first_frame": 552, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49195, "responder_port": 139, "initiator_bytes": 6294, "last_seen_epoch": "1556834634.825313", "responder_bytes": 2855, "first_seen_epoch": "1556832971.002228" }, { "bytes": 3968, "stream": 40, "flow_id": "flow-62443d691a56dec7c88b3fb5", "packets": 12, "transport": "tcp", "last_frame": 571, "first_frame": 560, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49196, "responder_port": 88, "initiator_bytes": 1994, "last_seen_epoch": "1556832971.006741", "responder_bytes": 1974, "first_seen_epoch": "1556832971.004531" }, { "bytes": 3667, "stream": 41, "flow_id": "flow-1cd2cb717c40adda9c08d618", "packets": 12, "transport": "tcp", "last_frame": 583, "first_frame": 572, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49197, "responder_port": 88, "initiator_bytes": 1827, "last_seen_epoch": "1556832971.008038", "responder_bytes": 1840, "first_seen_epoch": "1556832971.00693" }, { "bytes": 604, "stream": 42, "flow_id": "flow-00939caf22a4275c2564f529", "packets": 11, "transport": "tcp", "last_frame": 709, "first_frame": 597, "initiator_ip": "10.0.0.10", "responder_ip": "10.0.0.227", "initiator_port": 445, "responder_port": 49215, "initiator_bytes": 604, "last_seen_epoch": "1556832991.877027", "responder_bytes": 0, "first_seen_epoch": "1556832971.80037" }, { "bytes": 724, "stream": 43, "flow_id": "flow-ec69098de118265ed09a233d", "packets": 8, "transport": "tcp", "last_frame": 768, "first_frame": 598, "initiator_ip": "10.0.0.10", "responder_ip": "10.0.0.227", "initiator_port": 135, "responder_port": 49193, "initiator_bytes": 562, "last_seen_epoch": "1556833006.924277", "responder_bytes": 162, "first_seen_epoch": "1556832972.373575" }, { "bytes": 3998, "stream": 44, "flow_id": "flow-94cbc2f2342894b9a8723853", "packets": 12, "transport": "tcp", "last_frame": 613, "first_frame": 602, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49198, "responder_port": 88, "initiator_bytes": 2011, "last_seen_epoch": "1556832972.377378", "responder_bytes": 1987, "first_seen_epoch": "1556832972.375415" }, { "bytes": 5238, "stream": 45, "flow_id": "flow-bb9676768aa1ee658fd5df58", "packets": 15, "transport": "tcp", "last_frame": 687, "first_frame": 630, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49199, "responder_port": 389, "initiator_bytes": 2969, "last_seen_epoch": "1556832973.709898", "responder_bytes": 2269, "first_seen_epoch": "1556832972.9636" }, { "bytes": 3968, "stream": 46, "flow_id": "flow-6fb322fa1e6b886b488857e3", "packets": 12, "transport": "tcp", "last_frame": 644, "first_frame": 633, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49200, "responder_port": 88, "initiator_bytes": 1994, "last_seen_epoch": "1556832972.967898", "responder_bytes": 1974, "first_seen_epoch": "1556832972.965177" }, { "bytes": 3480, "stream": 47, "flow_id": "flow-21be6fcdf900db13ebeec2de", "packets": 14, "transport": "tcp", "last_frame": 682, "first_frame": 651, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49201, "responder_port": 389, "initiator_bytes": 2626, "last_seen_epoch": "1556832973.197777", "responder_bytes": 854, "first_seen_epoch": "1556832972.978355" }, { "bytes": 6974, "stream": 48, "flow_id": "flow-5ec5f421010ebef48495c81c", "packets": 25, "transport": "tcp", "last_frame": 773, "first_frame": 664, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49202, "responder_port": 445, "initiator_bytes": 5116, "last_seen_epoch": "1556833007.3161", "responder_bytes": 1858, "first_seen_epoch": "1556832973.185875" }, { "bytes": 194, "stream": 26, "flow_id": "flow-6e1c57358b80738db03854d2", "packets": 2, "transport": "udp", "last_frame": 690, "first_frame": 689, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 55103, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1556832974.729338", "responder_bytes": 113, "first_seen_epoch": "1556832974.687459" }, { "bytes": 1245, "stream": 49, "flow_id": "flow-c26e65a57c2051875098eff4", "packets": 11, "transport": "tcp", "last_frame": 812, "first_frame": 691, "initiator_ip": "10.0.0.227", "responder_ip": "104.16.154.36", "initiator_port": 49204, "responder_port": 80, "initiator_bytes": 407, "last_seen_epoch": "1556833074.872593", "responder_bytes": 838, "first_seen_epoch": "1556832974.733937" }, { "bytes": 229, "stream": 27, "flow_id": "flow-bd1691465841ba1d9b5e97fd", "packets": 2, "transport": "udp", "last_frame": 711, "first_frame": 710, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 60835, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1556832993.781309", "responder_bytes": 149, "first_seen_epoch": "1556832993.70196" }, { "bytes": 2598, "stream": 50, "flow_id": "flow-aac5b7af3518e6be2ab3cba7", "packets": 35, "transport": "tcp", "last_frame": 813, "first_frame": 712, "initiator_ip": "10.0.0.227", "responder_ip": "145.14.145.4", "initiator_port": 49205, "responder_port": 21, "initiator_bytes": 920, "last_seen_epoch": "1556833093.753655", "responder_bytes": 1678, "first_seen_epoch": "1556832993.781986" }, { "bytes": 3725, "stream": 51, "flow_id": "flow-3426a3bf52d431dc877671d0", "packets": 17, "transport": "tcp", "last_frame": 759, "first_frame": 739, "initiator_ip": "10.0.0.227", "responder_ip": "145.14.145.4", "initiator_port": 49206, "responder_port": 37280, "initiator_bytes": 3289, "last_seen_epoch": "1556832995.563895", "responder_bytes": 436, "first_seen_epoch": "1556832995.349344" }, { "bytes": 186, "stream": 52, "flow_id": "flow-455cbcbddcab3e4a15c8dd4a", "packets": 3, "transport": "tcp", "last_frame": 776, "first_frame": 774, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49207, "responder_port": 135, "initiator_bytes": 120, "last_seen_epoch": "1556833014.353115", "responder_bytes": 66, "first_seen_epoch": "1556833014.352804" }, { "bytes": 724, "stream": 53, "flow_id": "flow-6e41304e8e20f7d719ac5b00", "packets": 8, "transport": "tcp", "last_frame": 800, "first_frame": 777, "initiator_ip": "10.0.0.10", "responder_ip": "10.0.0.227", "initiator_port": 135, "responder_port": 49207, "initiator_bytes": 562, "last_seen_epoch": "1556833036.923684", "responder_bytes": 162, "first_seen_epoch": "1556833017.360207" }, { "bytes": 1468, "stream": 54, "flow_id": "flow-5d46e31084e5bd6c0cd59878", "packets": 12, "transport": "tcp", "last_frame": 798, "first_frame": 781, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49208, "responder_port": 49155, "initiator_bytes": 874, "last_seen_epoch": "1556833036.92328", "responder_bytes": 594, "first_seen_epoch": "1556833017.362238" }, { "bytes": 1050, "stream": 28, "flow_id": "flow-03b4435058ff7a458cd62767", "packets": 6, "transport": "udp", "last_frame": 808, "first_frame": 802, "initiator_ip": "10.0.0.227", "responder_ip": "239.255.255.250", "initiator_port": 60837, "responder_port": 1900, "initiator_bytes": 1050, "last_seen_epoch": "1556833045.830853", "responder_bytes": 0, "first_seen_epoch": "1556833039.389253" }, { "bytes": 533, "stream": 29, "flow_id": "flow-5e571eeb4d447f7946ec331e", "packets": 6, "transport": "udp", "last_frame": 823, "first_frame": 818, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 53832, "responder_port": 53, "initiator_bytes": 400, "last_seen_epoch": "1556833287.107989", "responder_bytes": 133, "first_seen_epoch": "1556833274.997255" }, { "bytes": 168, "stream": 30, "flow_id": "flow-bec287f98b9d6c785f5accd3", "packets": 2, "transport": "udp", "last_frame": 825, "first_frame": 824, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 59173, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1556833288.329591", "responder_bytes": 92, "first_seen_epoch": "1556833288.30242" }, { "bytes": 180, "stream": 31, "flow_id": "flow-5bb0ab6d65864b984604a1c1", "packets": 2, "transport": "udp", "last_frame": 827, "first_frame": 826, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 59977, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1556833288.330376", "responder_bytes": 104, "first_seen_epoch": "1556833288.330117" }, { "bytes": 229, "stream": 32, "flow_id": "flow-b42c8111b00cedceb216b828", "packets": 2, "transport": "udp", "last_frame": 835, "first_frame": 834, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 56260, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1556833587.155224", "responder_bytes": 149, "first_seen_epoch": "1556833587.071526" }, { "bytes": 3452, "stream": 55, "flow_id": "flow-bb285a1c25a8cd17a5ec2057", "packets": 46, "transport": "tcp", "last_frame": 5207, "first_frame": 836, "initiator_ip": "10.0.0.227", "responder_ip": "145.14.144.10", "initiator_port": 49209, "responder_port": 21, "initiator_bytes": 1189, "last_seen_epoch": "1556833644.075172", "responder_bytes": 2263, "first_seen_epoch": "1556833587.156343" }, { "bytes": 1393, "stream": 56, "flow_id": "flow-60898c432d6c499b42f4aa30", "packets": 9, "transport": "tcp", "last_frame": 873, "first_frame": 861, "initiator_ip": "10.0.0.227", "responder_ip": "145.14.144.10", "initiator_port": 49210, "responder_port": 40651, "initiator_bytes": 1173, "last_seen_epoch": "1556833588.172126", "responder_bytes": 220, "first_seen_epoch": "1556833587.958092" }, { "bytes": 3065820, "stream": 57, "flow_id": "flow-f40b65a3467dc1a9a772e7eb", "packets": 4317, "transport": "tcp", "last_frame": 5202, "first_frame": 881, "initiator_ip": "10.0.0.227", "responder_ip": "145.14.144.10", "initiator_port": 49211, "responder_port": 47434, "initiator_bytes": 2937728, "last_seen_epoch": "1556833593.007681", "responder_bytes": 128092, "first_seen_epoch": "1556833588.491727" }, { "bytes": 6336, "stream": 58, "flow_id": "flow-19917af358337f6d7dd4ec53", "packets": 22, "transport": "tcp", "last_frame": 5239, "first_frame": 5218, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49212, "responder_port": 445, "initiator_bytes": 4626, "last_seen_epoch": "1556833835.304934", "responder_bytes": 1710, "first_seen_epoch": "1556833823.78679" }, { "bytes": 229, "stream": 33, "flow_id": "flow-83e386caa2a9ceee69c55b6b", "packets": 2, "transport": "udp", "last_frame": 5255, "first_frame": 5254, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 51646, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1556834493.173728", "responder_bytes": 149, "first_seen_epoch": "1556834493.030295" }, { "bytes": 3506, "stream": 59, "flow_id": "flow-88605ced54b764e418b71956", "packets": 47, "transport": "tcp", "last_frame": 8740, "first_frame": 5256, "initiator_ip": "10.0.0.227", "responder_ip": "145.14.145.99", "initiator_port": 49213, "responder_port": 21, "initiator_bytes": 1244, "last_seen_epoch": "1556834594.619618", "responder_bytes": 2262, "first_seen_epoch": "1556834493.174821" }, { "bytes": 1211, "stream": 60, "flow_id": "flow-dd9d242bae5f4475fda3681f", "packets": 11, "transport": "tcp", "last_frame": 5295, "first_frame": 5281, "initiator_ip": "10.0.0.227", "responder_ip": "145.14.145.99", "initiator_port": 49214, "responder_port": 36091, "initiator_bytes": 937, "last_seen_epoch": "1556834494.610632", "responder_bytes": 274, "first_seen_epoch": "1556834494.385534" }, { "bytes": 2410649, "stream": 61, "flow_id": "flow-51670ad14e5e0f70236cad0e", "packets": 3425, "transport": "tcp", "last_frame": 8731, "first_frame": 5303, "initiator_ip": "10.0.0.227", "responder_ip": "145.14.145.99", "initiator_port": 49215, "responder_port": 35396, "initiator_bytes": 2308315, "last_seen_epoch": "1556834498.541762", "responder_bytes": 102334, "first_seen_epoch": "1556834494.86708" }, { "bytes": 6336, "stream": 62, "flow_id": "flow-8cb9497ea6c00f39e0aa7475", "packets": 22, "transport": "tcp", "last_frame": 8763, "first_frame": 8742, "initiator_ip": "10.0.0.227", "responder_ip": "10.0.0.10", "initiator_port": 49216, "responder_port": 445, "initiator_bytes": 4626, "last_seen_epoch": "1556834735.301592", "responder_bytes": 1710, "first_seen_epoch": "1556834723.812473" } ], "events": { "dns": [ { "kind": "dns", "dst_ip": "10.0.0.10", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.beguilesoft.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": 53, "event_id": "evt-bc48d0ac16ce0949483fe357", "src_port": 55136, "tcp_stream": null, "udp_stream": 1, "frame_number": 3, "timestamp_epoch": "1556832918.609168000" }, { "kind": "dns", "dst_ip": "10.0.0.227", "fields": { "dns.a": "10.0.0.10", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.beguilesoft.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.0.10", "dst_port": 55136, "event_id": "evt-26fd5e6e0ec9832e3900d52c", "src_port": 53, "tcp_stream": null, "udp_stream": 1, "frame_number": 4, "timestamp_epoch": "1556832918.610302000" }, { "kind": "dns", "dst_ip": "10.0.0.10", "fields": { "dns.qry.name": "beguilesoft-dc.beguilesoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": 53, "event_id": "evt-c147f3ef66744aa65ae10010", "src_port": 64512, "tcp_stream": null, "udp_stream": 2, "frame_number": 5, "timestamp_epoch": "1556832918.613709000" }, { "kind": "dns", "dst_ip": "10.0.0.227", "fields": { "dns.a": "10.0.0.10", "dns.qry.name": "beguilesoft-dc.beguilesoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.0.10", "dst_port": 64512, "event_id": "evt-31dc318630d017b5935b79e6", "src_port": 53, "tcp_stream": null, "udp_stream": 2, "frame_number": 6, "timestamp_epoch": "1556832918.614024000" }, { "kind": "dns", "dst_ip": "10.0.0.10", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.beguilesoft.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": 53, "event_id": "evt-65fb6d40be1bc20b0bbdf30a", "src_port": 59407, "tcp_stream": null, "udp_stream": 5, "frame_number": 79, "timestamp_epoch": "1556832918.803460000" }, { "kind": "dns", "dst_ip": "10.0.0.227", "fields": { "dns.a": "10.0.0.10", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.beguilesoft.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.0.10", "dst_port": 59407, "event_id": "evt-91c949a22313dc3bd37b1f37", "src_port": 53, "tcp_stream": null, "udp_stream": 5, "frame_number": 80, "timestamp_epoch": "1556832918.803720000" }, { "kind": "dns", "dst_ip": "10.0.0.10", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.beguilesoft.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": 53, "event_id": "evt-0804cbddd64cc3cf257f14b4", "src_port": 62718, "tcp_stream": null, "udp_stream": 7, "frame_number": 117, "timestamp_epoch": "1556832918.886742000" }, { "kind": "dns", "dst_ip": "10.0.0.227", "fields": { "dns.a": "10.0.0.10", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.beguilesoft.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.0.10", "dst_port": 62718, "event_id": "evt-cb7fb0e30a310bae114e5559", "src_port": 53, "tcp_stream": null, "udp_stream": 7, "frame_number": 118, "timestamp_epoch": "1556832918.886980000" }, { "kind": "dns", "dst_ip": "10.0.0.10", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.beguilesoft.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": 53, "event_id": "evt-7bbaaab3945aa9c3b88c4ed2", "src_port": 59277, "tcp_stream": null, "udp_stream": 9, "frame_number": 153, "timestamp_epoch": "1556832918.910299000" }, { "kind": "dns", "dst_ip": "10.0.0.227", "fields": { "dns.a": "10.0.0.10", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.beguilesoft.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.0.10", "dst_port": 59277, "event_id": "evt-c6245f71136d4eda49e8b465", "src_port": 53, "tcp_stream": null, "udp_stream": 9, "frame_number": 154, "timestamp_epoch": "1556832918.910589000" }, { "kind": "dns", "dst_ip": "10.0.0.10", "fields": { "dns.qry.name": "wpad.beguilesoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": 53, "event_id": "evt-73fe109bd7c217622e4a2180", "src_port": 54339, "tcp_stream": null, "udp_stream": 14, "frame_number": 229, "timestamp_epoch": "1556832921.197758000" }, { "kind": "dns", "dst_ip": "10.0.0.227", "fields": { "dns.qry.name": "wpad.beguilesoft.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.0.10", "dst_port": 54339, "event_id": "evt-6f27688d8b2709fd6b8de105", "src_port": 53, "tcp_stream": null, "udp_stream": 14, "frame_number": 230, "timestamp_epoch": "1556832921.198017000" }, { "kind": "dns", "dst_ip": "10.0.0.10", "fields": { "dns.qry.name": "BeguileSoft-DC.beguilesoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": 53, "event_id": "evt-09de0389619300093c7bb692", "src_port": 53008, "tcp_stream": null, "udp_stream": 16, "frame_number": 237, "timestamp_epoch": "1556832922.070554000" }, { "kind": "dns", "dst_ip": "10.0.0.227", "fields": { "dns.a": "10.0.0.10", "dns.qry.name": "BeguileSoft-DC.beguilesoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.0.10", "dst_port": 53008, "event_id": "evt-4b615d1bbb139b1145e47957", "src_port": 53, "tcp_stream": null, "udp_stream": 16, "frame_number": 238, "timestamp_epoch": "1556832922.070887000" }, { "kind": "dns", "dst_ip": "10.0.0.10", "fields": { "dns.qry.name": "isatap.beguilesoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": 53, "event_id": "evt-909dfbf981cca2c7896604f6", "src_port": 52682, "tcp_stream": null, "udp_stream": 17, "frame_number": 239, "timestamp_epoch": "1556832922.070903000" }, { "kind": "dns", "dst_ip": "10.0.0.227", "fields": { "dns.qry.name": "isatap.beguilesoft.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.0.10", "dst_port": 52682, "event_id": "evt-7d69515c15dab99a8d105de7", "src_port": 53, "tcp_stream": null, "udp_stream": 17, "frame_number": 240, "timestamp_epoch": "1556832922.071030000" }, { "kind": "dns", "dst_ip": "10.0.0.10", "fields": { "dns.qry.name": "isatap.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": 53, "event_id": "evt-bb130b7015fff75ffc896212", "src_port": 62720, "tcp_stream": null, "udp_stream": 19, "frame_number": 279, "timestamp_epoch": "1556832923.858883000" }, { "kind": "dns", "dst_ip": "10.0.0.227", "fields": { "dns.qry.name": "isatap.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.0.10", "dst_port": 62720, "event_id": "evt-b15703e5d41c93790842a0a5", "src_port": 53, "tcp_stream": null, "udp_stream": 19, "frame_number": 280, "timestamp_epoch": "1556832923.882075000" }, { "kind": "dns", "dst_ip": "10.0.0.10", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.BeguileSoft-DC.beguilesoft.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": 53, "event_id": "evt-b86538e16ff312fc399fef5c", "src_port": 56348, "tcp_stream": null, "udp_stream": 20, "frame_number": 284, "timestamp_epoch": "1556832924.375390000" }, { "kind": "dns", "dst_ip": "10.0.0.227", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.BeguileSoft-DC.beguilesoft.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.0.10", "dst_port": 56348, "event_id": "evt-7e161aae14591226f247f908", "src_port": 53, "tcp_stream": null, "udp_stream": 20, "frame_number": 285, "timestamp_epoch": "1556832924.375724000" }, { "kind": "dns", "dst_ip": "10.0.0.10", "fields": { "dns.qry.name": "_ldap._tcp.BeguileSoft-DC.beguilesoft.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": 53, "event_id": "evt-03a0da5b5b3d4abdc9dba57e", "src_port": 63630, "tcp_stream": null, "udp_stream": 21, "frame_number": 286, "timestamp_epoch": "1556832924.376100000" }, { "kind": "dns", "dst_ip": "10.0.0.227", "fields": { "dns.qry.name": "_ldap._tcp.BeguileSoft-DC.beguilesoft.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.0.0.10", "dst_port": 63630, "event_id": "evt-6aead45a033aca43955ca3db", "src_port": 53, "tcp_stream": null, "udp_stream": 21, "frame_number": 287, "timestamp_epoch": "1556832924.376390000" }, { "kind": "dns", "dst_ip": "10.0.0.10", "fields": { "dns.qry.name": "www.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": 53, "event_id": "evt-85bc6aeff3402cf469254d66", "src_port": 57454, "tcp_stream": null, "udp_stream": 22, "frame_number": 405, "timestamp_epoch": "1556832926.060635000" }, { "kind": "dns", "dst_ip": "10.0.0.10", "fields": { "dns.qry.name": "Breaux-Win7-PC.beguilesoft.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": 53, "event_id": "evt-7f808b7dd389d493e73e6ae9", "src_port": 57320, "tcp_stream": null, "udp_stream": 23, "frame_number": 406, "timestamp_epoch": "1556832926.199445000" }, { "kind": "dns", "dst_ip": "10.0.0.227", "fields": { "dns.a": "10.0.0.10", "dns.qry.name": "Breaux-Win7-PC.beguilesoft.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.0.10", "dst_port": 57320, "event_id": "evt-51dcfdeb2cccb79c5c9ca0fe", "src_port": 53, "tcp_stream": null, "udp_stream": 23, "frame_number": 407, "timestamp_epoch": "1556832926.199805000" }, { "kind": "dns", "dst_ip": "10.0.0.10", "fields": { "dns.a": "10.0.0.227", "dns.qry.name": "beguilesoft.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": 53, "event_id": "evt-7192e4d7087cdb675e72eac1", "src_port": 63924, "tcp_stream": null, "udp_stream": 24, "frame_number": 408, "timestamp_epoch": "1556832926.201223000" }, { "kind": "dns", "dst_ip": "10.0.0.227", "fields": { "dns.a": "10.0.0.227", "dns.qry.name": "beguilesoft.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.0.10", "dst_port": 63924, "event_id": "evt-cd3aec13b245060d735b778e", "src_port": 53, "tcp_stream": null, "udp_stream": 24, "frame_number": 409, "timestamp_epoch": "1556832926.202480000" }, { "kind": "dns", "dst_ip": "10.0.0.227", "fields": { "dns.a": "204.2.193.137,204.2.193.138", "dns.cname": "www.msftncsi.com.edgesuite.net,a1961.g2.akamai.net", "dns.qry.name": "www.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.0.10", "dst_port": 57454, "event_id": "evt-b7c77ed3d8b13905e0c629e0", "src_port": 53, "tcp_stream": null, "udp_stream": 22, "frame_number": 410, "timestamp_epoch": "1556832926.230910000" }, { "kind": "dns", "dst_ip": "10.0.0.10", "fields": { "dns.qry.name": "whatismyipaddress.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": 53, "event_id": "evt-ed2617b79b5e6c8ec8d695c1", "src_port": 55103, "tcp_stream": null, "udp_stream": 26, "frame_number": 689, "timestamp_epoch": "1556832974.687459000" }, { "kind": "dns", "dst_ip": "10.0.0.227", "fields": { "dns.a": "104.16.154.36,104.16.155.36", "dns.qry.name": "whatismyipaddress.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.0.10", "dst_port": 55103, "event_id": "evt-2b245b822ab1d0fce691ef03", "src_port": 53, "tcp_stream": null, "udp_stream": 26, "frame_number": 690, "timestamp_epoch": "1556832974.729338000" }, { "kind": "dns", "dst_ip": "10.0.0.10", "fields": { "dns.qry.name": "files.000webhost.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": 53, "event_id": "evt-5a2d553a7e383b97bd0a1607", "src_port": 60835, "tcp_stream": null, "udp_stream": 27, "frame_number": 710, "timestamp_epoch": "1556832993.701960000" }, { "kind": "dns", "dst_ip": "10.0.0.227", "fields": { "dns.a": "145.14.145.4", "dns.cname": "us-east-1.route-1000.000webhost.awex.io", "dns.qry.name": "files.000webhost.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.0.10", "dst_port": 60835, "event_id": "evt-20f07d06bfbc7ee2262be7bb", "src_port": 53, "tcp_stream": null, "udp_stream": 27, "frame_number": 711, "timestamp_epoch": "1556832993.781309000" }, { "kind": "dns", "dst_ip": "10.0.0.10", "fields": { "dns.qry.name": "files.000webhost.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": 53, "event_id": "evt-352d2d9cb0c0db26b92207ae", "src_port": 53832, "tcp_stream": null, "udp_stream": 29, "frame_number": 818, "timestamp_epoch": "1556833274.997255000" }, { "kind": "dns", "dst_ip": "10.0.0.10", "fields": { "dns.qry.name": "files.000webhost.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": 53, "event_id": "evt-4bd0989c6831ef17f083d7b5", "src_port": 53832, "tcp_stream": null, "udp_stream": 29, "frame_number": 819, "timestamp_epoch": "1556833276.007839000" }, { "kind": "dns", "dst_ip": "10.0.0.10", "fields": { "dns.qry.name": "files.000webhost.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": 53, "event_id": "evt-363bcaad5443940582f352bf", "src_port": 53832, "tcp_stream": null, "udp_stream": 29, "frame_number": 820, "timestamp_epoch": "1556833277.022496000" }, { "kind": "dns", "dst_ip": "10.0.0.10", "fields": { "dns.qry.name": "files.000webhost.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": 53, "event_id": "evt-46d5943630c60cc3d13c4f2e", "src_port": 53832, "tcp_stream": null, "udp_stream": 29, "frame_number": 821, "timestamp_epoch": "1556833279.034526000" }, { "kind": "dns", "dst_ip": "10.0.0.10", "fields": { "dns.qry.name": "files.000webhost.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": 53, "event_id": "evt-34bc98c349d917140fe49194", "src_port": 53832, "tcp_stream": null, "udp_stream": 29, "frame_number": 822, "timestamp_epoch": "1556833283.044125000" }, { "kind": "dns", "dst_ip": "10.0.0.227", "fields": { "dns.cname": "us-east-1.route-1000.000webhost.awex.io", "dns.qry.name": "files.000webhost.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.0.10", "dst_port": 53832, "event_id": "evt-5d5818a5d56a2bdb5d82b9ee", "src_port": 53, "tcp_stream": null, "udp_stream": 29, "frame_number": 823, "timestamp_epoch": "1556833287.107989000" }, { "kind": "dns", "dst_ip": "10.0.0.10", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": 53, "event_id": "evt-013fd5c3950126d999dace9d", "src_port": 59173, "tcp_stream": null, "udp_stream": 30, "frame_number": 824, "timestamp_epoch": "1556833288.302420000" }, { "kind": "dns", "dst_ip": "10.0.0.227", "fields": { "dns.a": "131.107.255.255", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.0.10", "dst_port": 59173, "event_id": "evt-8d2c3cd1ef94cf772c8e2b85", "src_port": 53, "tcp_stream": null, "udp_stream": 30, "frame_number": 825, "timestamp_epoch": "1556833288.329591000" }, { "kind": "dns", "dst_ip": "10.0.0.10", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": 53, "event_id": "evt-771a620635938edbfaf4e232", "src_port": 59977, "tcp_stream": null, "udp_stream": 31, "frame_number": 826, "timestamp_epoch": "1556833288.330117000" }, { "kind": "dns", "dst_ip": "10.0.0.227", "fields": { "dns.aaaa": "fd3e:4f5a:5b81::1", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "28", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.0.10", "dst_port": 59977, "event_id": "evt-5eb23767c345205e69891cf2", "src_port": 53, "tcp_stream": null, "udp_stream": 31, "frame_number": 827, "timestamp_epoch": "1556833288.330376000" }, { "kind": "dns", "dst_ip": "10.0.0.10", "fields": { "dns.qry.name": "files.000webhost.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": 53, "event_id": "evt-d04fc43206fd56931828b977", "src_port": 56260, "tcp_stream": null, "udp_stream": 32, "frame_number": 834, "timestamp_epoch": "1556833587.071526000" }, { "kind": "dns", "dst_ip": "10.0.0.227", "fields": { "dns.a": "145.14.144.10", "dns.cname": "us-east-1.route-1000.000webhost.awex.io", "dns.qry.name": "files.000webhost.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.0.10", "dst_port": 56260, "event_id": "evt-3baeae616282bd1b50655817", "src_port": 53, "tcp_stream": null, "udp_stream": 32, "frame_number": 835, "timestamp_epoch": "1556833587.155224000" }, { "kind": "dns", "dst_ip": "10.0.0.10", "fields": { "dns.qry.name": "files.000webhost.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": 53, "event_id": "evt-9fcf1ae873cd0bda7167a294", "src_port": 51646, "tcp_stream": null, "udp_stream": 33, "frame_number": 5254, "timestamp_epoch": "1556834493.030295000" }, { "kind": "dns", "dst_ip": "10.0.0.227", "fields": { "dns.a": "145.14.145.99", "dns.cname": "us-east-1.route-1000.000webhost.awex.io", "dns.qry.name": "files.000webhost.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.0.0.10", "dst_port": 51646, "event_id": "evt-8a68771d5291f41ae2b5eb1a", "src_port": 53, "tcp_stream": null, "udp_stream": 33, "frame_number": 5255, "timestamp_epoch": "1556834493.173728000" } ], "dhcp": [ { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "84:8f:69:09:86:c0", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "84:8f:69:09:86:c0,84:8f:69:09:86:c0", "dhcp.option.dhcp": "8", "dhcp.option.hostname": "Breaux-Win7-PC" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-653d0551c7a2fd7f1e4d0ca0", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 227, "timestamp_epoch": "1556832921.193470000" }, { "kind": "dhcp", "dst_ip": "10.0.0.227", "fields": { "eth.src": "a4:1f:72:c2:09:6a", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "84:8f:69:09:86:c0", "dhcp.option.dhcp": "5" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-17811e33431a9719b88ecade", "src_port": null, "tcp_stream": null, "udp_stream": 13, "frame_number": 228, "timestamp_epoch": "1556832921.193897000" } ], "smtp": [], "identity": [ { "kind": "identity", "dst_ip": "10.0.0.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "84:8f:69:09:86:c0", "nbns.name": "BREAUX-WIN7-PC<00>,BREAUX-WIN7-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-8c200022ed063c5e5f4d3ff9", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1, "timestamp_epoch": "1556832918.583678000" }, { "kind": "identity", "dst_ip": "10.0.0.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "84:8f:69:09:86:c0", "nbns.name": "BEGUILESOFT<00>,BEGUILESOFT<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-77c611bd2b66301f6e96c39e", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2, "timestamp_epoch": "1556832918.583928000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "10", "kerberos.CNameString": "breaux-win7-pc$" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-c651c69742b30c62ea8d1237", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 44, "timestamp_epoch": "1556832918.772283000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-c2bbe02e77f126d5aadafc7c", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 45, "timestamp_epoch": "1556832918.772738000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "10", "kerberos.CNameString": "breaux-win7-pc$" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-c629dbb397b510349b808d2b", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 52, "timestamp_epoch": "1556832918.792260000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "BREAUX-WIN7-PC$" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-6f97c449128ac505f547ba58", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 54, "timestamp_epoch": "1556832918.793223000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-de29940e41fb07f4df2cd072", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 63, "timestamp_epoch": "1556832918.796297000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "BREAUX-WIN7-PC$" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-d62f3063ea8067ff7e9aa70e", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 66, "timestamp_epoch": "1556832918.796909000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-cf2d070c3a96944ccbbe6680", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 72, "timestamp_epoch": "1556832918.797611000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-b3eca4c408e44dfe1779e73e", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 74, "timestamp_epoch": "1556832918.798207000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-5a85144812b36ac7cdb1a1ad", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 87, "timestamp_epoch": "1556832918.850904000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-d212383d3642001353134df6", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 88, "timestamp_epoch": "1556832918.851624000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-203a310b49d797e9a4f7a530", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 89, "timestamp_epoch": "1556832918.851851000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "10", "kerberos.CNameString": "breaux-win7-pc$" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-ba6921cdbbfbc9b6cca478bc", "src_port": null, "tcp_stream": 7, "udp_stream": null, "frame_number": 93, "timestamp_epoch": "1556832918.857282000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-d2755637b419e79eaf65134e", "src_port": null, "tcp_stream": 7, "udp_stream": null, "frame_number": 94, "timestamp_epoch": "1556832918.857825000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "10", "kerberos.CNameString": "breaux-win7-pc$" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-4fafcefe8f5c2c55c70fac6d", "src_port": null, "tcp_stream": 8, "udp_stream": null, "frame_number": 101, "timestamp_epoch": "1556832918.879306000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "BREAUX-WIN7-PC$" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-9a90671f39b2ee76ca800551", "src_port": null, "tcp_stream": 8, "udp_stream": null, "frame_number": 103, "timestamp_epoch": "1556832918.880187000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-564f67ce5b0878ff5c58e2c6", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 112, "timestamp_epoch": "1556832918.884189000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "BREAUX-WIN7-PC$" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-9f63b1308001654e07ba527f", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 115, "timestamp_epoch": "1556832918.885234000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-a705ba917fe0d590f4e26963", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 126, "timestamp_epoch": "1556832918.888331000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "BREAUX-WIN7-PC$" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-7667597da6b5808171684e2b", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 129, "timestamp_epoch": "1556832918.888767000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-05d2ecebcc93e0ea3adc1014", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 139, "timestamp_epoch": "1556832918.891113000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-5276ad1285d1ee78a7f122f9", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 140, "timestamp_epoch": "1556832918.892328000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-7f2fdea0d2d12d8fe5ce5cdb", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 141, "timestamp_epoch": "1556832918.894977000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-e7053c4060b4936be4533b0d", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 142, "timestamp_epoch": "1556832918.895181000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-8bc294aab1c87381d5dd8ec4", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 143, "timestamp_epoch": "1556832918.902022000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-b9126a9c3ef7d071926eefa5", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 144, "timestamp_epoch": "1556832918.902418000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-e95db6beed0a308dcce67efe", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 170, "timestamp_epoch": "1556832918.995708000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "BREAUX-WIN7-PC$" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-9479394ccf967da865bc97bc", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 173, "timestamp_epoch": "1556832918.996486000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-a8e879c5a22fa8acb9333bfa", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 179, "timestamp_epoch": "1556832918.997775000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-b8e27137b320e08b6f4dc961", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 181, "timestamp_epoch": "1556832918.998508000" }, { "kind": "identity", "dst_ip": "10.0.0.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "84:8f:69:09:86:c0", "nbns.name": "BREAUX-WIN7-PC<20>,BREAUX-WIN7-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-e18f0e74d0018e65f970000d", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 214, "timestamp_epoch": "1556832919.068636000" }, { "kind": "identity", "dst_ip": "10.0.0.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "84:8f:69:09:86:c0", "nbns.name": "BEGUILESOFT<00>,BEGUILESOFT<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-3aa626212aa48a94c0941af9", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 216, "timestamp_epoch": "1556832919.333391000" }, { "kind": "identity", "dst_ip": "10.0.0.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "84:8f:69:09:86:c0", "nbns.name": "BREAUX-WIN7-PC<00>,BREAUX-WIN7-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-f15155a29c8e87284b8a640a", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 217, "timestamp_epoch": "1556832919.333528000" }, { "kind": "identity", "dst_ip": "10.0.0.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "84:8f:69:09:86:c0", "nbns.name": "BREAUX-WIN7-PC<20>,BREAUX-WIN7-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-d4176849222d91d5e347c570", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 218, "timestamp_epoch": "1556832919.813626000" }, { "kind": "identity", "dst_ip": "10.0.0.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "84:8f:69:09:86:c0", "nbns.name": "BEGUILESOFT<00>,BEGUILESOFT<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-6cccce5cbae64a4ee576b813", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 219, "timestamp_epoch": "1556832920.083306000" }, { "kind": "identity", "dst_ip": "10.0.0.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "84:8f:69:09:86:c0", "nbns.name": "BREAUX-WIN7-PC<00>,BREAUX-WIN7-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-3e5707c2bbc81bd888fef75d", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 220, "timestamp_epoch": "1556832920.083437000" }, { "kind": "identity", "dst_ip": "10.0.0.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "84:8f:69:09:86:c0", "nbns.name": "BREAUX-WIN7-PC<20>,BREAUX-WIN7-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-dd55841760d732e4c20c77eb", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 221, "timestamp_epoch": "1556832920.563392000" }, { "kind": "identity", "dst_ip": "10.0.0.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "84:8f:69:09:86:c0", "nbns.name": "BREAUX-WIN7-PC<00>,BREAUX-WIN7-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-7e659770fa18650101b89ce0", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 222, "timestamp_epoch": "1556832920.833324000" }, { "kind": "identity", "dst_ip": "10.0.0.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "84:8f:69:09:86:c0", "nbns.name": "BEGUILESOFT<00>,BEGUILESOFT<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-503ca9c2ff09526817574594", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 223, "timestamp_epoch": "1556832920.833469000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "84:8f:69:09:86:c0", "dns.qry.name": "Breaux-Win7-PC" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-e1a56034d549a1066ce630e1", "src_port": null, "tcp_stream": null, "udp_stream": 11, "frame_number": 226, "timestamp_epoch": "1556832921.188271000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "84:8f:69:09:86:c0", "dns.qry.name": "wpad" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-78ec8bffba4fc88b3d11219c", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 231, "timestamp_epoch": "1556832921.198507000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "84:8f:69:09:86:c0", "dns.qry.name": "Breaux-Win7-PC" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-c451bc2c9fe0180101284a3b", "src_port": null, "tcp_stream": null, "udp_stream": 11, "frame_number": 232, "timestamp_epoch": "1556832921.283914000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "84:8f:69:09:86:c0", "dns.qry.name": "wpad" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-f2b7307cbf835d3b762376e4", "src_port": null, "tcp_stream": null, "udp_stream": 15, "frame_number": 233, "timestamp_epoch": "1556832921.293654000" }, { "kind": "identity", "dst_ip": "10.0.0.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "84:8f:69:09:86:c0", "nbns.name": "BREAUX-WIN7-PC<20>,BREAUX-WIN7-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-5d62bb54e0fb8374cca9a36e", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 234, "timestamp_epoch": "1556832921.313871000" }, { "kind": "identity", "dst_ip": "10.0.0.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "84:8f:69:09:86:c0", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-4ad2e9d01e6f1dbbd16675b7", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 235, "timestamp_epoch": "1556832921.493767000" }, { "kind": "identity", "dst_ip": "10.0.0.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "84:8f:69:09:86:c0", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-4c791843162b9abe488521ce", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 241, "timestamp_epoch": "1556832922.243421000" }, { "kind": "identity", "dst_ip": "10.0.0.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "84:8f:69:09:86:c0", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-1d25514a81499700e53c74c2", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 242, "timestamp_epoch": "1556832922.994403000" }, { "kind": "identity", "dst_ip": "10.0.0.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "84:8f:69:09:86:c0", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-e13b0f5d939549563deb8fe7", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 245, "timestamp_epoch": "1556832923.768800000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-5a0a2ff85c5c076faa2eab4e", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 246, "timestamp_epoch": "1556832923.771476000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-4259bee75713d2c674c5b9b2", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 247, "timestamp_epoch": "1556832923.771858000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-5b841ecd190495f8382831b8", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 257, "timestamp_epoch": "1556832923.774507000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "BREAUX-WIN7-PC$" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-26b775b8af88261925a5c025", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 260, "timestamp_epoch": "1556832923.775288000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-fe56ee028e803da12b16dc25", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 266, "timestamp_epoch": "1556832923.775938000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-f1b3b2fe8fb38e35342be977", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 268, "timestamp_epoch": "1556832923.776420000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "15" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-00f5b41d59c7fb5b9215e66e", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 269, "timestamp_epoch": "1556832923.776862000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-ff740daa0a3b39679b209df2", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 296, "timestamp_epoch": "1556832924.380000000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-2d23ba61f96d8cd8ba980e1d", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 298, "timestamp_epoch": "1556832924.381552000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-f74a25f3655584ac185601e9", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 303, "timestamp_epoch": "1556832924.387829000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "BREAUX-WIN7-PC$" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-3c86c6952a0448f6c113f69b", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 306, "timestamp_epoch": "1556832924.389040000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-44e911e3c19566d036aa9ff1", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 317, "timestamp_epoch": "1556832924.394075000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-73369b6cdf77e5c4f222b038", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 319, "timestamp_epoch": "1556832924.394659000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-969721491f83c20dc523c1d3", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 329, "timestamp_epoch": "1556832924.399589000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-c775a7fb921e5f7f60fafa86", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 330, "timestamp_epoch": "1556832924.399840000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-f4066945706770bf7f07bbb1", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 335, "timestamp_epoch": "1556832924.400656000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "BREAUX-WIN7-PC$" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-f66247f975c8e6881e43bf7c", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 338, "timestamp_epoch": "1556832924.401375000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-6f0cf78d974202862a1bde04", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 347, "timestamp_epoch": "1556832924.402084000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "BREAUX-WIN7-PC$" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-44162d331e8dedf00be27968", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 350, "timestamp_epoch": "1556832924.402531000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-f15113d027544c2e8a6acd2b", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 358, "timestamp_epoch": "1556832924.403190000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-37123289f9b71f87bc2e3b47", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 361, "timestamp_epoch": "1556832924.403910000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-958e56de544f09050485f48e", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 364, "timestamp_epoch": "1556832924.404078000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-e886fac84f43995fe4385f00", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 366, "timestamp_epoch": "1556832924.404431000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "BREAUX-WIN7-PC$" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-27c7cc361ef58a648b85b206", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 368, "timestamp_epoch": "1556832924.404733000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-2b9c0f0b2ab1b2029110d40a", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 369, "timestamp_epoch": "1556832924.404831000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-f9730afe6d60fc22aeb14734", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 375, "timestamp_epoch": "1556832924.405460000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-a8ab03324f76fffb4818bf53", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 379, "timestamp_epoch": "1556832924.405790000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-fd21aadb106eeecc197cc508", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 381, "timestamp_epoch": "1556832924.406478000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-f3319cd346c73ac4a6cc673d", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 385, "timestamp_epoch": "1556832924.408422000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-6e3361247d785e341a7b2758", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 386, "timestamp_epoch": "1556832924.408889000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-cbab23f7b9fc174699395bb1", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 387, "timestamp_epoch": "1556832924.409246000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-839f019b385380fd134c6978", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 388, "timestamp_epoch": "1556832924.409621000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-248d80c83dd81914ac409257", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 389, "timestamp_epoch": "1556832924.409852000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-9c064f47317abc8f45f9aa9c", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 390, "timestamp_epoch": "1556832924.411081000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-1423ea3deecae72ee95b6ad2", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 391, "timestamp_epoch": "1556832924.411608000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-5ffdd233629d85340ed752d5", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 392, "timestamp_epoch": "1556832924.412000000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-90f54d684734e7e74e2fa664", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 393, "timestamp_epoch": "1556832924.412192000" }, { "kind": "identity", "dst_ip": "10.0.0.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "84:8f:69:09:86:c0", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-fa6dfabfe7d808f3298d235a", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 397, "timestamp_epoch": "1556832924.529891000" }, { "kind": "identity", "dst_ip": "10.0.0.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "84:8f:69:09:86:c0", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-aae11304c3df8c9cd1561562", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 404, "timestamp_epoch": "1556832925.293163000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-63a1153e47e128bd7b36382e", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 428, "timestamp_epoch": "1556832929.459863000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-b6589d0b57372f7f3a2104c4", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 430, "timestamp_epoch": "1556832929.460670000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-20fff5f16f59e6764b7ee889", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 443, "timestamp_epoch": "1556832929.474672000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-c4b80c3764f2c85411452268", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 445, "timestamp_epoch": "1556832929.475315000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "10", "kerberos.CNameString": "BREAUX-WIN7-PC$" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-bfa20af69234b99273844e82", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 451, "timestamp_epoch": "1556832929.479084000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-1ba6e3ddcb477e5c8155a898", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 452, "timestamp_epoch": "1556832929.480143000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "10", "kerberos.CNameString": "BREAUX-WIN7-PC$" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-9932f2b56f495ac0e4f441ba", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 459, "timestamp_epoch": "1556832929.498359000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "BREAUX-WIN7-PC$" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-9259e156d3d1338509b0162e", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 461, "timestamp_epoch": "1556832929.499027000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-1d90ca6b3b2cbcf45f105c6f", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 470, "timestamp_epoch": "1556832929.500629000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "BREAUX-WIN7-PC$" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-3fa5da72b4d0a17e48b2aaf3", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 473, "timestamp_epoch": "1556832929.501313000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-7896b8bbdf108919ce53a71e", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 484, "timestamp_epoch": "1556832935.308185000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-6e49ef0eccd0f52ad9d50680", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 485, "timestamp_epoch": "1556832935.308415000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-5312a98513ffe7e4a7c50ffa", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 486, "timestamp_epoch": "1556832935.308574000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-427c6fc5b9997331c6ae8d77", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 487, "timestamp_epoch": "1556832935.308685000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-83366eb39ec2c20c0d6438b9", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 488, "timestamp_epoch": "1556832935.308888000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-f748423a79b5a95b3f0280b4", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 490, "timestamp_epoch": "1556832935.309041000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-d2631c70d8edd49763c071e6", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 500, "timestamp_epoch": "1556832947.305287000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-b8b5ed4136585b1fc641fe3e", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 501, "timestamp_epoch": "1556832947.305613000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-8252593983d60e34ebffc2ae", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 505, "timestamp_epoch": "1556832959.302108000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-b75f912f0ef0d9ffd76e85a9", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 506, "timestamp_epoch": "1556832959.302321000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-c7ac21761b8dcb812ebfa0ec", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 507, "timestamp_epoch": "1556832959.302502000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-7e1684b4cccd60e944accd2c", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 508, "timestamp_epoch": "1556832959.302630000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "10", "kerberos.CNameString": "adriana.breaux" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-e05e719421d8e55b42e0e6f0", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 517, "timestamp_epoch": "1556832968.928116000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-03bf9b25995a6f8d57299e28", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 518, "timestamp_epoch": "1556832968.929014000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "10", "kerberos.CNameString": "adriana.breaux" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-3d43c002a547619fc2b1c90d", "src_port": null, "tcp_stream": 35, "udp_stream": null, "frame_number": 525, "timestamp_epoch": "1556832968.940548000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "adriana.breaux" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-2441d14c00711502e7755280", "src_port": null, "tcp_stream": 35, "udp_stream": null, "frame_number": 527, "timestamp_epoch": "1556832968.941319000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-1d2cd2899b4c534790797006", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 536, "timestamp_epoch": "1556832968.942730000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "adriana.breaux" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-153d8508512c41430a0ea3cb", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 539, "timestamp_epoch": "1556832968.943388000" }, { "kind": "identity", "dst_ip": "10.0.0.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "84:8f:69:09:86:c0", "nbns.name": "BEGUILESOFT-DC<20>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-79afe4d8a9aa3d2b11fc9340", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 550, "timestamp_epoch": "1556832971.001741000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "nbns.name": "BEGUILESOFT-DC<20> (Server service)", "nbns.flags.opcode": "0", "nbns.flags.response": "True", "nbns.nb_flags.group": "False" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-09fd3b8ad2987e1563e9660f", "src_port": null, "tcp_stream": null, "udp_stream": 25, "frame_number": 551, "timestamp_epoch": "1556832971.002052000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-3fb8277d57decfeaba3e5ad4", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 557, "timestamp_epoch": "1556832971.003203000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-238249ae6e94add6ef19b365", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 558, "timestamp_epoch": "1556832971.003345000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-bf5c87c69ce58c6d36910c8c", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 559, "timestamp_epoch": "1556832971.003516000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-2e0c5826d6b66f96085f123b", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 564, "timestamp_epoch": "1556832971.004948000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "adriana.breaux" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-27fa365c114a95559fbe2710", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 567, "timestamp_epoch": "1556832971.006336000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-c6daef43b5fbe9fd0327fdde", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 576, "timestamp_epoch": "1556832971.007319000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "adriana.breaux" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-f292f00f115761ecbd7db3e9", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 579, "timestamp_epoch": "1556832971.007693000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-8a6d775f2cac932be936a499", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 588, "timestamp_epoch": "1556832971.008582000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-600c95829d58162b41e546ee", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 589, "timestamp_epoch": "1556832971.009096000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-eea8b85ee5e46188a1cdc679", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 590, "timestamp_epoch": "1556832971.009429000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-e01a68eed1f726ded3d88dfc", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 591, "timestamp_epoch": "1556832971.009566000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-a8a7e93f04685c35d6ccfd48", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 592, "timestamp_epoch": "1556832971.009841000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-7f807d379d05df3f52a4c14d", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 593, "timestamp_epoch": "1556832971.115526000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-6000cf1533d44ba1b3b7d445", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 594, "timestamp_epoch": "1556832971.119317000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-ed4a39455430f48c5cead598", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 595, "timestamp_epoch": "1556832971.119525000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-77758f2d7be44ac8bee92647", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 606, "timestamp_epoch": "1556832972.375827000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "adriana.breaux" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-56197863f359549730c44fd6", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 609, "timestamp_epoch": "1556832972.376867000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-395484fb8966cbd3785840f3", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 615, "timestamp_epoch": "1556832972.377578000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-bd77ec9843d7761f26e3e0fa", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 617, "timestamp_epoch": "1556832972.378167000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "15" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-964923c29476eac4732255ac", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 618, "timestamp_epoch": "1556832972.378547000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "12,14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-cdef0b31f973109bf92d4cce", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 637, "timestamp_epoch": "1556832972.965820000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "adriana.breaux" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-11df863b036e4544a5d2587b", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 640, "timestamp_epoch": "1556832972.966909000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-35de430a5fd44527996f4ec7", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 646, "timestamp_epoch": "1556832972.969514000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-28195fac3f53e2e5a4ecb9ea", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 648, "timestamp_epoch": "1556832972.970874000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-ddb77ab3cf1f0aeeb2507d6a", "src_port": null, "tcp_stream": 47, "udp_stream": null, "frame_number": 655, "timestamp_epoch": "1556832972.981122000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-76bf84c65591efb149a8c31a", "src_port": null, "tcp_stream": 47, "udp_stream": null, "frame_number": 657, "timestamp_epoch": "1556832972.981863000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-8b86e46d6447daa00e0a49f7", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 667, "timestamp_epoch": "1556832973.188879000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-2afe325246b4c4d7c11b012a", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 668, "timestamp_epoch": "1556832973.189226000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-64e4e12322bba0349a54fc84", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 672, "timestamp_epoch": "1556832973.192701000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-92f740c91349209c998d823b", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 673, "timestamp_epoch": "1556832973.193327000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-8eee2b9f9183bf302ec20851", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 674, "timestamp_epoch": "1556832973.195530000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-aaaed4cd0d268eefe442fe40", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 675, "timestamp_epoch": "1556832973.195698000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-75d9f7aff7a9ad0b86a1f570", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 676, "timestamp_epoch": "1556832973.195990000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-b5153e1368b080c0396a406c", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 677, "timestamp_epoch": "1556832973.196318000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-8e6d687a4fef1ac3285a05b4", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 678, "timestamp_epoch": "1556832973.196632000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-eab397f62866930844daf51d", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 679, "timestamp_epoch": "1556832973.196778000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-8ba28c8e3fc0079f69cc637b", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 702, "timestamp_epoch": "1556832983.304840000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-784663b05db8cbbdde4f072c", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 703, "timestamp_epoch": "1556832983.305036000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-66d0a8d43680042a2a065991", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 736, "timestamp_epoch": "1556832995.301465000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-e0460f5bb5a5ce57e2e01fb3", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 737, "timestamp_epoch": "1556832995.301715000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-80fa3bbdff748b63a58abbd3", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 769, "timestamp_epoch": "1556833007.314486000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-e56c75405ceefa7e9bc27540", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 770, "timestamp_epoch": "1556833007.314682000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-56480ec6b350acfc2fae5ca9", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 771, "timestamp_epoch": "1556833007.314841000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-2048dea5e41100b7c96e21e6", "src_port": null, "tcp_stream": 48, "udp_stream": null, "frame_number": 772, "timestamp_epoch": "1556833007.314993000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-3a0e7a18428ca5ccebe6e0c4", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 5210, "timestamp_epoch": "1556833719.753458000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-b94b418388d526793eaf9a93", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 5211, "timestamp_epoch": "1556833719.753693000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-65e8bfc741a9ce2c1eaceaa7", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 5212, "timestamp_epoch": "1556833719.754069000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-46acebd2f20b60640ef21bd5", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 5213, "timestamp_epoch": "1556833719.854649000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-652b56bac09a73037b9d6680", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 5215, "timestamp_epoch": "1556833733.303688000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-db912455edab7a011e8147b8", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 5216, "timestamp_epoch": "1556833733.303974000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-dac16c894970f3e15766f2ae", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 5222, "timestamp_epoch": "1556833823.787734000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-75f842d46e0b4cae30248e9f", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 5223, "timestamp_epoch": "1556833823.787852000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-34fbd627649bff27a017bf40", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 5224, "timestamp_epoch": "1556833823.788047000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-155bc162e03a95c6156e29fb", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 5228, "timestamp_epoch": "1556833823.789173000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-c5d5111e64743a8c16bbbe36", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 5229, "timestamp_epoch": "1556833823.789960000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-e46fdaedaaecff3886818c4e", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 5230, "timestamp_epoch": "1556833823.790335000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-89703d001a2de6cd3774caef", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 5231, "timestamp_epoch": "1556833823.790462000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-a44fab1942eeb11a9d4a41f4", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 5232, "timestamp_epoch": "1556833823.790818000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-dc7d0238c24ccfe30e9b6e62", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 5233, "timestamp_epoch": "1556833823.791138000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-135f3b03f423b11f41d3f13f", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 5235, "timestamp_epoch": "1556833835.303991000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-319a2c98b1b344069093c19b", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 5236, "timestamp_epoch": "1556833835.304297000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-e50b93cd6c1f5c495c6a6aa0", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 5237, "timestamp_epoch": "1556833835.304504000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-b71b8985829ed909d2c93a65", "src_port": null, "tcp_stream": 58, "udp_stream": null, "frame_number": 5238, "timestamp_epoch": "1556833835.304686000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-56e78aaa3280115de0a7d33d", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 8746, "timestamp_epoch": "1556834723.813511000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-7ea447131f62859b26500dd3", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 8747, "timestamp_epoch": "1556834723.813617000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-544c6a43030c65833468402d", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 8748, "timestamp_epoch": "1556834723.813807000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0", "kerberos.msg_type": "14" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-231a292a694df0bed2147a80", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 8752, "timestamp_epoch": "1556834723.815168000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-e4ce68ef6ec410b448693bd2", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 8753, "timestamp_epoch": "1556834723.816001000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-c628910bcfe0b2b390a637f0", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 8754, "timestamp_epoch": "1556834723.817964000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-934746b65c44523d0a4fa16e", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 8755, "timestamp_epoch": "1556834723.818156000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-f8c11c1b3f9d77a96d3d9718", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 8756, "timestamp_epoch": "1556834723.818420000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-08a821f89d2ba72d57bd2ce8", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 8757, "timestamp_epoch": "1556834723.818768000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-c5052193c5ec7e4ffa2fd947", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 8759, "timestamp_epoch": "1556834735.300890000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-55ba278b9a4306d081b1090e", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 8760, "timestamp_epoch": "1556834735.301111000" }, { "kind": "identity", "dst_ip": "10.0.0.10", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "84:8f:69:09:86:c0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-107c12223999388dc638c645", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 8761, "timestamp_epoch": "1556834735.301243000" }, { "kind": "identity", "dst_ip": "10.0.0.227", "fields": { "eth.dst": "84:8f:69:09:86:c0", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-c9b77f323b4756736f885f50", "src_port": null, "tcp_stream": 62, "udp_stream": null, "frame_number": 8762, "timestamp_epoch": "1556834735.301386000" } ], "http_request": [ { "kind": "http_request", "dst_ip": "204.2.193.137", "fields": { "http.host": "www.msftncsi.com", "http.user_agent": "Microsoft NCSI", "http.request.uri": "/ncsi.txt", "http.response_in": "416", "http.request.method": "GET", "http.request.full_uri": "http://www.msftncsi.com/ncsi.txt" }, "src_ip": "10.0.0.227", "dst_port": 80, "event_id": "evt-aad0a1201b15bf178f920bdc", "src_port": 49183, "tcp_stream": 27, "udp_stream": null, "frame_number": 414, "timestamp_epoch": "1556832926.267461000" }, { "kind": "http_request", "dst_ip": "104.16.154.36", "fields": { "http.host": "whatismyipaddress.com", "http.request.uri": "/", "http.response_in": "696", "http.request.method": "GET", "http.request.full_uri": "http://whatismyipaddress.com/" }, "src_ip": "10.0.0.227", "dst_port": 80, "event_id": "evt-8ad4f94e5152d411b6fe3fd6", "src_port": 49204, "tcp_stream": 49, "udp_stream": null, "frame_number": 694, "timestamp_epoch": "1556832974.764246000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-4ec7a087ce93cc6539f35d2f", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 802, "timestamp_epoch": "1556833039.389253000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-fec778c48d8b6ef4461117b1", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 804, "timestamp_epoch": "1556833039.807841000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-8b83b5abc97e71e0d29c472d", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 805, "timestamp_epoch": "1556833042.397674000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-a4831bc9252660a57171b825", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 806, "timestamp_epoch": "1556833042.819378000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-a49b6012ba302ce13f37d3db", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 807, "timestamp_epoch": "1556833045.408802000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-7738904955af93837993dd2c", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 808, "timestamp_epoch": "1556833045.830853000" } ], "http_response": [ { "kind": "http_response", "dst_ip": "10.0.0.227", "fields": { "http.request_in": "414", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "14" }, "src_ip": "204.2.193.137", "dst_port": 49183, "event_id": "evt-90e573532468678c37c8da53", "src_port": 80, "tcp_stream": 27, "udp_stream": null, "body_sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "frame_number": 416, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 14, "timestamp_epoch": "1556832926.296489000" }, { "kind": "http_response", "dst_ip": "10.0.0.227", "fields": { "http.request_in": "694", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "403", "http.transfer_encoding": "chunked" }, "src_ip": "104.16.154.36", "dst_port": 49204, "event_id": "evt-6198d211947cae0e29b2d9cd", "src_port": 80, "tcp_stream": 49, "udp_stream": null, "body_sha256": "071837b8164d0d54c84e6e2af06f06335db5cfef64ee391934660caec70f2f6f", "frame_number": 696, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 100, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 100, "timestamp_epoch": "1556832974.803704000" } ], "tls_client_hello": [], "unclassified_tcp": [ { "kind": "unclassified_tcp", "dst_ip": "10.0.0.227", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.0.10", "dst_port": 49195, "event_id": "evt-b9d1325de8194d076797d29a", "src_port": 139, "tcp_stream": 39, "udp_stream": null, "frame_number": 814, "timestamp_epoch": "1556833103.511014000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.0.227", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.0.10", "dst_port": 49195, "event_id": "evt-67a50d307ec49d38f93e8f53", "src_port": 139, "tcp_stream": 39, "udp_stream": null, "frame_number": 816, "timestamp_epoch": "1556833223.521658000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.0.227", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.0.10", "dst_port": 49195, "event_id": "evt-233393f03a91e7cb962c81aa", "src_port": 139, "tcp_stream": 39, "udp_stream": null, "frame_number": 828, "timestamp_epoch": "1556833343.531829000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.0.227", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.0.10", "dst_port": 49195, "event_id": "evt-82a24c45dcb49d0e10532396", "src_port": 139, "tcp_stream": 39, "udp_stream": null, "frame_number": 830, "timestamp_epoch": "1556833463.543927000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.0.227", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.0.10", "dst_port": 49195, "event_id": "evt-020fc468ecd86080bb97b5a5", "src_port": 139, "tcp_stream": 39, "udp_stream": null, "frame_number": 832, "timestamp_epoch": "1556833583.555206000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.0.227", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.0.10", "dst_port": 49195, "event_id": "evt-78e0aa8a279b9ebab69735b8", "src_port": 139, "tcp_stream": 39, "udp_stream": null, "frame_number": 5208, "timestamp_epoch": "1556833703.566666000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.0.227", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.0.10", "dst_port": 49195, "event_id": "evt-7836dc6d5877cc81fb5f4b81", "src_port": 139, "tcp_stream": 39, "udp_stream": null, "frame_number": 5240, "timestamp_epoch": "1556833853.513366000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.0.227", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.0.10", "dst_port": 49195, "event_id": "evt-fd3ab966b8c4f038006fcfd7", "src_port": 139, "tcp_stream": 39, "udp_stream": null, "frame_number": 5244, "timestamp_epoch": "1556833973.523601000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.0.227", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.0.10", "dst_port": 49195, "event_id": "evt-60d128b103a4984971da055c", "src_port": 139, "tcp_stream": 39, "udp_stream": null, "frame_number": 5246, "timestamp_epoch": "1556834093.535670000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.0.227", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.0.10", "dst_port": 49195, "event_id": "evt-b0c24efbf37c5abc3234e9f8", "src_port": 139, "tcp_stream": 39, "udp_stream": null, "frame_number": 5248, "timestamp_epoch": "1556834213.548250000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.0.227", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.0.10", "dst_port": 49195, "event_id": "evt-e22ac3d1062a0eb7e61d0dca", "src_port": 139, "tcp_stream": 39, "udp_stream": null, "frame_number": 5250, "timestamp_epoch": "1556834333.562283000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.0.227", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.0.10", "dst_port": 49195, "event_id": "evt-52e6581e24831abe01f7e7e2", "src_port": 139, "tcp_stream": 39, "udp_stream": null, "frame_number": 5252, "timestamp_epoch": "1556834453.568050000" }, { "kind": "unclassified_tcp", "dst_ip": "10.0.0.227", "fields": { "tcp.payload": "00" }, "src_ip": "10.0.0.10", "dst_port": 49195, "event_id": "evt-6abfe7bce9b5e5a7e40d91dc", "src_port": 139, "tcp_stream": 39, "udp_stream": null, "frame_number": 8738, "timestamp_epoch": "1556834573.564533000" } ], "directory_service": [ { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-7e05b0fb11873b5220e06a99", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 37, "timestamp_epoch": "1556832918.766086000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-2164ac8d131d6497aafc0384", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 39, "timestamp_epoch": "1556832918.766356000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-0bc8e395f62c2295e6839512", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 72, "timestamp_epoch": "1556832918.797611000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-f7fc47c448f3ee442ecb9d25", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 74, "timestamp_epoch": "1556832918.798207000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": {}, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-f6f3ef29a5014ddf217b11ef", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 75, "timestamp_epoch": "1556832918.799802000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": {}, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-590fdcf1e29907b30aff4901", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 76, "timestamp_epoch": "1556832918.800021000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": {}, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-d0fe8480f2aab8e973490ac5", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 77, "timestamp_epoch": "1556832918.801297000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": {}, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-85176c73835743d96c62d9c0", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 78, "timestamp_epoch": "1556832918.801685000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": {}, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-d7b95a0d2c10bdaac9f6b2a2", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 149, "timestamp_epoch": "1556832918.908002000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": {}, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-26ee9067d672f3949e9c9069", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 152, "timestamp_epoch": "1556832918.908471000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-753d26fae68d612403ba11ce", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 162, "timestamp_epoch": "1556832918.991590000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-2f901cb428650b6cc3b665a3", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 164, "timestamp_epoch": "1556832918.991959000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-bcf4c715b08a6176120e3b98", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 179, "timestamp_epoch": "1556832918.997775000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-3f2e1c3cd77af88f643211c8", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 181, "timestamp_epoch": "1556832918.998508000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-d037b4ecbde5026fc164283b", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 182, "timestamp_epoch": "1556832919.000806000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": {}, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-affcd58a0fc76ae592bb0b1b", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 190, "timestamp_epoch": "1556832919.031743000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": {}, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-777c1a43c86316ca8d0a1b9a", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 192, "timestamp_epoch": "1556832919.032195000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": {}, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-2903687d01a052d07a1e1b41", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 197, "timestamp_epoch": "1556832919.034365000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": {}, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-5a607f5fc005705f48bb4725", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 200, "timestamp_epoch": "1556832919.034877000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": {}, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-2d46f92946d609f100ddc72a", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 207, "timestamp_epoch": "1556832919.037162000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": {}, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-6ed2bab23098801320054574", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 208, "timestamp_epoch": "1556832919.037572000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": {}, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-b0c50bb2b658f7f8c36db631", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 209, "timestamp_epoch": "1556832919.039374000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": {}, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-2ceb2e031aff7cb95e586a90", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 210, "timestamp_epoch": "1556832919.039721000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": {}, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-2b703162cf3a3e4eb7603aa3", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 211, "timestamp_epoch": "1556832919.040069000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-fa4e6eef5f93626f09b9cf0a", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 271, "timestamp_epoch": "1556832923.777417000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-30b87fd140c0d60f8e7992e9", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 272, "timestamp_epoch": "1556832923.777653000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-bbfcd9be2779821d5c393020", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 273, "timestamp_epoch": "1556832923.778293000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-f77dc2b42a555ece9beb8425", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 274, "timestamp_epoch": "1556832923.778638000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-ead4bea7ec93f88c93d5de7d", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 275, "timestamp_epoch": "1556832923.778959000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-e0b7f5deadc1546a68736681", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 276, "timestamp_epoch": "1556832923.779281000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-358a99344d7af67647555455", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 277, "timestamp_epoch": "1556832923.779858000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-e7986a1856abe53423559dbf", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 278, "timestamp_epoch": "1556832923.780049000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-26fba10d5e2af31dfed0405c", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 291, "timestamp_epoch": "1556832924.378040000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-44fc50a59f6fa697e7d5c0d5", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 293, "timestamp_epoch": "1556832924.378327000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-882081cc5bf1cd355e5552e3", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 296, "timestamp_epoch": "1556832924.380000000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-196823f61ed2b3daa1fed726", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 298, "timestamp_epoch": "1556832924.381552000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=beguilesoft,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-ff0aeae8994634065daa7764", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 311, "timestamp_epoch": "1556832924.391015000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-26d5e798725d34d9887f4f5b", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 312, "timestamp_epoch": "1556832924.391426000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-40aaa6e0b2c8cbbef61ad181", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 317, "timestamp_epoch": "1556832924.394075000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-c56ad968bfd4164095475ec0", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 319, "timestamp_epoch": "1556832924.394659000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-04263dfc02c56183df539ab5", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 320, "timestamp_epoch": "1556832924.395215000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-762cb896670d8940c8252d20", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 321, "timestamp_epoch": "1556832924.395603000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=beguilesoft,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-5109a94c7cdfffaff8095e5e", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 322, "timestamp_epoch": "1556832924.395808000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-c6e2a65250200190334e9c08", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 323, "timestamp_epoch": "1556832924.396007000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=beguilesoft,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-4644a0ddd299e2a88206f8f5", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 324, "timestamp_epoch": "1556832924.396211000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-f1345fb8069779a9cd9727d2", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 325, "timestamp_epoch": "1556832924.396463000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-a3ee7ff5715aa1381465c7dd", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 394, "timestamp_epoch": "1556832924.413152000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-eea0e239680d90f6819a6ffa", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 400, "timestamp_epoch": "1556832924.801725000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-7e3a613b9eb2a7c90a386c3e", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 423, "timestamp_epoch": "1556832929.457930000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-e5f3d4a3b9ad56a330c944c2", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 425, "timestamp_epoch": "1556832929.458160000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-f7b07e37abcee20b66bb5de7", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 428, "timestamp_epoch": "1556832929.459863000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-b506056f79c17e368d623077", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 430, "timestamp_epoch": "1556832929.460670000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-c2e8c73172e34ad407b2a695", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 431, "timestamp_epoch": "1556832929.462463000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-118d5654ad90660f6be19f3a", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 432, "timestamp_epoch": "1556832929.462624000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-e3420ef2bd52c58dedd2ab65", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 433, "timestamp_epoch": "1556832929.462783000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-3c5c9d6a835c62ea7e13b408", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 434, "timestamp_epoch": "1556832929.462940000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=NTDS Settings,CN=BEGUILESOFT-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=beguilesoft,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-f17874f0878c4ca0446e199c", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 435, "timestamp_epoch": "1556832929.463090000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-c1202d7e65b969e7a32acc1e", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 436, "timestamp_epoch": "1556832929.463293000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Public Key Services,CN=Services,CN=Configuration,DC=beguilesoft,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-a0b8b053752c83fc57d88d20", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 437, "timestamp_epoch": "1556832929.463454000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-598883f921ec3c3cf49c2004", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 438, "timestamp_epoch": "1556832929.463667000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-371c24813eee87b0808d2d32", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 443, "timestamp_epoch": "1556832929.474672000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-50c2e8b22dd3cf00ca1d7631", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 445, "timestamp_epoch": "1556832929.475315000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-9bef895b569682d439356ae7", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 446, "timestamp_epoch": "1556832929.476516000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-612dfd4a274e1c6d3afc02b2", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 447, "timestamp_epoch": "1556832929.476822000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=beguilesoft,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-76c0fa40401f6ee970d74a63", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 478, "timestamp_epoch": "1556832929.503971000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-cadb3b656dddc99cd6a0b33d", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 479, "timestamp_epoch": "1556832929.504316000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-5826ef6ca8c729ceb0c46b4d", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 480, "timestamp_epoch": "1556832929.504627000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-12078ff7c100b062f7d5b66a", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 482, "timestamp_epoch": "1556832929.505118000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-7089fba776a31ada4667f6b8", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 620, "timestamp_epoch": "1556832972.379152000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-a220a58d5f7ae938c87b1ce9", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 621, "timestamp_epoch": "1556832972.379400000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-49796ea2cef13ce492e09fca", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 622, "timestamp_epoch": "1556832972.379677000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-926e6089304554db1a28914c", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 623, "timestamp_epoch": "1556832972.380083000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-142ff71037d50c25e61d0db1", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 624, "timestamp_epoch": "1556832972.381166000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-4bc2ab9267e9b90ecd23f8e7", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 625, "timestamp_epoch": "1556832972.381454000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-ddddb52f08ac9e3e3d2c7e51", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 626, "timestamp_epoch": "1556832972.381637000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-5a8d9b43ad50436fe265f0dd", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 627, "timestamp_epoch": "1556832972.381818000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-3bcd6533cdd19ed8fb919e88", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 646, "timestamp_epoch": "1556832972.969514000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-fd4455bf1a8b0847d6c2b87e", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 648, "timestamp_epoch": "1556832972.970874000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=beguilesoft,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-6c9c9d6ab88cdba24e4720fe", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 649, "timestamp_epoch": "1556832972.973789000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-e2cbb5dba10db2e3b1acc0ab", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 650, "timestamp_epoch": "1556832972.974511000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-0eed97e8930090cd48bd497c", "src_port": null, "tcp_stream": 47, "udp_stream": null, "frame_number": 655, "timestamp_epoch": "1556832972.981122000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-b73edd8d8d16ec2946245386", "src_port": null, "tcp_stream": 47, "udp_stream": null, "frame_number": 657, "timestamp_epoch": "1556832972.981863000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-45f0d9b2bbdfbe5f62c2685d", "src_port": null, "tcp_stream": 47, "udp_stream": null, "frame_number": 658, "timestamp_epoch": "1556832973.011417000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-0d4be68995770e609cdea3c3", "src_port": null, "tcp_stream": 47, "udp_stream": null, "frame_number": 659, "timestamp_epoch": "1556832973.011702000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=beguilesoft,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-dca031450dddce3304632e82", "src_port": null, "tcp_stream": 47, "udp_stream": null, "frame_number": 660, "timestamp_epoch": "1556832973.021861000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-ed50b2e7837a5d2e8b544579", "src_port": null, "tcp_stream": 47, "udp_stream": null, "frame_number": 661, "timestamp_epoch": "1556832973.022363000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=beguilesoft,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-f1f0aadf4a833db840fc4b7e", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 662, "timestamp_epoch": "1556832973.030930000" }, { "kind": "directory_service", "dst_ip": "10.0.0.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.0.0.10", "dst_port": null, "event_id": "evt-90fd8c599a0fdd2e8a58f0c8", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 663, "timestamp_epoch": "1556832973.031524000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-c8a00eb863b36f088eaaac01", "src_port": null, "tcp_stream": 47, "udp_stream": null, "frame_number": 680, "timestamp_epoch": "1556832973.197442000" }, { "kind": "directory_service", "dst_ip": "10.0.0.10", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.0.0.227", "dst_port": null, "event_id": "evt-d5866a20309662b876b84c39", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 685, "timestamp_epoch": "1556832973.708554000" } ] }, "capture": { "format": "pcap-le-microsecond", "packet_count": 8763, "interface_ids": [], "source_sha256": "41c9c4db17a58581eed3fc7f0bbebfe93c68034e2457afe131503c1a9eafac56", "captured_bytes": 5695407, "protocol_counts": { "ip": 8763, "dns": 46, "eth": 8763, "ftp": 71, "ntp": 4, "smb": 4, "tcp": 8665, "udp": 92, "data": 15, "dhcp": 2, "http": 4, "igmp": 12, "ldap": 78, "nbns": 20, "nbss": 106, "smb2": 100, "ssdp": 6, "cldap": 10, "llmnr": 4, "dcerpc": 50, "spnego": 46, "gss-api": 80, "ftp-data": 3480, "kerberos": 48, "ethertype": 8763, "spnego-krb5": 120, "data-text-lines": 7 }, "duration_seconds": 1816.717914, "last_packet_epoch": "1556834735.301592", "source_size_bytes": 5835639, "first_packet_epoch": "1556832918.583678", "encapsulation_types": [ 1 ] }, "summary": "Decoded 8763 packets across 12 IP endpoints and 97 transport flows. Observed 46 DNS events, 8 HTTP requests, 0 TLS ClientHello events, and 2 recovered file/message object(s). Deterministic rules produced 7 finding(s): 0 high, 3 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "coverage": { "warnings": [], "limitations": [ "Encrypted application contents are not decrypted", "Protocol decoding and heuristic findings do not establish malware family or attribution", "No endpoint execution, persistence, or credential-theft proof without corresponding evidence" ], "event_limits": { "dns": { "returned": 46, "truncated": false }, "dhcp": { "returned": 2, "truncated": false }, "smtp": { "returned": 0, "truncated": false }, "identity": { "returned": 194, "truncated": false }, "http_request": { "returned": 8, "truncated": false }, "http_response": { "returned": 2, "truncated": false }, "tls_client_hello": { "returned": 0, "truncated": false }, "unclassified_tcp": { "returned": 13, "truncated": false }, "directory_service": { "returned": 90, "truncated": false } }, "http_objects": { "complete": true, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "hashed_bytes": 114, "export_status": "completed", "unique_hashes": 2, "hashed_objects": 2, "compact_objects": 0, "detailed_objects": 2, "exported_objects": 2, "unhashed_objects": 0, "compact_hash_index": [], "omitted_unique_hashes": 0, "returned_unique_hashes": 2 }, "name_resolution": false, "supplemental_objects": { "scope": "bounded IMF, inert embedded base64 and complete contiguous HTTP response recovery", "returned": 0 }, "complete_within_profile": true, "encrypted_payload_visibility": "metadata-only" }, "findings": [ { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.0.0.10", "protocol": "drsuapi", "destination": "10.0.0.227", "event_count": 8, "operation_numbers": [ "0", "1", "12" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 17, "frame_number": 272, "display_filter": "frame.number == 272", "timestamp_epoch": "1556832923.777653000" }, { "tcp_stream": 17, "frame_number": 274, "display_filter": "frame.number == 274", "timestamp_epoch": "1556832923.778638000" }, { "tcp_stream": 17, "frame_number": 276, "display_filter": "frame.number == 276", "timestamp_epoch": "1556832923.779281000" }, { "tcp_stream": 17, "frame_number": 278, "display_filter": "frame.number == 278", "timestamp_epoch": "1556832923.780049000" }, { "tcp_stream": 17, "frame_number": 621, "display_filter": "frame.number == 621", "timestamp_epoch": "1556832972.379400000" }, { "tcp_stream": 17, "frame_number": 623, "display_filter": "frame.number == 623", "timestamp_epoch": "1556832972.380083000" }, { "tcp_stream": 17, "frame_number": 625, "display_filter": "frame.number == 625", "timestamp_epoch": "1556832972.381454000" }, { "tcp_stream": 17, "frame_number": 627, "display_filter": "frame.number == 627", "timestamp_epoch": "1556832972.381818000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-e0ded38dcb2f853105c0e03a", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.0.0.10", "protocol": "ldap", "destination": "10.0.0.227", "event_count": 33, "operation_numbers": [ "", "1", "4,19,19,19,5", "4,5", "5" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 2, "frame_number": 39, "display_filter": "frame.number == 39", "timestamp_epoch": "1556832918.766356000" }, { "tcp_stream": 2, "frame_number": 74, "display_filter": "frame.number == 74", "timestamp_epoch": "1556832918.798207000" }, { "tcp_stream": 2, "frame_number": 76, "display_filter": "frame.number == 76", "timestamp_epoch": "1556832918.800021000" }, { "tcp_stream": 2, "frame_number": 78, "display_filter": "frame.number == 78", "timestamp_epoch": "1556832918.801685000" }, { "tcp_stream": 2, "frame_number": 152, "display_filter": "frame.number == 152", "timestamp_epoch": "1556832918.908471000" }, { "tcp_stream": 12, "frame_number": 164, "display_filter": "frame.number == 164", "timestamp_epoch": "1556832918.991959000" }, { "tcp_stream": 12, "frame_number": 181, "display_filter": "frame.number == 181", "timestamp_epoch": "1556832918.998508000" }, { "tcp_stream": 2, "frame_number": 192, "display_filter": "frame.number == 192", "timestamp_epoch": "1556832919.032195000" }, { "tcp_stream": 2, "frame_number": 200, "display_filter": "frame.number == 200", "timestamp_epoch": "1556832919.034877000" }, { "tcp_stream": 2, "frame_number": 208, "display_filter": "frame.number == 208", "timestamp_epoch": "1556832919.037572000" }, { "tcp_stream": 2, "frame_number": 210, "display_filter": "frame.number == 210", "timestamp_epoch": "1556832919.039721000" }, { "tcp_stream": 19, "frame_number": 293, "display_filter": "frame.number == 293", "timestamp_epoch": "1556832924.378327000" }, { "tcp_stream": 19, "frame_number": 298, "display_filter": "frame.number == 298", "timestamp_epoch": "1556832924.381552000" }, { "tcp_stream": 19, "frame_number": 312, "display_filter": "frame.number == 312", "timestamp_epoch": "1556832924.391426000" }, { "tcp_stream": 21, "frame_number": 319, "display_filter": "frame.number == 319", "timestamp_epoch": "1556832924.394659000" }, { "tcp_stream": 21, "frame_number": 321, "display_filter": "frame.number == 321", "timestamp_epoch": "1556832924.395603000" }, { "tcp_stream": 21, "frame_number": 323, "display_filter": "frame.number == 323", "timestamp_epoch": "1556832924.396007000" }, { "tcp_stream": 19, "frame_number": 325, "display_filter": "frame.number == 325", "timestamp_epoch": "1556832924.396463000" }, { "tcp_stream": 28, "frame_number": 425, "display_filter": "frame.number == 425", "timestamp_epoch": "1556832929.458160000" }, { "tcp_stream": 28, "frame_number": 430, "display_filter": "frame.number == 430", "timestamp_epoch": "1556832929.460670000" }, { "tcp_stream": 28, "frame_number": 432, "display_filter": "frame.number == 432", "timestamp_epoch": "1556832929.462624000" }, { "tcp_stream": 28, "frame_number": 434, "display_filter": "frame.number == 434", "timestamp_epoch": "1556832929.462940000" }, { "tcp_stream": 28, "frame_number": 436, "display_filter": "frame.number == 436", "timestamp_epoch": "1556832929.463293000" }, { "tcp_stream": 28, "frame_number": 438, "display_filter": "frame.number == 438", "timestamp_epoch": "1556832929.463667000" }, { "tcp_stream": 29, "frame_number": 445, "display_filter": "frame.number == 445", "timestamp_epoch": "1556832929.475315000" }, { "tcp_stream": 29, "frame_number": 447, "display_filter": "frame.number == 447", "timestamp_epoch": "1556832929.476822000" }, { "tcp_stream": 29, "frame_number": 479, "display_filter": "frame.number == 479", "timestamp_epoch": "1556832929.504316000" }, { "tcp_stream": 45, "frame_number": 648, "display_filter": "frame.number == 648", "timestamp_epoch": "1556832972.970874000" }, { "tcp_stream": 45, "frame_number": 650, "display_filter": "frame.number == 650", "timestamp_epoch": "1556832972.974511000" }, { "tcp_stream": 47, "frame_number": 657, "display_filter": "frame.number == 657", "timestamp_epoch": "1556832972.981863000" }, { "tcp_stream": 47, "frame_number": 659, "display_filter": "frame.number == 659", "timestamp_epoch": "1556832973.011702000" }, { "tcp_stream": 47, "frame_number": 661, "display_filter": "frame.number == 661", "timestamp_epoch": "1556832973.022363000" }, { "tcp_stream": 45, "frame_number": 663, "display_filter": "frame.number == 663", "timestamp_epoch": "1556832973.031524000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-6e2ef5d4c5a117d79d58aa1c", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.0.0.227", "protocol": "drsuapi", "destination": "10.0.0.10", "event_count": 8, "operation_numbers": [ "0", "1", "12" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 17, "frame_number": 271, "display_filter": "frame.number == 271", "timestamp_epoch": "1556832923.777417000" }, { "tcp_stream": 17, "frame_number": 273, "display_filter": "frame.number == 273", "timestamp_epoch": "1556832923.778293000" }, { "tcp_stream": 17, "frame_number": 275, "display_filter": "frame.number == 275", "timestamp_epoch": "1556832923.778959000" }, { "tcp_stream": 17, "frame_number": 277, "display_filter": "frame.number == 277", "timestamp_epoch": "1556832923.779858000" }, { "tcp_stream": 17, "frame_number": 620, "display_filter": "frame.number == 620", "timestamp_epoch": "1556832972.379152000" }, { "tcp_stream": 17, "frame_number": 622, "display_filter": "frame.number == 622", "timestamp_epoch": "1556832972.379677000" }, { "tcp_stream": 17, "frame_number": 624, "display_filter": "frame.number == 624", "timestamp_epoch": "1556832972.381166000" }, { "tcp_stream": 17, "frame_number": 626, "display_filter": "frame.number == 626", "timestamp_epoch": "1556832972.381637000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-6aa20e5174d7a82feaebf676", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.0.0.227", "protocol": "ldap", "destination": "10.0.0.10", "event_count": 41, "operation_numbers": [ "", "0", "2", "3" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 2, "frame_number": 37, "display_filter": "frame.number == 37", "timestamp_epoch": "1556832918.766086000" }, { "tcp_stream": 2, "frame_number": 72, "display_filter": "frame.number == 72", "timestamp_epoch": "1556832918.797611000" }, { "tcp_stream": 2, "frame_number": 75, "display_filter": "frame.number == 75", "timestamp_epoch": "1556832918.799802000" }, { "tcp_stream": 2, "frame_number": 77, "display_filter": "frame.number == 77", "timestamp_epoch": "1556832918.801297000" }, { "tcp_stream": 2, "frame_number": 149, "display_filter": "frame.number == 149", "timestamp_epoch": "1556832918.908002000" }, { "tcp_stream": 12, "frame_number": 162, "display_filter": "frame.number == 162", "timestamp_epoch": "1556832918.991590000" }, { "tcp_stream": 12, "frame_number": 179, "display_filter": "frame.number == 179", "timestamp_epoch": "1556832918.997775000" }, { "tcp_stream": 12, "frame_number": 182, "display_filter": "frame.number == 182", "timestamp_epoch": "1556832919.000806000" }, { "tcp_stream": 2, "frame_number": 190, "display_filter": "frame.number == 190", "timestamp_epoch": "1556832919.031743000" }, { "tcp_stream": 2, "frame_number": 197, "display_filter": "frame.number == 197", "timestamp_epoch": "1556832919.034365000" }, { "tcp_stream": 2, "frame_number": 207, "display_filter": "frame.number == 207", "timestamp_epoch": "1556832919.037162000" }, { "tcp_stream": 2, "frame_number": 209, "display_filter": "frame.number == 209", "timestamp_epoch": "1556832919.039374000" }, { "tcp_stream": 2, "frame_number": 211, "display_filter": "frame.number == 211", "timestamp_epoch": "1556832919.040069000" }, { "tcp_stream": 19, "frame_number": 291, "display_filter": "frame.number == 291", "timestamp_epoch": "1556832924.378040000" }, { "tcp_stream": 19, "frame_number": 296, "display_filter": "frame.number == 296", "timestamp_epoch": "1556832924.380000000" }, { "tcp_stream": 19, "frame_number": 311, "display_filter": "frame.number == 311", "timestamp_epoch": "1556832924.391015000" }, { "tcp_stream": 21, "frame_number": 317, "display_filter": "frame.number == 317", "timestamp_epoch": "1556832924.394075000" }, { "tcp_stream": 21, "frame_number": 320, "display_filter": "frame.number == 320", "timestamp_epoch": "1556832924.395215000" }, { "tcp_stream": 21, "frame_number": 322, "display_filter": "frame.number == 322", "timestamp_epoch": "1556832924.395808000" }, { "tcp_stream": 19, "frame_number": 324, "display_filter": "frame.number == 324", "timestamp_epoch": "1556832924.396211000" }, { "tcp_stream": 21, "frame_number": 394, "display_filter": "frame.number == 394", "timestamp_epoch": "1556832924.413152000" }, { "tcp_stream": 19, "frame_number": 400, "display_filter": "frame.number == 400", "timestamp_epoch": "1556832924.801725000" }, { "tcp_stream": 28, "frame_number": 423, "display_filter": "frame.number == 423", "timestamp_epoch": "1556832929.457930000" }, { "tcp_stream": 28, "frame_number": 428, "display_filter": "frame.number == 428", "timestamp_epoch": "1556832929.459863000" }, { "tcp_stream": 28, "frame_number": 431, "display_filter": "frame.number == 431", "timestamp_epoch": "1556832929.462463000" }, { "tcp_stream": 28, "frame_number": 433, "display_filter": "frame.number == 433", "timestamp_epoch": "1556832929.462783000" }, { "tcp_stream": 28, "frame_number": 435, "display_filter": "frame.number == 435", "timestamp_epoch": "1556832929.463090000" }, { "tcp_stream": 28, "frame_number": 437, "display_filter": "frame.number == 437", "timestamp_epoch": "1556832929.463454000" }, { "tcp_stream": 29, "frame_number": 443, "display_filter": "frame.number == 443", "timestamp_epoch": "1556832929.474672000" }, { "tcp_stream": 29, "frame_number": 446, "display_filter": "frame.number == 446", "timestamp_epoch": "1556832929.476516000" }, { "tcp_stream": 29, "frame_number": 478, "display_filter": "frame.number == 478", "timestamp_epoch": "1556832929.503971000" }, { "tcp_stream": 29, "frame_number": 480, "display_filter": "frame.number == 480", "timestamp_epoch": "1556832929.504627000" }, { "tcp_stream": 28, "frame_number": 482, "display_filter": "frame.number == 482", "timestamp_epoch": "1556832929.505118000" }, { "tcp_stream": 45, "frame_number": 646, "display_filter": "frame.number == 646", "timestamp_epoch": "1556832972.969514000" }, { "tcp_stream": 45, "frame_number": 649, "display_filter": "frame.number == 649", "timestamp_epoch": "1556832972.973789000" }, { "tcp_stream": 47, "frame_number": 655, "display_filter": "frame.number == 655", "timestamp_epoch": "1556832972.981122000" }, { "tcp_stream": 47, "frame_number": 658, "display_filter": "frame.number == 658", "timestamp_epoch": "1556832973.011417000" }, { "tcp_stream": 47, "frame_number": 660, "display_filter": "frame.number == 660", "timestamp_epoch": "1556832973.021861000" }, { "tcp_stream": 45, "frame_number": 662, "display_filter": "frame.number == 662", "timestamp_epoch": "1556832973.030930000" }, { "tcp_stream": 47, "frame_number": 680, "display_filter": "frame.number == 680", "timestamp_epoch": "1556832973.197442000" }, { "tcp_stream": 45, "frame_number": 685, "display_filter": "frame.number == 685", "timestamp_epoch": "1556832973.708554000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-36d7ca595484ef57966bb5c8", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Sustained external TCP conversation outside decoded application coverage", "status": "candidate", "metrics": { "source": "10.0.0.227", "packets": 35, "wire_bytes": 2598, "destination": "145.14.145.4", "destination_port": 21, "duration_seconds": 99.972 }, "rule_id": "unclassified-external-tcp", "evidence": [ { "tcp_stream": 50, "frame_number": 712, "display_filter": "tcp.stream == 50", "timestamp_epoch": "1556832993.781986" } ], "severity": "medium", "confidence": 0.7, "finding_id": "finding-0e8d6e589f99764788129f0e", "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.", "rule_version": "pcap-rules-v5" }, { "title": "Sustained external TCP conversation outside decoded application coverage", "status": "candidate", "metrics": { "source": "10.0.0.227", "packets": 46, "wire_bytes": 3452, "destination": "145.14.144.10", "destination_port": 21, "duration_seconds": 56.919 }, "rule_id": "unclassified-external-tcp", "evidence": [ { "tcp_stream": 55, "frame_number": 836, "display_filter": "tcp.stream == 55", "timestamp_epoch": "1556833587.156343" } ], "severity": "medium", "confidence": 0.7, "finding_id": "finding-ddcd0d75111cb2668d564863", "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.", "rule_version": "pcap-rules-v5" }, { "title": "Sustained external TCP conversation outside decoded application coverage", "status": "candidate", "metrics": { "source": "10.0.0.227", "packets": 47, "wire_bytes": 3506, "destination": "145.14.145.99", "destination_port": 21, "duration_seconds": 101.445 }, "rule_id": "unclassified-external-tcp", "evidence": [ { "tcp_stream": 59, "frame_number": 5256, "display_filter": "tcp.stream == 59", "timestamp_epoch": "1556834493.174821" } ], "severity": "medium", "confidence": 0.7, "finding_id": "finding-a9a25e3ecbf8ef4db44f4901", "explanation": "The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.", "rule_version": "pcap-rules-v5" } ], "artifacts": [ { "md5": "176e0d32a9bb512e83b3d30067a6a121", "sha1": "5b58ecf46de1e15747b2014d6a7692c0f58c72df", "type": "http-exported-object", "sha256": "071837b8164d0d54c84e6e2af06f06335db5cfef64ee391934660caec70f2f6f", "evidence": [ { "tcp_stream": 49, "frame_number": 696, "display_filter": "frame.number == 696", "timestamp_epoch": "1556832974.803704000" } ], "filename": "%2f", "filenames": [ "%2f" ], "transfers": [ { "url": "http://whatismyipaddress.com/", "client_ip": "10.0.0.227", "server_ip": "104.16.154.36", "tcp_stream": 49, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "403", "completeness": "unknown", "request_frame": 694, "response_frame": 696 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 100, "artifact_id": "artifact-30e9b467628c568d1dad37da", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 100, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 100, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "cd5a4d3fdd5bffc16bf959ef75cf37bc", "sha1": "33bf88d5b82df3723d5863c7d23445e345828904", "type": "http-exported-object", "sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "evidence": [ { "tcp_stream": 27, "frame_number": 416, "display_filter": "frame.number == 416", "timestamp_epoch": "1556832926.296489000" } ], "filename": "ncsi.txt", "filenames": [ "ncsi.txt" ], "transfers": [ { "url": "http://www.msftncsi.com/ncsi.txt", "client_ip": "10.0.0.227", "server_ip": "204.2.193.137", "tcp_stream": 27, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 414, "response_frame": 416 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/plain", "size_bytes": 14, "artifact_id": "artifact-0bc514218e6df50c2d8f63dd", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 14, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false } ], "endpoints": [ { "ip": "10.0.0.10", "bytes_sent": 87767, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-fbf32ceadd4dd0cb355d99ef", "packets_sent": 382, "mac_addresses": [ "a4:1f:72:c2:09:6a" ], "bytes_received": 109307, "evidence_frames": [ 3, 4, 5, 6, 7 ], "last_seen_epoch": "1556834735.301592", "first_seen_epoch": "1556832918.609168", "packets_received": 418 }, { "ip": "10.0.0.227", "bytes_sent": 5368844, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-4b986c7d3de2c4b05a9ab100", "packets_sent": 4011, "mac_addresses": [ "84:8f:69:09:86:c0" ], "bytes_received": 326563, "evidence_frames": [ 1, 2, 3, 4, 5 ], "last_seen_epoch": "1556834735.301592", "first_seen_epoch": "1556832918.583678", "packets_received": 4752 }, { "ip": "10.0.0.255", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-0f0a862f6974f7ba9e8b16dd", "packets_sent": 0, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "bytes_received": 1964, "evidence_frames": [ 1, 2, 214, 216, 217 ], "last_seen_epoch": "1556832971.001741", "first_seen_epoch": "1556832918.583678", "packets_received": 19 }, { "ip": "104.16.154.36", "bytes_sent": 838, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6fc1989b96f3a764cef2be72", "packets_sent": 5, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 407, "evidence_frames": [ 691, 692, 693, 694, 695 ], "last_seen_epoch": "1556833074.872593", "first_seen_epoch": "1556832974.733937", "packets_received": 6 }, { "ip": "145.14.144.10", "bytes_sent": 130575, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-326ed89ef08187752bc60a54", "packets_sent": 2404, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2940090, "evidence_frames": [ 836, 837, 838, 839, 840 ], "last_seen_epoch": "1556833644.075172", "first_seen_epoch": "1556833587.156343", "packets_received": 1968 }, { "ip": "145.14.145.4", "bytes_sent": 2114, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-bd8801762a3d5e0079e2f839", "packets_sent": 29, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4209, "evidence_frames": [ 712, 713, 714, 715, 716 ], "last_seen_epoch": "1556833093.753655", "first_seen_epoch": "1556832993.781986", "packets_received": 23 }, { "ip": "145.14.145.99", "bytes_sent": 104870, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8fe77b926f4e6d3206047246", "packets_sent": 1928, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2310496, "evidence_frames": [ 5256, 5257, 5258, 5259, 5260 ], "last_seen_epoch": "1556834594.619618", "first_seen_epoch": "1556834493.174821", "packets_received": 1555 }, { "ip": "204.2.193.137", "bytes_sent": 399, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c04837fc0669cec210757f5e", "packets_sent": 4, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 379, "evidence_frames": [ 411, 412, 413, 414, 415 ], "last_seen_epoch": "1556832926.296833", "first_seen_epoch": "1556832926.233526", "packets_received": 5 }, { "ip": "224.0.0.22", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a73ee315f269208bea928d38", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:16" ], "bytes_received": 324, "evidence_frames": [ 11, 224, 225, 236, 801 ], "last_seen_epoch": "1556833039.682511", "first_seen_epoch": "1556832918.674195", "packets_received": 6 }, { "ip": "224.0.0.252", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-68dd9a4853c0bb44bdf7d6bc", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:fc" ], "bytes_received": 276, "evidence_frames": [ 226, 231, 232, 233 ], "last_seen_epoch": "1556832921.293654", "first_seen_epoch": "1556832921.188271", "packets_received": 4 }, { "ip": "239.255.255.250", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-07c7ba78d6f6564af35cb171", "packets_sent": 0, "mac_addresses": [ "01:00:5e:7f:ff:fa" ], "bytes_received": 1050, "evidence_frames": [ 802, 804, 805, 806, 807 ], "last_seen_epoch": "1556833045.830853", "first_seen_epoch": "1556833039.389253", "packets_received": 6 }, { "ip": "255.255.255.255", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-373efd95b89f47fd3251de2f", "packets_sent": 0, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "bytes_received": 342, "evidence_frames": [ 227 ], "last_seen_epoch": "1556832921.19347", "first_seen_epoch": "1556832921.19347", "packets_received": 1 } ], "identities": [ { "type": "account", "value": "adriana.breaux", "bindings": [ { "account": "", "owner_ip": "10.0.0.227", "frame_number": 517, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.10", "conversation_src": "10.0.0.227" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 525, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.10", "conversation_src": "10.0.0.227" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 527, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.227", "conversation_src": "10.0.0.10" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 539, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.227", "conversation_src": "10.0.0.10" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 567, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.227", "conversation_src": "10.0.0.10" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 579, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.227", "conversation_src": "10.0.0.10" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 609, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.227", "conversation_src": "10.0.0.10" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 640, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.227", "conversation_src": "10.0.0.10" } ], "evidence": [ { "tcp_stream": 34, "frame_number": 517, "display_filter": "frame.number == 517", "timestamp_epoch": "1556832968.928116000" }, { "tcp_stream": 35, "frame_number": 525, "display_filter": "frame.number == 525", "timestamp_epoch": "1556832968.940548000" }, { "tcp_stream": 35, "frame_number": 527, "display_filter": "frame.number == 527", "timestamp_epoch": "1556832968.941319000" }, { "tcp_stream": 36, "frame_number": 539, "display_filter": "frame.number == 539", "timestamp_epoch": "1556832968.943388000" }, { "tcp_stream": 40, "frame_number": 567, "display_filter": "frame.number == 567", "timestamp_epoch": "1556832971.006336000" }, { "tcp_stream": 41, "frame_number": 579, "display_filter": "frame.number == 579", "timestamp_epoch": "1556832971.007693000" }, { "tcp_stream": 44, "frame_number": 609, "display_filter": "frame.number == 609", "timestamp_epoch": "1556832972.376867000" }, { "tcp_stream": 46, "frame_number": 640, "display_filter": "frame.number == 640", "timestamp_epoch": "1556832972.966909000" } ], "raw_values": [ "adriana.breaux" ], "identity_id": "identity-e03f3a688297d3c17011a15d", "ip_addresses": [ "10.0.0.227" ], "mac_addresses": [ "84:8f:69:09:86:c0" ] }, { "type": "account", "value": "breaux-win7-pc$", "bindings": [ { "account": "", "owner_ip": "10.0.0.227", "frame_number": 44, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.10", "conversation_src": "10.0.0.227" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 52, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.10", "conversation_src": "10.0.0.227" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 54, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.227", "conversation_src": "10.0.0.10" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 66, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.227", "conversation_src": "10.0.0.10" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 93, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.10", "conversation_src": "10.0.0.227" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 101, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.10", "conversation_src": "10.0.0.227" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 103, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.227", "conversation_src": "10.0.0.10" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 115, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.227", "conversation_src": "10.0.0.10" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 129, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.227", "conversation_src": "10.0.0.10" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 173, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.227", "conversation_src": "10.0.0.10" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 260, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.227", "conversation_src": "10.0.0.10" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 306, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.227", "conversation_src": "10.0.0.10" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 338, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.227", "conversation_src": "10.0.0.10" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 350, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.227", "conversation_src": "10.0.0.10" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 368, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.227", "conversation_src": "10.0.0.10" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 451, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.10", "conversation_src": "10.0.0.227" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 459, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.10", "conversation_src": "10.0.0.227" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 461, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.227", "conversation_src": "10.0.0.10" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 473, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.0.0.227", "conversation_src": "10.0.0.10" } ], "evidence": [ { "tcp_stream": 3, "frame_number": 44, "display_filter": "frame.number == 44", "timestamp_epoch": "1556832918.772283000" }, { "tcp_stream": 4, "frame_number": 52, "display_filter": "frame.number == 52", "timestamp_epoch": "1556832918.792260000" }, { "tcp_stream": 4, "frame_number": 54, "display_filter": "frame.number == 54", "timestamp_epoch": "1556832918.793223000" }, { "tcp_stream": 5, "frame_number": 66, "display_filter": "frame.number == 66", "timestamp_epoch": "1556832918.796909000" }, { "tcp_stream": 7, "frame_number": 93, "display_filter": "frame.number == 93", "timestamp_epoch": "1556832918.857282000" }, { "tcp_stream": 8, "frame_number": 101, "display_filter": "frame.number == 101", "timestamp_epoch": "1556832918.879306000" }, { "tcp_stream": 8, "frame_number": 103, "display_filter": "frame.number == 103", "timestamp_epoch": "1556832918.880187000" }, { "tcp_stream": 9, "frame_number": 115, "display_filter": "frame.number == 115", "timestamp_epoch": "1556832918.885234000" }, { "tcp_stream": 10, "frame_number": 129, "display_filter": "frame.number == 129", "timestamp_epoch": "1556832918.888767000" }, { "tcp_stream": 13, "frame_number": 173, "display_filter": "frame.number == 173", "timestamp_epoch": "1556832918.996486000" }, { "tcp_stream": 18, "frame_number": 260, "display_filter": "frame.number == 260", "timestamp_epoch": "1556832923.775288000" }, { "tcp_stream": 20, "frame_number": 306, "display_filter": "frame.number == 306", "timestamp_epoch": "1556832924.389040000" }, { "tcp_stream": 23, "frame_number": 338, "display_filter": "frame.number == 338", "timestamp_epoch": "1556832924.401375000" }, { "tcp_stream": 24, "frame_number": 350, "display_filter": "frame.number == 350", "timestamp_epoch": "1556832924.402531000" }, { "tcp_stream": 25, "frame_number": 368, "display_filter": "frame.number == 368", "timestamp_epoch": "1556832924.404733000" }, { "tcp_stream": 30, "frame_number": 451, "display_filter": "frame.number == 451", "timestamp_epoch": "1556832929.479084000" }, { "tcp_stream": 31, "frame_number": 459, "display_filter": "frame.number == 459", "timestamp_epoch": "1556832929.498359000" }, { "tcp_stream": 31, "frame_number": 461, "display_filter": "frame.number == 461", "timestamp_epoch": "1556832929.499027000" }, { "tcp_stream": 32, "frame_number": 473, "display_filter": "frame.number == 473", "timestamp_epoch": "1556832929.501313000" } ], "raw_values": [ "BREAUX-WIN7-PC$", "breaux-win7-pc$" ], "identity_id": "identity-81dba411a963f20986a0f7b8", "ip_addresses": [ "10.0.0.227" ], "mac_addresses": [ "84:8f:69:09:86:c0" ] }, { "type": "hostname", "value": "Breaux-Win7-PC", "bindings": [ { "account": "", "owner_ip": "0.0.0.0", "frame_number": 227, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "10.0.0.227" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 1, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.0.255", "conversation_src": "10.0.0.227" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 214, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.0.255", "conversation_src": "10.0.0.227" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 217, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.0.255", "conversation_src": "10.0.0.227" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 218, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.0.255", "conversation_src": "10.0.0.227" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 220, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.0.255", "conversation_src": "10.0.0.227" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 221, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.0.255", "conversation_src": "10.0.0.227" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 222, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.0.255", "conversation_src": "10.0.0.227" }, { "account": "", "owner_ip": "10.0.0.227", "frame_number": 234, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.0.0.255", "conversation_src": "10.0.0.227" } ], "evidence": [ { "udp_stream": 12, "frame_number": 227, "display_filter": "frame.number == 227", "timestamp_epoch": "1556832921.193470000" }, { "udp_stream": 0, "frame_number": 1, "display_filter": "frame.number == 1", "timestamp_epoch": "1556832918.583678000" }, { "udp_stream": 0, "frame_number": 214, "display_filter": "frame.number == 214", "timestamp_epoch": "1556832919.068636000" }, { "udp_stream": 0, "frame_number": 217, "display_filter": "frame.number == 217", "timestamp_epoch": "1556832919.333528000" }, { "udp_stream": 0, "frame_number": 218, "display_filter": "frame.number == 218", "timestamp_epoch": "1556832919.813626000" }, { "udp_stream": 0, "frame_number": 220, "display_filter": "frame.number == 220", "timestamp_epoch": "1556832920.083437000" }, { "udp_stream": 0, "frame_number": 221, "display_filter": "frame.number == 221", "timestamp_epoch": "1556832920.563392000" }, { "udp_stream": 0, "frame_number": 222, "display_filter": "frame.number == 222", "timestamp_epoch": "1556832920.833324000" }, { "udp_stream": 0, "frame_number": 234, "display_filter": "frame.number == 234", "timestamp_epoch": "1556832921.313871000" } ], "raw_values": [ "BREAUX-WIN7-PC<00>,BREAUX-WIN7-PC<00> (Workstation/Redirector)", "BREAUX-WIN7-PC<20>,BREAUX-WIN7-PC<20> (Server service)", "Breaux-Win7-PC" ], "identity_id": "identity-833cb5cc20f7fa5d2dd1e97b", "ip_addresses": [ "10.0.0.227" ], "mac_addresses": [ "84:8f:69:09:86:c0", "84:8f:69:09:86:c0,84:8f:69:09:86:c0" ] }, { "type": "netbios-group", "value": "BEGUILESOFT", "bindings": [ { "account": "", "owner_ip": null, "frame_number": 2, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.0.0.255", "conversation_src": "10.0.0.227" }, { "account": "", "owner_ip": null, "frame_number": 216, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.0.0.255", "conversation_src": "10.0.0.227" }, { "account": "", "owner_ip": null, "frame_number": 219, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.0.0.255", "conversation_src": "10.0.0.227" }, { "account": "", "owner_ip": null, "frame_number": 223, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.0.0.255", "conversation_src": "10.0.0.227" } ], "evidence": [ { "udp_stream": 0, "frame_number": 2, "display_filter": "frame.number == 2", "timestamp_epoch": "1556832918.583928000" }, { "udp_stream": 0, "frame_number": 216, "display_filter": "frame.number == 216", "timestamp_epoch": "1556832919.333391000" }, { "udp_stream": 0, "frame_number": 219, "display_filter": "frame.number == 219", "timestamp_epoch": "1556832920.083306000" }, { "udp_stream": 0, "frame_number": 223, "display_filter": "frame.number == 223", "timestamp_epoch": "1556832920.833469000" } ], "raw_values": [ "BEGUILESOFT<00>,BEGUILESOFT<00> (Workstation/Redirector)" ], "identity_id": "identity-d403151cf932a80ad36474bf", "ip_addresses": [], "mac_addresses": [] } ], "actor_leads": [], "observables": [ { "type": "domain", "roles": [ "dns-query" ], "value": "beguilesoft-dc.beguilesoft.com", "evidence": [ { "udp_stream": 2, "frame_number": 5, "display_filter": "frame.number == 5", "timestamp_epoch": "1556832918.613709000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1556832918.614024000" }, { "udp_stream": 16, "frame_number": 237, "display_filter": "frame.number == 237", "timestamp_epoch": "1556832922.070554000" }, { "udp_stream": 16, "frame_number": 238, "display_filter": "frame.number == 238", "timestamp_epoch": "1556832922.070887000" } ], "is_private": null, "observable_id": "observable-b7260f33743c6cd748c31fab", "last_seen_epoch": "1556832922.070887000", "enrichment_state": "not_requested", "first_seen_epoch": "1556832918.613709000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "beguilesoft.com", "evidence": [ { "udp_stream": 24, "frame_number": 408, "display_filter": "frame.number == 408", "timestamp_epoch": "1556832926.201223000" }, { "udp_stream": 24, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1556832926.202480000" } ], "is_private": null, "observable_id": "observable-eba7a4950c1589d99a9389b5", "last_seen_epoch": "1556832926.202480000", "enrichment_state": "not_requested", "first_seen_epoch": "1556832926.201223000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "breaux-win7-pc.beguilesoft.com", "evidence": [ { "udp_stream": 23, "frame_number": 406, "display_filter": "frame.number == 406", "timestamp_epoch": "1556832926.199445000" }, { "udp_stream": 23, "frame_number": 407, "display_filter": "frame.number == 407", "timestamp_epoch": "1556832926.199805000" } ], "is_private": null, "observable_id": "observable-e3428aad446f708e95e28927", "last_seen_epoch": "1556832926.199805000", "enrichment_state": "not_requested", "first_seen_epoch": "1556832926.199445000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "dns.msftncsi.com", "evidence": [ { "udp_stream": 30, "frame_number": 824, "display_filter": "frame.number == 824", "timestamp_epoch": "1556833288.302420000" }, { "udp_stream": 30, "frame_number": 825, "display_filter": "frame.number == 825", "timestamp_epoch": "1556833288.329591000" }, { "udp_stream": 31, "frame_number": 826, "display_filter": "frame.number == 826", "timestamp_epoch": "1556833288.330117000" }, { "udp_stream": 31, "frame_number": 827, "display_filter": "frame.number == 827", "timestamp_epoch": "1556833288.330376000" } ], "is_private": null, "observable_id": "observable-11308e0237c49f95b3d6ab7d", "last_seen_epoch": "1556833288.330376000", "enrichment_state": "not_requested", "first_seen_epoch": "1556833288.302420000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "files.000webhost.com", "evidence": [ { "udp_stream": 27, "frame_number": 710, "display_filter": "frame.number == 710", "timestamp_epoch": "1556832993.701960000" }, { "udp_stream": 27, "frame_number": 711, "display_filter": "frame.number == 711", "timestamp_epoch": "1556832993.781309000" }, { "udp_stream": 29, "frame_number": 818, "display_filter": "frame.number == 818", "timestamp_epoch": "1556833274.997255000" }, { "udp_stream": 29, "frame_number": 819, "display_filter": "frame.number == 819", "timestamp_epoch": "1556833276.007839000" }, { "udp_stream": 29, "frame_number": 820, "display_filter": "frame.number == 820", "timestamp_epoch": "1556833277.022496000" }, { "udp_stream": 29, "frame_number": 821, "display_filter": "frame.number == 821", "timestamp_epoch": "1556833279.034526000" }, { "udp_stream": 29, "frame_number": 822, "display_filter": "frame.number == 822", "timestamp_epoch": "1556833283.044125000" }, { "udp_stream": 29, "frame_number": 823, "display_filter": "frame.number == 823", "timestamp_epoch": "1556833287.107989000" }, { "udp_stream": 32, "frame_number": 834, "display_filter": "frame.number == 834", "timestamp_epoch": "1556833587.071526000" }, { "udp_stream": 32, "frame_number": 835, "display_filter": "frame.number == 835", "timestamp_epoch": "1556833587.155224000" }, { "udp_stream": 33, "frame_number": 5254, "display_filter": "frame.number == 5254", "timestamp_epoch": "1556834493.030295000" }, { "udp_stream": 33, "frame_number": 5255, "display_filter": "frame.number == 5255", "timestamp_epoch": "1556834493.173728000" } ], "is_private": null, "observable_id": "observable-94268df48ad5fdc8a0900ace", "last_seen_epoch": "1556834493.173728000", "enrichment_state": "not_requested", "first_seen_epoch": "1556832993.701960000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "isatap.beguilesoft.com", "evidence": [ { "udp_stream": 17, "frame_number": 239, "display_filter": "frame.number == 239", "timestamp_epoch": "1556832922.070903000" }, { "udp_stream": 17, "frame_number": 240, "display_filter": "frame.number == 240", "timestamp_epoch": "1556832922.071030000" } ], "is_private": null, "observable_id": "observable-022092e2685292b669ac5887", "last_seen_epoch": "1556832922.071030000", "enrichment_state": "not_requested", "first_seen_epoch": "1556832922.070903000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "isatap.localdomain", "evidence": [ { "udp_stream": 19, "frame_number": 279, "display_filter": "frame.number == 279", "timestamp_epoch": "1556832923.858883000" }, { "udp_stream": 19, "frame_number": 280, "display_filter": "frame.number == 280", "timestamp_epoch": "1556832923.882075000" } ], "is_private": null, "observable_id": "observable-e4fc85f5e5a1661467df1475", "last_seen_epoch": "1556832923.882075000", "enrichment_state": "not_requested", "first_seen_epoch": "1556832923.858883000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "us-east-1.route-1000.000webhost.awex.io", "evidence": [ { "udp_stream": 27, "frame_number": 711, "display_filter": "frame.number == 711", "timestamp_epoch": "1556832993.781309000" }, { "udp_stream": 29, "frame_number": 823, "display_filter": "frame.number == 823", "timestamp_epoch": "1556833287.107989000" }, { "udp_stream": 32, "frame_number": 835, "display_filter": "frame.number == 835", "timestamp_epoch": "1556833587.155224000" }, { "udp_stream": 33, "frame_number": 5255, "display_filter": "frame.number == 5255", "timestamp_epoch": "1556834493.173728000" } ], "is_private": null, "observable_id": "observable-40b31057ae3841004ad9b762", "last_seen_epoch": "1556834493.173728000", "enrichment_state": "not_requested", "first_seen_epoch": "1556832993.781309000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "whatismyipaddress.com", "evidence": [ { "udp_stream": 26, "frame_number": 689, "display_filter": "frame.number == 689", "timestamp_epoch": "1556832974.687459000" }, { "udp_stream": 26, "frame_number": 690, "display_filter": "frame.number == 690", "timestamp_epoch": "1556832974.729338000" }, { "tcp_stream": 49, "frame_number": 694, "display_filter": "frame.number == 694", "timestamp_epoch": "1556832974.764246000" } ], "is_private": null, "observable_id": "observable-8f170c819042eb58ad6f9492", "last_seen_epoch": "1556832974.764246000", "enrichment_state": "not_requested", "first_seen_epoch": "1556832974.687459000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "wpad.beguilesoft.com", "evidence": [ { "udp_stream": 14, "frame_number": 229, "display_filter": "frame.number == 229", "timestamp_epoch": "1556832921.197758000" }, { "udp_stream": 14, "frame_number": 230, "display_filter": "frame.number == 230", "timestamp_epoch": "1556832921.198017000" } ], "is_private": null, "observable_id": "observable-08e46963fbb95bac48a9c3bb", "last_seen_epoch": "1556832921.198017000", "enrichment_state": "not_requested", "first_seen_epoch": "1556832921.197758000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "www.msftncsi.com", "evidence": [ { "udp_stream": 22, "frame_number": 405, "display_filter": "frame.number == 405", "timestamp_epoch": "1556832926.060635000" }, { "udp_stream": 22, "frame_number": 410, "display_filter": "frame.number == 410", "timestamp_epoch": "1556832926.230910000" }, { "tcp_stream": 27, "frame_number": 414, "display_filter": "frame.number == 414", "timestamp_epoch": "1556832926.267461000" } ], "is_private": null, "observable_id": "observable-54cbb0a2eeb7da8963da0203", "last_seen_epoch": "1556832926.267461000", "enrichment_state": "not_requested", "first_seen_epoch": "1556832926.060635000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "10.0.0.10", "evidence": [ { "udp_stream": 1, "frame_number": 4, "display_filter": "frame.number == 4", "timestamp_epoch": "1556832918.610302000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1556832918.614024000" }, { "udp_stream": 5, "frame_number": 80, "display_filter": "frame.number == 80", "timestamp_epoch": "1556832918.803720000" }, { "udp_stream": 7, "frame_number": 118, "display_filter": "frame.number == 118", "timestamp_epoch": "1556832918.886980000" }, { "udp_stream": 9, "frame_number": 154, "display_filter": "frame.number == 154", "timestamp_epoch": "1556832918.910589000" }, { "udp_stream": 16, "frame_number": 238, "display_filter": "frame.number == 238", "timestamp_epoch": "1556832922.070887000" }, { "udp_stream": 23, "frame_number": 407, "display_filter": "frame.number == 407", "timestamp_epoch": "1556832926.199805000" } ], "is_private": true, "observable_id": "observable-8f7d8857ddab52349ea34f7d", "last_seen_epoch": "1556832926.199805000", "enrichment_state": "not_requested", "first_seen_epoch": "1556832918.610302000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "10.0.0.227", "evidence": [ { "udp_stream": 24, "frame_number": 408, "display_filter": "frame.number == 408", "timestamp_epoch": "1556832926.201223000" }, { "udp_stream": 24, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1556832926.202480000" } ], "is_private": true, "observable_id": "observable-cb1deec5c921b5620f9ea128", "last_seen_epoch": "1556832926.202480000", "enrichment_state": "not_requested", "first_seen_epoch": "1556832926.201223000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "10.0.0.255", "evidence": [], "is_private": true, "observable_id": "observable-48eb7dbac24bc9129a758145", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.16.154.36", "evidence": [ { "udp_stream": 26, "frame_number": 690, "display_filter": "frame.number == 690", "timestamp_epoch": "1556832974.729338000" } ], "is_private": false, "observable_id": "observable-62e1577b3aa3c866b80beaaf", "last_seen_epoch": "1556832974.729338000", "enrichment_state": "not_requested", "first_seen_epoch": "1556832974.729338000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "104.16.155.36", "evidence": [ { "udp_stream": 26, "frame_number": 690, "display_filter": "frame.number == 690", "timestamp_epoch": "1556832974.729338000" } ], "is_private": false, "observable_id": "observable-971b4ee056014cc5c614c979", "last_seen_epoch": "1556832974.729338000", "enrichment_state": "not_requested", "first_seen_epoch": "1556832974.729338000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "131.107.255.255", "evidence": [ { "udp_stream": 30, "frame_number": 825, "display_filter": "frame.number == 825", "timestamp_epoch": "1556833288.329591000" } ], "is_private": false, "observable_id": "observable-f2d6fa54a34c0fca171344a9", "last_seen_epoch": "1556833288.329591000", "enrichment_state": "not_requested", "first_seen_epoch": "1556833288.329591000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "145.14.144.10", "evidence": [ { "udp_stream": 32, "frame_number": 835, "display_filter": "frame.number == 835", "timestamp_epoch": "1556833587.155224000" } ], "is_private": false, "observable_id": "observable-fda740449b4a302dfa570a50", "last_seen_epoch": "1556833587.155224000", "enrichment_state": "not_requested", "first_seen_epoch": "1556833587.155224000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "145.14.145.4", "evidence": [ { "udp_stream": 27, "frame_number": 711, "display_filter": "frame.number == 711", "timestamp_epoch": "1556832993.781309000" } ], "is_private": false, "observable_id": "observable-517558f76b0cc4894215096b", "last_seen_epoch": "1556832993.781309000", "enrichment_state": "not_requested", "first_seen_epoch": "1556832993.781309000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "145.14.145.99", "evidence": [ { "udp_stream": 33, "frame_number": 5255, "display_filter": "frame.number == 5255", "timestamp_epoch": "1556834493.173728000" } ], "is_private": false, "observable_id": "observable-c5c4552aa292c629f3c02300", "last_seen_epoch": "1556834493.173728000", "enrichment_state": "not_requested", "first_seen_epoch": "1556834493.173728000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "204.2.193.137", "evidence": [ { "udp_stream": 22, "frame_number": 410, "display_filter": "frame.number == 410", "timestamp_epoch": "1556832926.230910000" } ], "is_private": false, "observable_id": "observable-0396d27a1cf0b819fcaaa608", "last_seen_epoch": "1556832926.230910000", "enrichment_state": "not_requested", "first_seen_epoch": "1556832926.230910000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "204.2.193.138", "evidence": [ { "udp_stream": 22, "frame_number": 410, "display_filter": "frame.number == 410", "timestamp_epoch": "1556832926.230910000" } ], "is_private": false, "observable_id": "observable-418129c92239da56d38ee489", "last_seen_epoch": "1556832926.230910000", "enrichment_state": "not_requested", "first_seen_epoch": "1556832926.230910000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.22", "evidence": [], "is_private": false, "observable_id": "observable-75ab2ff411f290ae4e3cd84c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.252", "evidence": [], "is_private": false, "observable_id": "observable-0dfaf62fb107663f2bde9db4", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "http-host", "network-endpoint" ], "value": "239.255.255.250", "evidence": [ { "frame_number": 802, "display_filter": "frame.number == 802", "timestamp_epoch": "1556833039.389253000" }, { "frame_number": 804, "display_filter": "frame.number == 804", "timestamp_epoch": "1556833039.807841000" }, { "frame_number": 805, "display_filter": "frame.number == 805", "timestamp_epoch": "1556833042.397674000" }, { "frame_number": 806, "display_filter": "frame.number == 806", "timestamp_epoch": "1556833042.819378000" }, { "frame_number": 807, "display_filter": "frame.number == 807", "timestamp_epoch": "1556833045.408802000" }, { "frame_number": 808, "display_filter": "frame.number == 808", "timestamp_epoch": "1556833045.830853000" } ], "is_private": false, "observable_id": "observable-dd4209684c273583500780e2", "last_seen_epoch": "1556833045.830853000", "enrichment_state": "not_requested", "first_seen_epoch": "1556833039.389253000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "255.255.255.255", "evidence": [], "is_private": true, "observable_id": "observable-45f09be55a47e385328651ea", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv6", "roles": [ "dns-answer" ], "value": "fd3e:4f5a:5b81::1", "evidence": [ { "udp_stream": 31, "frame_number": 827, "display_filter": "frame.number == 827", "timestamp_epoch": "1556833288.330376000" } ], "is_private": true, "observable_id": "observable-f7cafc70e0c4f82c0bfca3a8", "last_seen_epoch": "1556833288.330376000", "enrichment_state": "not_requested", "first_seen_epoch": "1556833288.330376000" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "071837b8164d0d54c84e6e2af06f06335db5cfef64ee391934660caec70f2f6f", "evidence": [], "is_private": null, "observable_id": "observable-e6f4bba8ca2079fb02b9c74e", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "evidence": [], "is_private": null, "observable_id": "observable-7a2d259dc31b303de09744a4", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "url", "roles": [ "http-request" ], "value": "http://239.255.255.250:1900*", "evidence": [ { "frame_number": 802, "display_filter": "frame.number == 802", "timestamp_epoch": "1556833039.389253000" }, { "frame_number": 804, "display_filter": "frame.number == 804", "timestamp_epoch": "1556833039.807841000" }, { "frame_number": 805, "display_filter": "frame.number == 805", "timestamp_epoch": "1556833042.397674000" }, { "frame_number": 806, "display_filter": "frame.number == 806", "timestamp_epoch": "1556833042.819378000" }, { "frame_number": 807, "display_filter": "frame.number == 807", "timestamp_epoch": "1556833045.408802000" }, { "frame_number": 808, "display_filter": "frame.number == 808", "timestamp_epoch": "1556833045.830853000" } ], "is_private": null, "observable_id": "observable-183a04917e8aa0c4c5345183", "last_seen_epoch": "1556833045.830853000", "enrichment_state": "not_requested", "first_seen_epoch": "1556833039.389253000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://whatismyipaddress.com/", "evidence": [ { "tcp_stream": 49, "frame_number": 694, "display_filter": "frame.number == 694", "timestamp_epoch": "1556832974.764246000" } ], "is_private": null, "observable_id": "observable-be342767a83c507756bb7ccd", "last_seen_epoch": "1556832974.764246000", "enrichment_state": "not_requested", "first_seen_epoch": "1556832974.764246000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.msftncsi.com/ncsi.txt", "evidence": [ { "tcp_stream": 27, "frame_number": 414, "display_filter": "frame.number == 414", "timestamp_epoch": "1556832926.267461000" } ], "is_private": null, "observable_id": "observable-ffb917b9edb474496f6bca98", "last_seen_epoch": "1556832926.267461000", "enrichment_state": "not_requested", "first_seen_epoch": "1556832926.267461000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Microsoft NCSI", "evidence": [ { "tcp_stream": 27, "frame_number": 414, "display_filter": "frame.number == 414", "timestamp_epoch": "1556832926.267461000" } ], "is_private": null, "observable_id": "observable-dc73136ec07b3eb482c9c871", "last_seen_epoch": "1556832926.267461000", "enrichment_state": "not_requested", "first_seen_epoch": "1556832926.267461000" } ], "schema_version": "pcap-analysis-v1", "semantic_sha256": "30110b47eb7722b407caa6084fdbb6cbde0f12e5f8e17009e0f0244d32719fb9", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "attack_candidates": [], "analysis_key_material": { "source_sha256": "41c9c4db17a58581eed3fc7f0bbebfe93c68034e2457afe131503c1a9eafac56", "rulepack_version": "pcap-rules-v5", "analyzer_manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0" } }, "context": { "mode": "local-only", "matches": [], "coverage": { "truncated": false, "no_exact_match": 33, "observable_limit": 5000, "observables_total": 33, "matched_observables": 0, "observables_checked": 33, "prior_cases_checked": 50, "prior_case_limit_reached": true }, "created_at": "2026-09-22T16:04:31.432754+00:00", "session_id": "6356080a-6fd5-4a14-96b2-dedff3fa917d", "techniques": [], "interpretation": "No match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.", "schema_version": "pcap-context-v1", "snapshot_sha256": "9747aa796c7a1832b3297c8265b6d84a782e30ff3bdd924db961a7acd74f03d4", "source_actor_links": [], "external_enrichment": { "reason": "Requires explicit provider consent and privacy review", "status": "not-requested", "requests": 0 }, "source_semantic_sha256": "30110b47eb7722b407caa6084fdbb6cbde0f12e5f8e17009e0f0244d32719fb9", "cross_case_correlations": [ { "shared_count": 8, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 8, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 3, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 3, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 1, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 3, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 3, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 3, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 7, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." } ] }, "assessment": { "policy_version": "pcap-assessment-v3", "source_semantic_sha256": "30110b47eb7722b407caa6084fdbb6cbde0f12e5f8e17009e0f0244d32719fb9", "items": [ { "observable_id": "observable-b7260f33743c6cd748c31fab", "type": "domain", "value": "beguilesoft-dc.beguilesoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:02.985359+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:02.983062+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 2, "frame_number": 5, "display_filter": "frame.number == 5", "timestamp_epoch": "1556832918.613709000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1556832918.614024000" }, { "udp_stream": 16, "frame_number": 237, "display_filter": "frame.number == 237", "timestamp_epoch": "1556832922.070554000" }, { "udp_stream": 16, "frame_number": 238, "display_filter": "frame.number == 238", "timestamp_epoch": "1556832922.070887000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:02.981241+00:00" }, { "observable_id": "observable-eba7a4950c1589d99a9389b5", "type": "domain", "value": "beguilesoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:03.175110+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:03.173259+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 24, "frame_number": 408, "display_filter": "frame.number == 408", "timestamp_epoch": "1556832926.201223000" }, { "udp_stream": 24, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1556832926.202480000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:03.171210+00:00" }, { "observable_id": "observable-e3428aad446f708e95e28927", "type": "domain", "value": "breaux-win7-pc.beguilesoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:03.359207+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:03.354441+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 23, "frame_number": 406, "display_filter": "frame.number == 406", "timestamp_epoch": "1556832926.199445000" }, { "udp_stream": 23, "frame_number": 407, "display_filter": "frame.number == 407", "timestamp_epoch": "1556832926.199805000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:03.346362+00:00" }, { "observable_id": "observable-11308e0237c49f95b3d6ab7d", "type": "domain", "value": "dns.msftncsi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 30, "frame_number": 824, "display_filter": "frame.number == 824", "timestamp_epoch": "1556833288.302420000" }, { "udp_stream": 30, "frame_number": 825, "display_filter": "frame.number == 825", "timestamp_epoch": "1556833288.329591000" }, { "udp_stream": 31, "frame_number": 826, "display_filter": "frame.number == 826", "timestamp_epoch": "1556833288.330117000" }, { "udp_stream": 31, "frame_number": 827, "display_filter": "frame.number == 827", "timestamp_epoch": "1556833288.330376000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-94268df48ad5fdc8a0900ace", "type": "domain", "value": "files.000webhost.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 27, "frame_number": 710, "display_filter": "frame.number == 710", "timestamp_epoch": "1556832993.701960000" }, { "udp_stream": 27, "frame_number": 711, "display_filter": "frame.number == 711", "timestamp_epoch": "1556832993.781309000" }, { "udp_stream": 29, "frame_number": 818, "display_filter": "frame.number == 818", "timestamp_epoch": "1556833274.997255000" }, { "udp_stream": 29, "frame_number": 819, "display_filter": "frame.number == 819", "timestamp_epoch": "1556833276.007839000" }, { "udp_stream": 29, "frame_number": 820, "display_filter": "frame.number == 820", "timestamp_epoch": "1556833277.022496000" }, { "udp_stream": 29, "frame_number": 821, "display_filter": "frame.number == 821", "timestamp_epoch": "1556833279.034526000" }, { "udp_stream": 29, "frame_number": 822, "display_filter": "frame.number == 822", "timestamp_epoch": "1556833283.044125000" }, { "udp_stream": 29, "frame_number": 823, "display_filter": "frame.number == 823", "timestamp_epoch": "1556833287.107989000" }, { "udp_stream": 32, "frame_number": 834, "display_filter": "frame.number == 834", "timestamp_epoch": "1556833587.071526000" }, { "udp_stream": 32, "frame_number": 835, "display_filter": "frame.number == 835", "timestamp_epoch": "1556833587.155224000" }, { "udp_stream": 33, "frame_number": 5254, "display_filter": "frame.number == 5254", "timestamp_epoch": "1556834493.030295000" }, { "udp_stream": 33, "frame_number": 5255, "display_filter": "frame.number == 5255", "timestamp_epoch": "1556834493.173728000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-022092e2685292b669ac5887", "type": "domain", "value": "isatap.beguilesoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 17, "frame_number": 239, "display_filter": "frame.number == 239", "timestamp_epoch": "1556832922.070903000" }, { "udp_stream": 17, "frame_number": 240, "display_filter": "frame.number == 240", "timestamp_epoch": "1556832922.071030000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e4fc85f5e5a1661467df1475", "type": "domain", "value": "isatap.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 19, "frame_number": 279, "display_filter": "frame.number == 279", "timestamp_epoch": "1556832923.858883000" }, { "udp_stream": 19, "frame_number": 280, "display_filter": "frame.number == 280", "timestamp_epoch": "1556832923.882075000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-40b31057ae3841004ad9b762", "type": "domain", "value": "us-east-1.route-1000.000webhost.awex.io", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 27, "frame_number": 711, "display_filter": "frame.number == 711", "timestamp_epoch": "1556832993.781309000" }, { "udp_stream": 29, "frame_number": 823, "display_filter": "frame.number == 823", "timestamp_epoch": "1556833287.107989000" }, { "udp_stream": 32, "frame_number": 835, "display_filter": "frame.number == 835", "timestamp_epoch": "1556833587.155224000" }, { "udp_stream": 33, "frame_number": 5255, "display_filter": "frame.number == 5255", "timestamp_epoch": "1556834493.173728000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8f170c819042eb58ad6f9492", "type": "domain", "value": "whatismyipaddress.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:02.491292+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:02.487717+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 689, "display_filter": "frame.number == 689", "timestamp_epoch": "1556832974.687459000" }, { "udp_stream": 26, "frame_number": 690, "display_filter": "frame.number == 690", "timestamp_epoch": "1556832974.729338000" }, { "tcp_stream": 49, "frame_number": 694, "display_filter": "frame.number == 694", "timestamp_epoch": "1556832974.764246000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:02.484072+00:00" }, { "observable_id": "observable-08e46963fbb95bac48a9c3bb", "type": "domain", "value": "wpad.beguilesoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 14, "frame_number": 229, "display_filter": "frame.number == 229", "timestamp_epoch": "1556832921.197758000" }, { "udp_stream": 14, "frame_number": 230, "display_filter": "frame.number == 230", "timestamp_epoch": "1556832921.198017000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-54cbb0a2eeb7da8963da0203", "type": "domain", "value": "www.msftncsi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:46:30.477224+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:02.979381+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 22, "frame_number": 405, "display_filter": "frame.number == 405", "timestamp_epoch": "1556832926.060635000" }, { "udp_stream": 22, "frame_number": 410, "display_filter": "frame.number == 410", "timestamp_epoch": "1556832926.230910000" }, { "tcp_stream": 27, "frame_number": 414, "display_filter": "frame.number == 414", "timestamp_epoch": "1556832926.267461000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:02.976953+00:00" }, { "observable_id": "observable-8f7d8857ddab52349ea34f7d", "type": "ipv4", "value": "10.0.0.10", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 1, "frame_number": 4, "display_filter": "frame.number == 4", "timestamp_epoch": "1556832918.610302000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1556832918.614024000" }, { "udp_stream": 5, "frame_number": 80, "display_filter": "frame.number == 80", "timestamp_epoch": "1556832918.803720000" }, { "udp_stream": 7, "frame_number": 118, "display_filter": "frame.number == 118", "timestamp_epoch": "1556832918.886980000" }, { "udp_stream": 9, "frame_number": 154, "display_filter": "frame.number == 154", "timestamp_epoch": "1556832918.910589000" }, { "udp_stream": 16, "frame_number": 238, "display_filter": "frame.number == 238", "timestamp_epoch": "1556832922.070887000" }, { "udp_stream": 23, "frame_number": 407, "display_filter": "frame.number == 407", "timestamp_epoch": "1556832926.199805000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cb1deec5c921b5620f9ea128", "type": "ipv4", "value": "10.0.0.227", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 24, "frame_number": 408, "display_filter": "frame.number == 408", "timestamp_epoch": "1556832926.201223000" }, { "udp_stream": 24, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1556832926.202480000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-48eb7dbac24bc9129a758145", "type": "ipv4", "value": "10.0.0.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-62e1577b3aa3c866b80beaaf", "type": "ipv4", "value": "104.16.154.36", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:03.544731+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:03.540614+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 690, "display_filter": "frame.number == 690", "timestamp_epoch": "1556832974.729338000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:03.536116+00:00" }, { "observable_id": "observable-971b4ee056014cc5c614c979", "type": "ipv4", "value": "104.16.155.36", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 690, "display_filter": "frame.number == 690", "timestamp_epoch": "1556832974.729338000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f2d6fa54a34c0fca171344a9", "type": "ipv4", "value": "131.107.255.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 30, "frame_number": 825, "display_filter": "frame.number == 825", "timestamp_epoch": "1556833288.329591000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fda740449b4a302dfa570a50", "type": "ipv4", "value": "145.14.144.10", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 835, "display_filter": "frame.number == 835", "timestamp_epoch": "1556833587.155224000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-517558f76b0cc4894215096b", "type": "ipv4", "value": "145.14.145.4", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 27, "frame_number": 711, "display_filter": "frame.number == 711", "timestamp_epoch": "1556832993.781309000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c5c4552aa292c629f3c02300", "type": "ipv4", "value": "145.14.145.99", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 33, "frame_number": 5255, "display_filter": "frame.number == 5255", "timestamp_epoch": "1556834493.173728000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0396d27a1cf0b819fcaaa608", "type": "ipv4", "value": "204.2.193.137", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:47:03.744960+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:03.740755+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 22, "frame_number": 410, "display_filter": "frame.number == 410", "timestamp_epoch": "1556832926.230910000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:47:03.735320+00:00" }, { "observable_id": "observable-418129c92239da56d38ee489", "type": "ipv4", "value": "204.2.193.138", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 22, "frame_number": 410, "display_filter": "frame.number == 410", "timestamp_epoch": "1556832926.230910000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-75ab2ff411f290ae4e3cd84c", "type": "ipv4", "value": "224.0.0.22", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0dfaf62fb107663f2bde9db4", "type": "ipv4", "value": "224.0.0.252", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dd4209684c273583500780e2", "type": "ipv4", "value": "239.255.255.250", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "frame_number": 802, "display_filter": "frame.number == 802", "timestamp_epoch": "1556833039.389253000" }, { "frame_number": 804, "display_filter": "frame.number == 804", "timestamp_epoch": "1556833039.807841000" }, { "frame_number": 805, "display_filter": "frame.number == 805", "timestamp_epoch": "1556833042.397674000" }, { "frame_number": 806, "display_filter": "frame.number == 806", "timestamp_epoch": "1556833042.819378000" }, { "frame_number": 807, "display_filter": "frame.number == 807", "timestamp_epoch": "1556833045.408802000" }, { "frame_number": 808, "display_filter": "frame.number == 808", "timestamp_epoch": "1556833045.830853000" } ], "roles": [ "http-host", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-45f09be55a47e385328651ea", "type": "ipv4", "value": "255.255.255.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f7cafc70e0c4f82c0bfca3a8", "type": "ipv6", "value": "fd3e:4f5a:5b81::1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 31, "frame_number": 827, "display_filter": "frame.number == 827", "timestamp_epoch": "1556833288.330376000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e6f4bba8ca2079fb02b9c74e", "type": "sha256", "value": "071837b8164d0d54c84e6e2af06f06335db5cfef64ee391934660caec70f2f6f", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7a2d259dc31b303de09744a4", "type": "sha256", "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-183a04917e8aa0c4c5345183", "type": "url", "value": "http://239.255.255.250:1900*", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "frame_number": 802, "display_filter": "frame.number == 802", "timestamp_epoch": "1556833039.389253000" }, { "frame_number": 804, "display_filter": "frame.number == 804", "timestamp_epoch": "1556833039.807841000" }, { "frame_number": 805, "display_filter": "frame.number == 805", "timestamp_epoch": "1556833042.397674000" }, { "frame_number": 806, "display_filter": "frame.number == 806", "timestamp_epoch": "1556833042.819378000" }, { "frame_number": 807, "display_filter": "frame.number == 807", "timestamp_epoch": "1556833045.408802000" }, { "frame_number": 808, "display_filter": "frame.number == 808", "timestamp_epoch": "1556833045.830853000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-be342767a83c507756bb7ccd", "type": "url", "value": "http://whatismyipaddress.com/", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 49, "frame_number": 694, "display_filter": "frame.number == 694", "timestamp_epoch": "1556832974.764246000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ffb917b9edb474496f6bca98", "type": "url", "value": "http://www.msftncsi.com/ncsi.txt", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 27, "frame_number": 414, "display_filter": "frame.number == 414", "timestamp_epoch": "1556832926.267461000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null } ], "counts": { "observed": 32 }, "ioc_candidate_count": 0, "summary": "32 typed observations; 0 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.", "limitations": [ "No detections, no record, missing credentials and provider errors do not mean benign.", "Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.", "A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.", "Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure." ], "enrichment_plan": { "policy": "evidence-priority-v2", "items": [ { "observable_id": "observable-e6f4bba8ca2079fb02b9c74e", "type": "sha256", "value": "071837b8164d0d54c84e6e2af06f06335db5cfef64ee391934660caec70f2f6f", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7a2d259dc31b303de09744a4", "type": "sha256", "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-11308e0237c49f95b3d6ab7d", "type": "domain", "value": "dns.msftncsi.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-94268df48ad5fdc8a0900ace", "type": "domain", "value": "files.000webhost.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-022092e2685292b669ac5887", "type": "domain", "value": "isatap.beguilesoft.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e4fc85f5e5a1661467df1475", "type": "domain", "value": "isatap.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-08e46963fbb95bac48a9c3bb", "type": "domain", "value": "wpad.beguilesoft.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-40b31057ae3841004ad9b762", "type": "domain", "value": "us-east-1.route-1000.000webhost.awex.io", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-971b4ee056014cc5c614c979", "type": "ipv4", "value": "104.16.155.36", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f2d6fa54a34c0fca171344a9", "type": "ipv4", "value": "131.107.255.255", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fda740449b4a302dfa570a50", "type": "ipv4", "value": "145.14.144.10", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-517558f76b0cc4894215096b", "type": "ipv4", "value": "145.14.145.4", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c5c4552aa292c629f3c02300", "type": "ipv4", "value": "145.14.145.99", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-418129c92239da56d38ee489", "type": "ipv4", "value": "204.2.193.138", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8f170c819042eb58ad6f9492", "type": "domain", "value": "whatismyipaddress.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-54cbb0a2eeb7da8963da0203", "type": "domain", "value": "www.msftncsi.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b7260f33743c6cd748c31fab", "type": "domain", "value": "beguilesoft-dc.beguilesoft.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-eba7a4950c1589d99a9389b5", "type": "domain", "value": "beguilesoft.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e3428aad446f708e95e28927", "type": "domain", "value": "breaux-win7-pc.beguilesoft.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-62e1577b3aa3c866b80beaaf", "type": "ipv4", "value": "104.16.154.36", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0396d27a1cf0b819fcaaa608", "type": "ipv4", "value": "204.2.193.137", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false } ], "eligible_count": 21, "next_batch": [ "observable-e6f4bba8ca2079fb02b9c74e", "observable-7a2d259dc31b303de09744a4", "observable-11308e0237c49f95b3d6ab7d", "observable-94268df48ad5fdc8a0900ace", "observable-022092e2685292b669ac5887", "observable-e4fc85f5e5a1661467df1475", "observable-08e46963fbb95bac48a9c3bb", "observable-40b31057ae3841004ad9b762", "observable-971b4ee056014cc5c614c979", "observable-f2d6fa54a34c0fca171344a9" ], "scope": "Query recommendations, not IOC verdicts. Partial provider coverage stays pending; cooldowns/credential failures are not completed checks. Checked means completed attempted direct providers, not all available providers. Review before external disclosure." }, "assessment_sha256": "c94f4413652191d9dd45f234048c98c9db6760f4f217769a26a4a53e6aadc739" }, "enrichment": { "items": [ { "type": "ipv4", "value": "204.2.193.137", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:03.744960+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:03.740755+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:03.735320+00:00", "observable_id": "observable-0396d27a1cf0b819fcaaa608" }, { "type": "ipv4", "value": "104.16.154.36", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:03.544731+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:03.540614+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:03.536116+00:00", "observable_id": "observable-62e1577b3aa3c866b80beaaf" }, { "type": "domain", "value": "breaux-win7-pc.beguilesoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:03.359207+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:03.354441+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:03.346362+00:00", "observable_id": "observable-e3428aad446f708e95e28927" }, { "type": "domain", "value": "beguilesoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:03.175110+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:03.173259+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:03.171210+00:00", "observable_id": "observable-eba7a4950c1589d99a9389b5" }, { "type": "domain", "value": "beguilesoft-dc.beguilesoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:02.985359+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:02.983062+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:02.981241+00:00", "observable_id": "observable-b7260f33743c6cd748c31fab" }, { "type": "domain", "value": "www.msftncsi.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:46:30.477224+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:02.979381+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:02.976953+00:00", "observable_id": "observable-54cbb0a2eeb7da8963da0203" }, { "type": "domain", "value": "whatismyipaddress.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:47:02.491292+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:47:02.487717+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:47:02.484072+00:00", "observable_id": "observable-8f170c819042eb58ad6f9492" } ], "coverage": { "cache_hits": 1, "active_scans": 0, "batch_results": [ { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-8f170c819042eb58ad6f9492" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-8f170c819042eb58ad6f9492" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-54cbb0a2eeb7da8963da0203" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-54cbb0a2eeb7da8963da0203" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-b7260f33743c6cd748c31fab" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-b7260f33743c6cd748c31fab" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-eba7a4950c1589d99a9389b5" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-eba7a4950c1589d99a9389b5" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-e3428aad446f708e95e28927" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-e3428aad446f708e95e28927" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-62e1577b3aa3c866b80beaaf" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-62e1577b3aa3c866b80beaaf" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-0396d27a1cf0b819fcaaa608" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-0396d27a1cf0b819fcaaa608" } ], "batch_targets": 7, "payload_uploads": 0, "targets_omitted": 0, "retained_targets": 7, "full_urls_disclosed": 0, "provider_lookups_started": 6 }, "updated_at": "2026-09-22T17:47:03.934734+00:00", "schema_version": "pcap-reputation-v1", "snapshot_sha256": "27f952687490fdb3149a06846c14b430c36d0dbce0b3d67b5f26ba793ed9b610", "source_semantic_sha256": "30110b47eb7722b407caa6084fdbb6cbde0f12e5f8e17009e0f0244d32719fb9", "previous_snapshot_sha256": null }, "artifact_download_available": true, "source_tlp": "TLP:CLEAR", "techniques": [], "apt_matches": [], "public_note": "Public derivative: full packet extraction retained; provider evidence bounded; other-session details omitted. Original snapshot hashes do not hash this serialized derivative." }