{
  "id": "abad4a24-6a07-41cb-abc4-9bc1b8fb2303",
  "name": "PCAP verified workflow 2022-03-21 20260919",
  "description": "Explicit test workspace: real training capture; review remains draft. Not a production incident.",
  "status": "active",
  "domain": "enterprise-attack",
  "actor_ids": [],
  "technique_ids": [],
  "report_ids": [],
  "evidence_nodes": [
    {
      "id": "log-pcap:6df36b51-4b44-4660-b534-2fa89705e807",
      "type": "log-pcap-analysis",
      "label": "2022-03-21-traffic-analysis-exercise.pcap",
      "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2022-03-21-traffic-analysis-exercise.pcap\nCapture SHA-256: `d9b67e18bca13cf6135874fd81d167403c7cb6b8a422679948db914e9959b90d`\nSemantic result SHA-256: `f38dc6eb2db7e16e10a92b68527beec8e2509ef67cf4ab5380a35fc1909d09af`\nAnalyzer manifest SHA-256: `ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde`\n\n## Executive summary\n\nDecoded 16296 packets across 63 IP endpoints and 837 transport flows. Observed 640 DNS events, 38 HTTP requests, 313 TLS ClientHello events, and 2 exported HTTP object(s). Deterministic rules produced 8 finding(s): 0 high, 0 medium, and 8 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 16296\n- Duration: 22746.472749 seconds\n- Captured bytes: 6591621\n- Endpoints: 63\n- Flows: 837\n\n## Deterministic findings\n\n### LOW — Repeated unsuccessful DNS resolution\n\nRepeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.\n\nRule: `repeated-nxdomain@pcap-rules-v3`; confidence: 0.5; evidence: frame 3298, frame 3584, frame 3845, frame 3916, frame 4014.\n\nMetrics: `{\"domain\":\"wpad.burnincandle.com\",\"response_count\":42,\"source\":\"10.0.19.14\"}`\n\n### LOW — Repeated unsuccessful DNS resolution\n\nRepeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.\n\nRule: `repeated-nxdomain@pcap-rules-v3`; confidence: 0.5; evidence: frame 3300, frame 3586, frame 3851, frame 3918, frame 4016.\n\nMetrics: `{\"domain\":\"wpad.mshome.net\",\"response_count\":41,\"source\":\"10.0.19.14\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 3450 / TCP stream 23, frame 3452 / TCP stream 23, frame 3454 / TCP stream 23, frame 3458 / TCP stream 23, frame 3460 / TCP stream 23.\n\nMetrics: `{\"destination\":\"10.0.19.9\",\"event_count\":82,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.0.19.14\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 3473 / TCP stream 24, frame 3478 / TCP stream 24, frame 3481 / TCP stream 24, frame 3483 / TCP stream 24, frame 3485 / TCP stream 24.\n\nMetrics: `{\"destination\":\"10.0.19.9\",\"event_count\":182,\"operation_numbers\":[\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.0.19.14\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 816 / TCP stream 12, frame 818 / TCP stream 12, frame 820 / TCP stream 12, frame 822 / TCP stream 12, frame 824 / TCP stream 12.\n\nMetrics: `{\"destination\":\"10.0.19.9\",\"event_count\":51,\"operation_numbers\":[\"1\",\"16\",\"17\",\"18\",\"19\",\"20\",\"25\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.0.19.14\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 3451 / TCP stream 23, frame 3453 / TCP stream 23, frame 3455 / TCP stream 23, frame 3459 / TCP stream 23, frame 3461 / TCP stream 23.\n\nMetrics: `{\"destination\":\"10.0.19.14\",\"event_count\":82,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.0.19.9\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 3475 / TCP stream 24, frame 3480 / TCP stream 24, frame 3482 / TCP stream 24, frame 3484 / TCP stream 24, frame 3486 / TCP stream 24.\n\nMetrics: `{\"destination\":\"10.0.19.14\",\"event_count\":146,\"operation_numbers\":[\"1\",\"4,19,19,19,5\",\"4,4,4,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.0.19.9\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 817 / TCP stream 12, frame 819 / TCP stream 12, frame 821 / TCP stream 12, frame 823 / TCP stream 12, frame 825 / TCP stream 12.\n\nMetrics: `{\"destination\":\"10.0.19.14\",\"event_count\":51,\"operation_numbers\":[\"1\",\"16\",\"17\",\"18\",\"19\",\"20\",\"25\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.0.19.9\"}`\n\n## ATT&CK candidates\n\n- No deterministic ATT&CK candidates.\n\n## Identities\n\n- account: `DESKTOP-5QS3D5D$`; client IPs: 10.0.19.14; frames: 12633, 12641, 12643, 12655, 15402\n- account: `patrick.zimmerman`; client IPs: 10.0.19.14; frames: 3696, 4150, 4162, 4171, 4173\n- full-name: `Patrick Zimmerman`; client IPs: 10.0.19.14; frames: 3696, 4317\n- hostname: `BURNINCANDLE`; client IPs: 10.0.19.14, 169.254.179.89; frames: 3763, 3764, 3765, 3766, 3933\n- hostname: `BURNINCANDLE-DC`; client IPs: 10.0.19.9; frames: 3980\n- hostname: `DESKTOP-5QS3D5D`; client IPs: 10.0.19.14, 169.254.179.89; frames: 3771, 3773, 744, 3241, 3513\n- netbios-group: `BURNINCANDLE`; client IPs: unbound subject; frames: 3724, 3728, 3732, 3735, 3737\n\n## IOC and artifact candidates\n\n- domain: `antnosience.com`; roles: dns-query, tls-sni\n- domain: `api.msn.com`; roles: dns-query, tls-sni\n- domain: `arc.msn.com`; roles: dns-query, tls-sni\n- domain: `bupdater.com`; roles: dns-query, tls-sni\n- domain: `burnincandle-dc.burnincandle.com`; roles: dns-query\n- domain: `checkappexec.microsoft.com`; roles: dns-query, tls-sni\n- domain: `client.wns.windows.com`; roles: dns-query, tls-sni\n- domain: `config.edge.skype.com`; roles: dns-query, tls-sni\n- domain: `ctldl.windowsupdate.com`; roles: dns-query, http-host\n- domain: `desktop-lr77s6e.burnincandle.com`; roles: dns-query\n- domain: `dilimoretast.com`; roles: dns-query, tls-sni\n- domain: `dns.msftncsi.com`; roles: dns-query\n- domain: `ecs.office.com`; roles: dns-query, tls-sni\n- domain: `filebin.net`; roles: dns-query, tls-sni\n- domain: `fp-vp-nocache.azureedge.net`; roles: dns-query, tls-sni\n- domain: `fp-vp.azureedge.net`; roles: dns-query, tls-sni\n- domain: `fp-vs-nocache.azureedge.net`; roles: dns-query, tls-sni\n- domain: `licensing.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `login.microsoftonline.com`; roles: dns-query, tls-sni\n- domain: `msedge.api.cdp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `nexusrules.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `oceriesfornot.top`; roles: http-host\n- domain: `otectagain.top`; roles: dns-query, tls-sni\n- domain: `prod.nexusrules.live.com.akadns.net`; roles: dns-cname\n- domain: `r3.i.lencr.org`; roles: dns-query, http-host\n- domain: `seaskysafe.com`; roles: dns-query, tls-sni\n- domain: `settings-win.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `situla.bitbit.net`; roles: dns-query, tls-sni\n- domain: `spo-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `storecatalogrevocation.storequality.microsoft.com`; roles: dns-query, tls-sni\n- domain: `suncoastpinball.com`; roles: dns-query, tls-sni\n- domain: `t-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `teams-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `v10.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `wns.notify.trafficmanager.net`; roles: dns-cname\n- domain: `wpad.burnincandle.com`; roles: dns-query\n- domain: `wpad.mshome.net`; roles: dns-query\n- domain: `www.bing.com`; roles: dns-query, tls-sni\n- domain: `x1.c.lencr.org`; roles: dns-query, http-host\n- ipv4: `0.0.0.0`; roles: network-endpoint\n- ipv4: `10.0.19.1`; roles: network-endpoint\n- ipv4: `10.0.19.14`; roles: network-endpoint\n- ipv4: `10.0.19.255`; roles: network-endpoint\n- ipv4: `10.0.19.9`; roles: dns-answer, network-endpoint\n- ipv4: `104.80.96.219`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.136.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.21.200`; roles: dns-answer\n- ipv4: `13.107.246.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.42.16`; roles: dns-answer, network-endpoint\n- ipv4: `13.69.116.104`; roles: dns-answer, network-endpoint\n- ipv4: `13.69.239.74`; roles: dns-answer, network-endpoint\n- ipv4: `13.87.188.105`; roles: dns-answer, network-endpoint\n- ipv4: `13.89.179.10`; roles: dns-answer, network-endpoint\n- ipv4: `13.89.179.9`; roles: dns-answer, network-endpoint\n- ipv4: `131.107.255.255`; roles: dns-answer\n- ipv4: `157.245.142.66`; roles: dns-answer, network-endpoint\n- ipv4: `160.153.32.99`; roles: dns-answer, network-endpoint\n- ipv4: `169.254.179.89`; roles: network-endpoint\n- ipv4: `169.254.255.255`; roles: network-endpoint\n- ipv4: `184.85.64.91`; roles: dns-answer, network-endpoint\n- ipv4: `185.47.40.36`; roles: dns-answer, network-endpoint\n- ipv4: `188.166.154.118`; roles: network-endpoint\n- ipv4: `20.189.173.15`; roles: dns-answer, network-endpoint\n- ipv4: `20.189.173.2`; roles: dns-answer, network-endpoint\n- ipv4: `20.190.154.137`; roles: dns-answer\n- ipv4: `20.190.154.139`; roles: dns-answer\n- ipv4: `20.190.154.16`; roles: dns-answer\n- ipv4: `20.190.154.17`; roles: dns-answer\n- ipv4: `20.190.154.18`; roles: dns-answer\n- ipv4: `20.190.154.19`; roles: dns-answer\n- ipv4: `20.42.65.89`; roles: dns-answer, network-endpoint\n- ipv4: `20.44.10.123`; roles: dns-answer, network-endpoint\n- ipv4: `20.69.130.185`; roles: dns-answer, network-endpoint\n- ipv4: `20.72.205.209`; roles: dns-answer, network-endpoint\n- ipv4: `20.81.51.95`; roles: dns-answer, network-endpoint\n- ipv4: `20.81.52.156`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.200`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.203`; roles: dns-answer, network-endpoint\n- ipv4: `209.197.3.8`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.251`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.219.38.10`; roles: dns-answer, network-endpoint\n- ipv4: `23.219.38.40`; roles: dns-answer\n- ipv4: `23.227.198.203`; roles: dns-answer, network-endpoint\n- ipv4: `239.255.255.250`; roles: http-host, network-endpoint\n- ipv4: `255.255.255.255`; roles: network-endpoint\n- ipv4: `40.124.168.44`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.26.134`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.26.135`; roles: dns-answer\n- ipv4: `40.74.98.194`; roles: dns-answer, network-endpoint\n- ipv4: `40.83.240.146`; roles: dns-answer, network-endpoint\n- ipv4: `51.105.71.137`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.8.19`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.8.20`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.8.21`; roles: dns-answer, network-endpoint\n- ipv4: `52.113.194.132`; roles: dns-answer, network-endpoint\n- ipv4: `52.113.196.254`; roles: dns-answer, network-endpoint\n- ipv4: `52.137.108.250`; roles: dns-answer, network-endpoint\n- ipv4: `52.168.117.170`; roles: dns-answer, network-endpoint\n- ipv4: `52.182.143.208`; roles: dns-answer, network-endpoint\n- ipv4: `52.182.143.210`; roles: dns-answer, network-endpoint\n- ipv4: `52.183.220.149`; roles: dns-answer, network-endpoint\n- ipv4: `52.185.211.133`; roles: dns-answer, network-endpoint\n- ipv4: `68.142.107.1`; roles: dns-answer, network-endpoint\n- ipv4: `68.142.107.129`; roles: dns-answer, network-endpoint\n- ipv4: `69.28.162.0`; roles: dns-answer, network-endpoint\n- ipv4: `69.28.162.128`; roles: dns-answer, network-endpoint\n- ipv4: `72.21.81.200`; roles: dns-answer, network-endpoint\n- ipv4: `72.21.81.240`; roles: dns-answer, network-endpoint\n- ipv4: `87.238.33.7`; roles: dns-answer\n- ipv4: `87.238.33.8`; roles: dns-answer, network-endpoint\n- ipv4: `91.193.16.181`; roles: dns-answer, network-endpoint\n- ja3: `28a2c9bd18a11de089ef85a160da29e4`; roles: tls-client-fingerprint\n- ja3: `37f463bf4616ecd445d4a1937da06e19`; roles: tls-client-fingerprint\n- ja3: `3b5074b1b5d032e5620f69f9f700ff0e`; roles: tls-client-fingerprint\n- ja3: `6271f898ce5be7dd52b0fc260d0662b3`; roles: tls-client-fingerprint\n- ja3: `a0e9f5d64349fb13191bc781f81f42e1`; roles: tls-client-fingerprint\n- sha256: `67add1166b020ae61b8f5fc96813c04c2aa589960796865572a3c7e737613dfd`; roles: exported-object\n- sha256: `ac64292e91738bf97842e7e5d28373a3a52bdb0aa2bc48a0df512e34d1b41501`; roles: exported-object\n- url: `http://239.255.255.250:1900*`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?161b4282e13b6962`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?48e7354130cbe0e4`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?c66ea67221454a2e`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?c6c9c220471a286c`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0356947035b28e34`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1131f2daab4034ba`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8fd0590036de0ddd`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?36a063424dfa7851`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?416ee1a6826abea5`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?9770388e0c613755`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?d1adc478adff0d72`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?fcfd7669d19bb421`; roles: http-request\n- url: `http://oceriesfornot.top/`; roles: http-request\n- url: `http://r3.i.lencr.org/`; roles: http-request\n- url: `http://x1.c.lencr.org/`; roles: http-request\n- user_agent: `Microsoft-CryptoAPI/10.0`; roles: http-client\n- exported object `%2f`; SHA-256 `ac64292e91738bf97842e7e5d28373a3a52bdb0aa2bc48a0df512e34d1b41501`; size 393277 bytes\n- exported object `%2f(1)`; SHA-256 `67add1166b020ae61b8f5fc96813c04c2aa589960796865572a3c7e737613dfd`; size 1306 bytes\n\n## Actor similarity leads\n\n- No actor lead was calculated.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `6a2316caee77621222da55a0117f143ac0b4ad630ec057912dd940e824fe529d`; recorded 2026-09-19T12:09:11.063080+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":137,\"observable_limit\":5000,\"observables_checked\":137,\"observables_total\":137,\"prior_case_limit_reached\":false,\"prior_cases_checked\":10,\"truncated\":false}`\n\n- Prior analysis `29aa3ef8-47c9-4c47-b4cc-1ff3e0708142` shares 18 observations. This does not establish a common campaign.\n- Prior analysis `b79032a8-d69e-4ac1-bdd4-542473fa8e3b` shares 17 observations. This does not establish a common campaign.\n- Prior analysis `faf041c3-70e0-4a01-8780-10917e5e187c` shares 18 observations. This does not establish a common campaign.\n- Prior analysis `08324647-35af-4af2-8d82-4387eec03918` shares 19 observations. This does not establish a common campaign.\n- Prior analysis `616a90fa-f15e-4fcb-8d56-7b8e0eff5785` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `459e119d-191f-49e8-85ea-c78f9de41826` shares 14 observations. This does not establish a common campaign.\n- Prior analysis `7a2cfe72-f48d-4894-8a2d-8889cb3b11b2` shares 22 observations. This does not establish a common campaign.\n- Prior analysis `81373b30-6a59-49d1-89b0-bad73ed19eaa` shares 16 observations. This does not establish a common campaign.\n- Prior analysis `38851ad7-b3a0-423d-ae89-3b7be4e4b908` shares 19 observations. This does not establish a common campaign.\n- Prior analysis `bfccc426-aa9b-4007-8558-a66d37ecb90c` shares 19 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":2,\"exported_objects\":2,\"hashed_bytes\":394583,\"hashed_objects\":2,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":2,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":2}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 8/8, identities 7/7, observables 137/137, artifacts 2/2. Full returned inventory is in the JSON result.\n",
      "summary": "Decoded 16296 packets across 63 IP endpoints and 837 transport flows. Observed 640 DNS events, 38 HTTP requests, 313 TLS ClientHello events, and 2 exported HTTP object(s). Deterministic rules produced 8 finding(s): 0 high, 0 medium, and 8 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "observables": [
        {
          "type": "domain",
          "value": "antnosience.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 499 / UDP stream 0, frame 501 / UDP stream 0, frame 543 / UDP stream 3, frame 544 / UDP stream 3, frame 3262 / UDP stream 10 +15 more"
        },
        {
          "type": "domain",
          "value": "api.msn.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 4405 / UDP stream 68, frame 4414 / UDP stream 68, frame 4418 / TCP stream 57"
        },
        {
          "type": "domain",
          "value": "arc.msn.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 11610 / UDP stream 197, frame 11611 / UDP stream 197, frame 11615 / TCP stream 229"
        },
        {
          "type": "domain",
          "value": "bupdater.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 5735 / UDP stream 88, frame 5736 / UDP stream 88, frame 5740 / TCP stream 80, frame 5804 / TCP stream 82, frame 5840 / TCP stream 83 +15 more"
        },
        {
          "type": "domain",
          "value": "burnincandle-dc.burnincandle.com",
          "confidence": 1,
          "description": "dns-query; frame 3792 / UDP stream 34, frame 3793 / UDP stream 34, frame 3894 / UDP stream 49, frame 3895 / UDP stream 49, frame 4302 / UDP stream 67 +15 more"
        },
        {
          "type": "domain",
          "value": "checkappexec.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3520 / UDP stream 18, frame 3521 / UDP stream 18, frame 4725 / UDP stream 77, frame 4726 / UDP stream 77, frame 7956 / UDP stream 105 +4 more"
        },
        {
          "type": "domain",
          "value": "client.wns.windows.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3867 / UDP stream 48, frame 3873 / UDP stream 48, frame 3880 / TCP stream 32, frame 4093 / TCP stream 38"
        },
        {
          "type": "domain",
          "value": "config.edge.skype.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 8880 / UDP stream 125, frame 8881 / UDP stream 125, frame 8885 / TCP stream 146"
        },
        {
          "type": "domain",
          "value": "ctldl.windowsupdate.com",
          "confidence": 1,
          "description": "dns-query, http-host; frame 4069 / UDP stream 59, frame 4070 / UDP stream 59, frame 6062 / UDP stream 96, frame 6064 / UDP stream 96, frame 8621 / UDP stream 116 +15 more"
        },
        {
          "type": "domain",
          "value": "desktop-lr77s6e.burnincandle.com",
          "confidence": 1,
          "description": "dns-query; frame 7375 / UDP stream 101, frame 7376 / UDP stream 101"
        },
        {
          "type": "domain",
          "value": "dilimoretast.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 11265 / UDP stream 191, frame 11266 / UDP stream 191, frame 11279 / UDP stream 192, frame 11280 / UDP stream 192, frame 11437 / UDP stream 193 +15 more"
        },
        {
          "type": "domain",
          "value": "dns.msftncsi.com",
          "confidence": 1,
          "description": "dns-query; frame 3822 / UDP stream 37, frame 3824 / UDP stream 37"
        },
        {
          "type": "domain",
          "value": "ecs.office.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 14078 / UDP stream 287, frame 14079 / UDP stream 287, frame 15823 / UDP stream 350, frame 15824 / UDP stream 350, frame 14115 / TCP stream 353 +2 more"
        },
        {
          "type": "domain",
          "value": "filebin.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 5073 / UDP stream 86, frame 5075 / UDP stream 86, frame 5081 / TCP stream 78"
        },
        {
          "type": "domain",
          "value": "fp-vp-nocache.azureedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 4447 / UDP stream 71, frame 4452 / UDP stream 71, frame 4481 / TCP stream 59"
        },
        {
          "type": "domain",
          "value": "fp-vp.azureedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 4450 / UDP stream 74, frame 4456 / UDP stream 74, frame 4480 / TCP stream 60"
        },
        {
          "type": "domain",
          "value": "fp-vs-nocache.azureedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 4448 / UDP stream 72, frame 4453 / UDP stream 72, frame 4479 / TCP stream 62"
        },
        {
          "type": "domain",
          "value": "licensing.mp.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 12670 / UDP stream 236, frame 12671 / UDP stream 236, frame 12678 / TCP stream 285"
        },
        {
          "type": "domain",
          "value": "login.microsoftonline.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 11573 / UDP stream 196, frame 11583 / UDP stream 196, frame 11592 / TCP stream 228"
        },
        {
          "type": "domain",
          "value": "msedge.api.cdp.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 8845 / UDP stream 124, frame 8846 / UDP stream 124, frame 8850 / TCP stream 145"
        },
        {
          "type": "domain",
          "value": "nexusrules.officeapps.live.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 8569 / UDP stream 114, frame 8570 / UDP stream 114, frame 11802 / UDP stream 207, frame 11803 / UDP stream 207, frame 15155 / UDP stream 324 +4 more"
        },
        {
          "type": "domain",
          "value": "oceriesfornot.top",
          "confidence": 1,
          "description": "http-host; frame 4 / TCP stream 0"
        },
        {
          "type": "domain",
          "value": "otectagain.top",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 11231 / UDP stream 189, frame 11232 / UDP stream 189, frame 11249 / UDP stream 190, frame 11250 / UDP stream 190, frame 11733 / UDP stream 202 +15 more"
        },
        {
          "type": "domain",
          "value": "prod.nexusrules.live.com.akadns.net",
          "confidence": 1,
          "description": "dns-cname; frame 8570 / UDP stream 114, frame 11803 / UDP stream 207, frame 15156 / UDP stream 324"
        },
        {
          "type": "domain",
          "value": "r3.i.lencr.org",
          "confidence": 1,
          "description": "dns-query, http-host; frame 5748 / UDP stream 89, frame 5749 / UDP stream 89, frame 5753 / TCP stream 81"
        },
        {
          "type": "domain",
          "value": "seaskysafe.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 11196 / UDP stream 187, frame 11197 / UDP stream 187, frame 11212 / UDP stream 188, frame 11213 / UDP stream 188, frame 11669 / UDP stream 199 +15 more"
        },
        {
          "type": "domain",
          "value": "settings-win.data.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3379 / UDP stream 14, frame 3381 / UDP stream 14, frame 3826 / UDP stream 38, frame 3827 / UDP stream 38, frame 5969 / UDP stream 94 +15 more"
        },
        {
          "type": "domain",
          "value": "situla.bitbit.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 5098 / UDP stream 87, frame 5100 / UDP stream 87, frame 5104 / TCP stream 79"
        },
        {
          "type": "domain",
          "value": "spo-ring.msedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 4462 / UDP stream 76, frame 4467 / UDP stream 76, frame 4494 / TCP stream 65"
        },
        {
          "type": "domain",
          "value": "storecatalogrevocation.storequality.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 12768 / UDP stream 238, frame 12769 / UDP stream 238, frame 12773 / TCP stream 288"
        },
        {
          "type": "domain",
          "value": "suncoastpinball.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 564 / UDP stream 4, frame 566 / UDP stream 4, frame 573 / TCP stream 5, frame 1107 / TCP stream 13, frame 1703 / TCP stream 14 +2 more"
        },
        {
          "type": "domain",
          "value": "t-ring.msedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 4449 / UDP stream 73, frame 4454 / UDP stream 73, frame 4483 / TCP stream 61"
        },
        {
          "type": "domain",
          "value": "teams-ring.msedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 4451 / UDP stream 75, frame 4455 / UDP stream 75, frame 4482 / TCP stream 63"
        },
        {
          "type": "domain",
          "value": "v10.events.data.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 517 / UDP stream 1, frame 518 / UDP stream 1, frame 4039 / UDP stream 58, frame 4040 / UDP stream 58, frame 5944 / UDP stream 93 +15 more"
        },
        {
          "type": "domain",
          "value": "wns.notify.trafficmanager.net",
          "confidence": 1,
          "description": "dns-cname; frame 3873 / UDP stream 48"
        },
        {
          "type": "domain",
          "value": "wpad.burnincandle.com",
          "confidence": 1,
          "description": "dns-query; frame 3297 / UDP stream 11, frame 3298 / UDP stream 11, frame 3583 / UDP stream 20, frame 3584 / UDP stream 20, frame 3842 / UDP stream 40 +15 more"
        },
        {
          "type": "domain",
          "value": "wpad.mshome.net",
          "confidence": 1,
          "description": "dns-query; frame 3299 / UDP stream 12, frame 3300 / UDP stream 12, frame 3585 / UDP stream 21, frame 3586 / UDP stream 21, frame 3849 / UDP stream 43 +15 more"
        },
        {
          "type": "domain",
          "value": "www.bing.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 4446 / UDP stream 70, frame 4463 / UDP stream 70, frame 4759 / UDP stream 78, frame 4760 / UDP stream 78, frame 11453 / UDP stream 194 +7 more"
        },
        {
          "type": "domain",
          "value": "x1.c.lencr.org",
          "confidence": 1,
          "description": "dns-query, http-host; frame 6054 / UDP stream 95, frame 6055 / UDP stream 95, frame 9263 / UDP stream 135, frame 9264 / UDP stream 135, frame 11752 / UDP stream 203 +7 more"
        },
        {
          "type": "ipv4",
          "value": "0.0.0.0",
          "confidence": 1,
          "description": "network-endpoint; no frame reference"
        },
        {
          "type": "ipv4",
          "value": "10.0.19.1",
          "confidence": 1,
          "description": "network-endpoint; no frame reference"
        },
        {
          "type": "ipv4",
          "value": "10.0.19.14",
          "confidence": 1,
          "description": "network-endpoint; no frame reference"
        },
        {
          "type": "ipv4",
          "value": "10.0.19.255",
          "confidence": 1,
          "description": "network-endpoint; no frame reference"
        },
        {
          "type": "ipv4",
          "value": "10.0.19.9",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 3431 / UDP stream 15, frame 3790 / UDP stream 32, frame 3793 / UDP stream 34, frame 3895 / UDP stream 49, frame 4130 / UDP stream 65 +15 more"
        },
        {
          "type": "ipv4",
          "value": "104.80.96.219",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 5749 / UDP stream 89, frame 6055 / UDP stream 95, frame 9264 / UDP stream 135, frame 11753 / UDP stream 203, frame 14367 / UDP stream 292"
        },
        {
          "type": "ipv4",
          "value": "13.107.136.254",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 4467 / UDP stream 76"
        },
        {
          "type": "ipv4",
          "value": "13.107.21.200",
          "confidence": 1,
          "description": "dns-answer; frame 4463 / UDP stream 70, frame 4760 / UDP stream 78, frame 11454 / UDP stream 194"
        },
        {
          "type": "ipv4",
          "value": "13.107.246.254",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 4454 / UDP stream 73"
        },
        {
          "type": "ipv4",
          "value": "13.107.42.16",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 8881 / UDP stream 125"
        },
        {
          "type": "ipv4",
          "value": "13.69.116.104",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 5945 / UDP stream 93"
        },
        {
          "type": "ipv4",
          "value": "13.69.239.74",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 10044 / UDP stream 158"
        },
        {
          "type": "ipv4",
          "value": "13.87.188.105",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 3521 / UDP stream 18"
        },
        {
          "type": "ipv4",
          "value": "13.89.179.10",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 8691 / UDP stream 119"
        },
        {
          "type": "ipv4",
          "value": "13.89.179.9",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 4040 / UDP stream 58"
        },
        {
          "type": "ipv4",
          "value": "131.107.255.255",
          "confidence": 1,
          "description": "dns-answer; frame 3824 / UDP stream 37"
        },
        {
          "type": "ipv4",
          "value": "157.245.142.66",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 501 / UDP stream 0, frame 544 / UDP stream 3, frame 3263 / UDP stream 10, frame 3322 / UDP stream 13, frame 3547 / UDP stream 19 +15 more"
        },
        {
          "type": "ipv4",
          "value": "160.153.32.99",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 566 / UDP stream 4"
        },
        {
          "type": "ipv4",
          "value": "169.254.179.89",
          "confidence": 1,
          "description": "network-endpoint; no frame reference"
        },
        {
          "type": "ipv4",
          "value": "169.254.255.255",
          "confidence": 1,
          "description": "network-endpoint; no frame reference"
        },
        {
          "type": "ipv4",
          "value": "184.85.64.91",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 12769 / UDP stream 238"
        },
        {
          "type": "ipv4",
          "value": "185.47.40.36",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 5075 / UDP stream 86"
        },
        {
          "type": "ipv4",
          "value": "188.166.154.118",
          "confidence": 1,
          "description": "network-endpoint; no frame reference"
        },
        {
          "type": "ipv4",
          "value": "20.189.173.15",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 518 / UDP stream 1"
        },
        {
          "type": "ipv4",
          "value": "20.189.173.2",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 10808 / UDP stream 174"
        },
        {
          "type": "ipv4",
          "value": "20.190.154.137",
          "confidence": 1,
          "description": "dns-answer; frame 11583 / UDP stream 196"
        },
        {
          "type": "ipv4",
          "value": "20.190.154.139",
          "confidence": 1,
          "description": "dns-answer; frame 11583 / UDP stream 196"
        },
        {
          "type": "ipv4",
          "value": "20.190.154.16",
          "confidence": 1,
          "description": "dns-answer; frame 11583 / UDP stream 196"
        },
        {
          "type": "ipv4",
          "value": "20.190.154.17",
          "confidence": 1,
          "description": "dns-answer; frame 11583 / UDP stream 196"
        },
        {
          "type": "ipv4",
          "value": "20.190.154.18",
          "confidence": 1,
          "description": "dns-answer; frame 11583 / UDP stream 196"
        },
        {
          "type": "ipv4",
          "value": "20.190.154.19",
          "confidence": 1,
          "description": "dns-answer; frame 11583 / UDP stream 196"
        },
        {
          "type": "ipv4",
          "value": "20.42.65.89",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 15204 / UDP stream 325"
        },
        {
          "type": "ipv4",
          "value": "20.44.10.123",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 9233 / UDP stream 134"
        },
        {
          "type": "ipv4",
          "value": "20.69.130.185",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 11611 / UDP stream 197"
        },
        {
          "type": "ipv4",
          "value": "20.72.205.209",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 14763 / UDP stream 309"
        },
        {
          "type": "ipv4",
          "value": "20.81.51.95",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 4726 / UDP stream 77"
        },
        {
          "type": "ipv4",
          "value": "20.81.52.156",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 7957 / UDP stream 105"
        },
        {
          "type": "ipv4",
          "value": "204.79.197.200",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 4463 / UDP stream 70, frame 4760 / UDP stream 78, frame 11454 / UDP stream 194"
        },
        {
          "type": "ipv4",
          "value": "204.79.197.203",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 4414 / UDP stream 68"
        },
        {
          "type": "ipv4",
          "value": "209.197.3.8",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 8622 / UDP stream 116, frame 11763 / UDP stream 204, frame 12498 / UDP stream 230"
        },
        {
          "type": "ipv4",
          "value": "224.0.0.22",
          "confidence": 1,
          "description": "network-endpoint; no frame reference"
        },
        {
          "type": "ipv4",
          "value": "224.0.0.251",
          "confidence": 1,
          "description": "network-endpoint; no frame reference"
        },
        {
          "type": "ipv4",
          "value": "224.0.0.252",
          "confidence": 1,
          "description": "network-endpoint; no frame reference"
        },
        {
          "type": "ipv4",
          "value": "23.219.38.10",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 14817 / UDP stream 310"
        },
        {
          "type": "ipv4",
          "value": "23.219.38.40",
          "confidence": 1,
          "description": "dns-answer; frame 14817 / UDP stream 310"
        },
        {
          "type": "ipv4",
          "value": "23.227.198.203",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 5736 / UDP stream 88"
        },
        {
          "type": "ipv4",
          "value": "239.255.255.250",
          "confidence": 1,
          "description": "http-host, network-endpoint; frame 3730, frame 3739, frame 3742, frame 3745, frame 3747 +15 more"
        },
        {
          "type": "ipv4",
          "value": "255.255.255.255",
          "confidence": 1,
          "description": "network-endpoint; no frame reference"
        },
        {
          "type": "ipv4",
          "value": "40.124.168.44",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 8846 / UDP stream 124"
        },
        {
          "type": "ipv4",
          "value": "40.126.26.134",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 11583 / UDP stream 196"
        },
        {
          "type": "ipv4",
          "value": "40.126.26.135",
          "confidence": 1,
          "description": "dns-answer; frame 11583 / UDP stream 196"
        },
        {
          "type": "ipv4",
          "value": "40.74.98.194",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 11881 / UDP stream 209"
        },
        {
          "type": "ipv4",
          "value": "40.83.240.146",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 3873 / UDP stream 48"
        },
        {
          "type": "ipv4",
          "value": "51.105.71.137",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 13156 / UDP stream 255"
        },
        {
          "type": "ipv4",
          "value": "52.109.8.19",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 11803 / UDP stream 207"
        },
        {
          "type": "ipv4",
          "value": "52.109.8.20",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 8570 / UDP stream 114"
        },
        {
          "type": "ipv4",
          "value": "52.109.8.21",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 15156 / UDP stream 324"
        },
        {
          "type": "ipv4",
          "value": "52.113.194.132",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 14079 / UDP stream 287, frame 15824 / UDP stream 350"
        },
        {
          "type": "ipv4",
          "value": "52.113.196.254",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 4455 / UDP stream 75"
        },
        {
          "type": "ipv4",
          "value": "52.137.108.250",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 12671 / UDP stream 236"
        },
        {
          "type": "ipv4",
          "value": "52.168.117.170",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 14342 / UDP stream 291"
        }
      ],
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap"
      ],
      "source_sha256": "d9b67e18bca13cf6135874fd81d167403c7cb6b8a422679948db914e9959b90d",
      "semantic_sha256": "f38dc6eb2db7e16e10a92b68527beec8e2509ef67cf4ab5380a35fc1909d09af",
      "observable_count": 137,
      "evidence_copy_scope": "bounded-preview-full-evidence-retained-in-source-analysis",
      "source_analysis_ref": "/api/pcap/analyses/6df36b51-4b44-4660-b534-2fa89705e807",
      "suspicious_findings": [
        {
          "reason": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm. Rule repeated-nxdomain@pcap-rules-v3; confidence 50%.",
          "category": "Repeated unsuccessful DNS resolution",
          "evidence": "frame 3298 / UDP stream 11, frame 3584 / UDP stream 20, frame 3845 / UDP stream 40, frame 3916 / UDP stream 50, frame 4014 / UDP stream 55 +37 more",
          "severity": "low"
        },
        {
          "reason": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm. Rule repeated-nxdomain@pcap-rules-v3; confidence 50%.",
          "category": "Repeated unsuccessful DNS resolution",
          "evidence": "frame 3300 / UDP stream 12, frame 3586 / UDP stream 21, frame 3851 / UDP stream 43, frame 3918 / UDP stream 51, frame 4016 / UDP stream 56 +36 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 3450 / TCP stream 23, frame 3452 / TCP stream 23, frame 3454 / TCP stream 23, frame 3458 / TCP stream 23, frame 3460 / TCP stream 23 +77 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 3473 / TCP stream 24, frame 3478 / TCP stream 24, frame 3481 / TCP stream 24, frame 3483 / TCP stream 24, frame 3485 / TCP stream 24 +95 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 816 / TCP stream 12, frame 818 / TCP stream 12, frame 820 / TCP stream 12, frame 822 / TCP stream 12, frame 824 / TCP stream 12 +46 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 3451 / TCP stream 23, frame 3453 / TCP stream 23, frame 3455 / TCP stream 23, frame 3459 / TCP stream 23, frame 3461 / TCP stream 23 +77 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 3475 / TCP stream 24, frame 3480 / TCP stream 24, frame 3482 / TCP stream 24, frame 3484 / TCP stream 24, frame 3486 / TCP stream 24 +95 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 817 / TCP stream 12, frame 819 / TCP stream 12, frame 821 / TCP stream 12, frame 823 / TCP stream 12, frame 825 / TCP stream 12 +46 more",
          "severity": "low"
        }
      ],
      "observables_truncated": true,
      "actor_similarity_leads": [],
      "expected_suspicious_behaviors": []
    },
    {
      "id": "ioc:antnosience.com",
      "type": "ioc",
      "value": "antnosience.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 499 / UDP stream 0, frame 501 / UDP stream 0, frame 543 / UDP stream 3, frame 544 / UDP stream 3, frame 3262 / UDP stream 10 +15 more",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:api.msn.com",
      "type": "ioc",
      "value": "api.msn.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 4405 / UDP stream 68, frame 4414 / UDP stream 68, frame 4418 / TCP stream 57",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:arc.msn.com",
      "type": "ioc",
      "value": "arc.msn.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 11610 / UDP stream 197, frame 11611 / UDP stream 197, frame 11615 / TCP stream 229",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:bupdater.com",
      "type": "ioc",
      "value": "bupdater.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 5735 / UDP stream 88, frame 5736 / UDP stream 88, frame 5740 / TCP stream 80, frame 5804 / TCP stream 82, frame 5840 / TCP stream 83 +15 more",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:burnincandle-dc.burnincandle.com",
      "type": "ioc",
      "value": "burnincandle-dc.burnincandle.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query; frame 3792 / UDP stream 34, frame 3793 / UDP stream 34, frame 3894 / UDP stream 49, frame 3895 / UDP stream 49, frame 4302 / UDP stream 67 +15 more",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:checkappexec.microsoft.com",
      "type": "ioc",
      "value": "checkappexec.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 3520 / UDP stream 18, frame 3521 / UDP stream 18, frame 4725 / UDP stream 77, frame 4726 / UDP stream 77, frame 7956 / UDP stream 105 +4 more",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:client.wns.windows.com",
      "type": "ioc",
      "value": "client.wns.windows.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 3867 / UDP stream 48, frame 3873 / UDP stream 48, frame 3880 / TCP stream 32, frame 4093 / TCP stream 38",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:config.edge.skype.com",
      "type": "ioc",
      "value": "config.edge.skype.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 8880 / UDP stream 125, frame 8881 / UDP stream 125, frame 8885 / TCP stream 146",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:ctldl.windowsupdate.com",
      "type": "ioc",
      "value": "ctldl.windowsupdate.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, http-host; frame 4069 / UDP stream 59, frame 4070 / UDP stream 59, frame 6062 / UDP stream 96, frame 6064 / UDP stream 96, frame 8621 / UDP stream 116 +15 more",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:desktop-lr77s6e.burnincandle.com",
      "type": "ioc",
      "value": "desktop-lr77s6e.burnincandle.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query; frame 7375 / UDP stream 101, frame 7376 / UDP stream 101",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:dilimoretast.com",
      "type": "ioc",
      "value": "dilimoretast.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 11265 / UDP stream 191, frame 11266 / UDP stream 191, frame 11279 / UDP stream 192, frame 11280 / UDP stream 192, frame 11437 / UDP stream 193 +15 more",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:dns.msftncsi.com",
      "type": "ioc",
      "value": "dns.msftncsi.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query; frame 3822 / UDP stream 37, frame 3824 / UDP stream 37",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:ecs.office.com",
      "type": "ioc",
      "value": "ecs.office.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 14078 / UDP stream 287, frame 14079 / UDP stream 287, frame 15823 / UDP stream 350, frame 15824 / UDP stream 350, frame 14115 / TCP stream 353 +2 more",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:filebin.net",
      "type": "ioc",
      "value": "filebin.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 5073 / UDP stream 86, frame 5075 / UDP stream 86, frame 5081 / TCP stream 78",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fp-vp-nocache.azureedge.net",
      "type": "ioc",
      "value": "fp-vp-nocache.azureedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 4447 / UDP stream 71, frame 4452 / UDP stream 71, frame 4481 / TCP stream 59",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fp-vp.azureedge.net",
      "type": "ioc",
      "value": "fp-vp.azureedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 4450 / UDP stream 74, frame 4456 / UDP stream 74, frame 4480 / TCP stream 60",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fp-vs-nocache.azureedge.net",
      "type": "ioc",
      "value": "fp-vs-nocache.azureedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 4448 / UDP stream 72, frame 4453 / UDP stream 72, frame 4479 / TCP stream 62",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:licensing.mp.microsoft.com",
      "type": "ioc",
      "value": "licensing.mp.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 12670 / UDP stream 236, frame 12671 / UDP stream 236, frame 12678 / TCP stream 285",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:login.microsoftonline.com",
      "type": "ioc",
      "value": "login.microsoftonline.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 11573 / UDP stream 196, frame 11583 / UDP stream 196, frame 11592 / TCP stream 228",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:msedge.api.cdp.microsoft.com",
      "type": "ioc",
      "value": "msedge.api.cdp.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 8845 / UDP stream 124, frame 8846 / UDP stream 124, frame 8850 / TCP stream 145",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:nexusrules.officeapps.live.com",
      "type": "ioc",
      "value": "nexusrules.officeapps.live.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 8569 / UDP stream 114, frame 8570 / UDP stream 114, frame 11802 / UDP stream 207, frame 11803 / UDP stream 207, frame 15155 / UDP stream 324 +4 more",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:oceriesfornot.top",
      "type": "ioc",
      "value": "oceriesfornot.top",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "http-host; frame 4 / TCP stream 0",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:otectagain.top",
      "type": "ioc",
      "value": "otectagain.top",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 11231 / UDP stream 189, frame 11232 / UDP stream 189, frame 11249 / UDP stream 190, frame 11250 / UDP stream 190, frame 11733 / UDP stream 202 +15 more",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:prod.nexusrules.live.com.akadns.net",
      "type": "ioc",
      "value": "prod.nexusrules.live.com.akadns.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-cname; frame 8570 / UDP stream 114, frame 11803 / UDP stream 207, frame 15156 / UDP stream 324",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:r3.i.lencr.org",
      "type": "ioc",
      "value": "r3.i.lencr.org",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, http-host; frame 5748 / UDP stream 89, frame 5749 / UDP stream 89, frame 5753 / TCP stream 81",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:seaskysafe.com",
      "type": "ioc",
      "value": "seaskysafe.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 11196 / UDP stream 187, frame 11197 / UDP stream 187, frame 11212 / UDP stream 188, frame 11213 / UDP stream 188, frame 11669 / UDP stream 199 +15 more",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:settings-win.data.microsoft.com",
      "type": "ioc",
      "value": "settings-win.data.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 3379 / UDP stream 14, frame 3381 / UDP stream 14, frame 3826 / UDP stream 38, frame 3827 / UDP stream 38, frame 5969 / UDP stream 94 +15 more",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:situla.bitbit.net",
      "type": "ioc",
      "value": "situla.bitbit.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 5098 / UDP stream 87, frame 5100 / UDP stream 87, frame 5104 / TCP stream 79",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:spo-ring.msedge.net",
      "type": "ioc",
      "value": "spo-ring.msedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 4462 / UDP stream 76, frame 4467 / UDP stream 76, frame 4494 / TCP stream 65",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:storecatalogrevocation.storequality.microsoft.com",
      "type": "ioc",
      "value": "storecatalogrevocation.storequality.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 12768 / UDP stream 238, frame 12769 / UDP stream 238, frame 12773 / TCP stream 288",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:suncoastpinball.com",
      "type": "ioc",
      "value": "suncoastpinball.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 564 / UDP stream 4, frame 566 / UDP stream 4, frame 573 / TCP stream 5, frame 1107 / TCP stream 13, frame 1703 / TCP stream 14 +2 more",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:t-ring.msedge.net",
      "type": "ioc",
      "value": "t-ring.msedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 4449 / UDP stream 73, frame 4454 / UDP stream 73, frame 4483 / TCP stream 61",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:teams-ring.msedge.net",
      "type": "ioc",
      "value": "teams-ring.msedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 4451 / UDP stream 75, frame 4455 / UDP stream 75, frame 4482 / TCP stream 63",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:v10.events.data.microsoft.com",
      "type": "ioc",
      "value": "v10.events.data.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 517 / UDP stream 1, frame 518 / UDP stream 1, frame 4039 / UDP stream 58, frame 4040 / UDP stream 58, frame 5944 / UDP stream 93 +15 more",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:wns.notify.trafficmanager.net",
      "type": "ioc",
      "value": "wns.notify.trafficmanager.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-cname; frame 3873 / UDP stream 48",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:wpad.burnincandle.com",
      "type": "ioc",
      "value": "wpad.burnincandle.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query; frame 3297 / UDP stream 11, frame 3298 / UDP stream 11, frame 3583 / UDP stream 20, frame 3584 / UDP stream 20, frame 3842 / UDP stream 40 +15 more",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:wpad.mshome.net",
      "type": "ioc",
      "value": "wpad.mshome.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query; frame 3299 / UDP stream 12, frame 3300 / UDP stream 12, frame 3585 / UDP stream 21, frame 3586 / UDP stream 21, frame 3849 / UDP stream 43 +15 more",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:www.bing.com",
      "type": "ioc",
      "value": "www.bing.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, tls-sni; frame 4446 / UDP stream 70, frame 4463 / UDP stream 70, frame 4759 / UDP stream 78, frame 4760 / UDP stream 78, frame 11453 / UDP stream 194 +7 more",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:x1.c.lencr.org",
      "type": "ioc",
      "value": "x1.c.lencr.org",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-query, http-host; frame 6054 / UDP stream 95, frame 6055 / UDP stream 95, frame 9263 / UDP stream 135, frame 9264 / UDP stream 135, frame 11752 / UDP stream 203 +7 more",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:0.0.0.0",
      "type": "ioc",
      "value": "0.0.0.0",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "network-endpoint; no frame reference",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:10.0.19.1",
      "type": "ioc",
      "value": "10.0.19.1",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "network-endpoint; no frame reference",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:10.0.19.14",
      "type": "ioc",
      "value": "10.0.19.14",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "network-endpoint; no frame reference",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:10.0.19.255",
      "type": "ioc",
      "value": "10.0.19.255",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "network-endpoint; no frame reference",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:10.0.19.9",
      "type": "ioc",
      "value": "10.0.19.9",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 3431 / UDP stream 15, frame 3790 / UDP stream 32, frame 3793 / UDP stream 34, frame 3895 / UDP stream 49, frame 4130 / UDP stream 65 +15 more",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.80.96.219",
      "type": "ioc",
      "value": "104.80.96.219",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 5749 / UDP stream 89, frame 6055 / UDP stream 95, frame 9264 / UDP stream 135, frame 11753 / UDP stream 203, frame 14367 / UDP stream 292",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.107.136.254",
      "type": "ioc",
      "value": "13.107.136.254",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 4467 / UDP stream 76",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.107.21.200",
      "type": "ioc",
      "value": "13.107.21.200",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer; frame 4463 / UDP stream 70, frame 4760 / UDP stream 78, frame 11454 / UDP stream 194",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.107.246.254",
      "type": "ioc",
      "value": "13.107.246.254",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 4454 / UDP stream 73",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.107.42.16",
      "type": "ioc",
      "value": "13.107.42.16",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 8881 / UDP stream 125",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.69.116.104",
      "type": "ioc",
      "value": "13.69.116.104",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 5945 / UDP stream 93",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.69.239.74",
      "type": "ioc",
      "value": "13.69.239.74",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 10044 / UDP stream 158",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.87.188.105",
      "type": "ioc",
      "value": "13.87.188.105",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 3521 / UDP stream 18",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.89.179.10",
      "type": "ioc",
      "value": "13.89.179.10",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 8691 / UDP stream 119",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.89.179.9",
      "type": "ioc",
      "value": "13.89.179.9",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 4040 / UDP stream 58",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:131.107.255.255",
      "type": "ioc",
      "value": "131.107.255.255",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer; frame 3824 / UDP stream 37",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:157.245.142.66",
      "type": "ioc",
      "value": "157.245.142.66",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 501 / UDP stream 0, frame 544 / UDP stream 3, frame 3263 / UDP stream 10, frame 3322 / UDP stream 13, frame 3547 / UDP stream 19 +15 more",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:160.153.32.99",
      "type": "ioc",
      "value": "160.153.32.99",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 566 / UDP stream 4",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:169.254.179.89",
      "type": "ioc",
      "value": "169.254.179.89",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "network-endpoint; no frame reference",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:169.254.255.255",
      "type": "ioc",
      "value": "169.254.255.255",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "network-endpoint; no frame reference",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:184.85.64.91",
      "type": "ioc",
      "value": "184.85.64.91",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 12769 / UDP stream 238",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:185.47.40.36",
      "type": "ioc",
      "value": "185.47.40.36",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 5075 / UDP stream 86",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:188.166.154.118",
      "type": "ioc",
      "value": "188.166.154.118",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "network-endpoint; no frame reference",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.189.173.15",
      "type": "ioc",
      "value": "20.189.173.15",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 518 / UDP stream 1",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.189.173.2",
      "type": "ioc",
      "value": "20.189.173.2",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 10808 / UDP stream 174",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.190.154.137",
      "type": "ioc",
      "value": "20.190.154.137",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer; frame 11583 / UDP stream 196",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.190.154.139",
      "type": "ioc",
      "value": "20.190.154.139",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer; frame 11583 / UDP stream 196",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.190.154.16",
      "type": "ioc",
      "value": "20.190.154.16",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer; frame 11583 / UDP stream 196",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.190.154.17",
      "type": "ioc",
      "value": "20.190.154.17",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer; frame 11583 / UDP stream 196",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.190.154.18",
      "type": "ioc",
      "value": "20.190.154.18",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer; frame 11583 / UDP stream 196",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.190.154.19",
      "type": "ioc",
      "value": "20.190.154.19",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer; frame 11583 / UDP stream 196",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.42.65.89",
      "type": "ioc",
      "value": "20.42.65.89",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 15204 / UDP stream 325",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.44.10.123",
      "type": "ioc",
      "value": "20.44.10.123",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 9233 / UDP stream 134",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.69.130.185",
      "type": "ioc",
      "value": "20.69.130.185",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 11611 / UDP stream 197",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.72.205.209",
      "type": "ioc",
      "value": "20.72.205.209",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 14763 / UDP stream 309",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.81.51.95",
      "type": "ioc",
      "value": "20.81.51.95",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 4726 / UDP stream 77",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.81.52.156",
      "type": "ioc",
      "value": "20.81.52.156",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 7957 / UDP stream 105",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:204.79.197.200",
      "type": "ioc",
      "value": "204.79.197.200",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 4463 / UDP stream 70, frame 4760 / UDP stream 78, frame 11454 / UDP stream 194",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:204.79.197.203",
      "type": "ioc",
      "value": "204.79.197.203",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 4414 / UDP stream 68",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:209.197.3.8",
      "type": "ioc",
      "value": "209.197.3.8",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 8622 / UDP stream 116, frame 11763 / UDP stream 204, frame 12498 / UDP stream 230",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:224.0.0.22",
      "type": "ioc",
      "value": "224.0.0.22",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "network-endpoint; no frame reference",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:224.0.0.251",
      "type": "ioc",
      "value": "224.0.0.251",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "network-endpoint; no frame reference",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:224.0.0.252",
      "type": "ioc",
      "value": "224.0.0.252",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "network-endpoint; no frame reference",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:23.219.38.10",
      "type": "ioc",
      "value": "23.219.38.10",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 14817 / UDP stream 310",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:23.219.38.40",
      "type": "ioc",
      "value": "23.219.38.40",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer; frame 14817 / UDP stream 310",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:23.227.198.203",
      "type": "ioc",
      "value": "23.227.198.203",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 5736 / UDP stream 88",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:239.255.255.250",
      "type": "ioc",
      "value": "239.255.255.250",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "http-host, network-endpoint; frame 3730, frame 3739, frame 3742, frame 3745, frame 3747 +15 more",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:255.255.255.255",
      "type": "ioc",
      "value": "255.255.255.255",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "network-endpoint; no frame reference",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:40.124.168.44",
      "type": "ioc",
      "value": "40.124.168.44",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 8846 / UDP stream 124",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:40.126.26.134",
      "type": "ioc",
      "value": "40.126.26.134",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 11583 / UDP stream 196",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:40.126.26.135",
      "type": "ioc",
      "value": "40.126.26.135",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer; frame 11583 / UDP stream 196",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:40.74.98.194",
      "type": "ioc",
      "value": "40.74.98.194",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 11881 / UDP stream 209",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:40.83.240.146",
      "type": "ioc",
      "value": "40.83.240.146",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 3873 / UDP stream 48",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:51.105.71.137",
      "type": "ioc",
      "value": "51.105.71.137",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 13156 / UDP stream 255",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:52.109.8.19",
      "type": "ioc",
      "value": "52.109.8.19",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 11803 / UDP stream 207",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:52.109.8.20",
      "type": "ioc",
      "value": "52.109.8.20",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 8570 / UDP stream 114",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:52.109.8.21",
      "type": "ioc",
      "value": "52.109.8.21",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 15156 / UDP stream 324",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:52.113.194.132",
      "type": "ioc",
      "value": "52.113.194.132",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 14079 / UDP stream 287, frame 15824 / UDP stream 350",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:52.113.196.254",
      "type": "ioc",
      "value": "52.113.196.254",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 4455 / UDP stream 75",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:52.137.108.250",
      "type": "ioc",
      "value": "52.137.108.250",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 12671 / UDP stream 236",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:52.168.117.170",
      "type": "ioc",
      "value": "52.168.117.170",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "description": "dns-answer, network-endpoint; frame 14342 / UDP stream 291",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "finding-b3a5d7a8db6cdcb181e9f3ea",
      "type": "pcap-finding",
      "label": "Repeated unsuccessful DNS resolution",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "domain": "wpad.burnincandle.com",
        "source": "10.0.19.14",
        "response_count": 42
      },
      "rule_id": "repeated-nxdomain",
      "severity": "low",
      "confidence": 0.5,
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "explanation": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "udp_stream": 11,
          "frame_number": 3298,
          "display_filter": "frame.number == 3298",
          "timestamp_epoch": "1647896803.730603000"
        },
        {
          "udp_stream": 20,
          "frame_number": 3584,
          "display_filter": "frame.number == 3584",
          "timestamp_epoch": "1647897403.696658000"
        },
        {
          "udp_stream": 40,
          "frame_number": 3845,
          "display_filter": "frame.number == 3845",
          "timestamp_epoch": "1647898111.854034000"
        },
        {
          "udp_stream": 50,
          "frame_number": 3916,
          "display_filter": "frame.number == 3916",
          "timestamp_epoch": "1647898113.838694000"
        },
        {
          "udp_stream": 55,
          "frame_number": 4014,
          "display_filter": "frame.number == 4014",
          "timestamp_epoch": "1647898132.383360000"
        },
        {
          "udp_stream": 60,
          "frame_number": 4079,
          "display_filter": "frame.number == 4079",
          "timestamp_epoch": "1647898192.390434000"
        },
        {
          "udp_stream": 62,
          "frame_number": 4118,
          "display_filter": "frame.number == 4118",
          "timestamp_epoch": "1647898792.360245000"
        },
        {
          "udp_stream": 62,
          "frame_number": 4119,
          "display_filter": "frame.number == 4119",
          "timestamp_epoch": "1647898792.360754000"
        },
        {
          "udp_stream": 83,
          "frame_number": 5014,
          "display_filter": "frame.number == 5014",
          "timestamp_epoch": "1647899392.324173000"
        },
        {
          "udp_stream": 90,
          "frame_number": 5782,
          "display_filter": "frame.number == 5782",
          "timestamp_epoch": "1647899730.286884000"
        },
        {
          "udp_stream": 98,
          "frame_number": 6091,
          "display_filter": "frame.number == 6091",
          "timestamp_epoch": "1647899992.296362000"
        },
        {
          "udp_stream": 103,
          "frame_number": 7951,
          "display_filter": "frame.number == 7951",
          "timestamp_epoch": "1647900592.256090000"
        },
        {
          "udp_stream": 110,
          "frame_number": 8431,
          "display_filter": "frame.number == 8431",
          "timestamp_epoch": "1647901192.230372000"
        },
        {
          "udp_stream": 32,
          "frame_number": 8652,
          "display_filter": "frame.number == 8652",
          "timestamp_epoch": "1647901792.204194000"
        },
        {
          "udp_stream": 122,
          "frame_number": 8818,
          "display_filter": "frame.number == 8818",
          "timestamp_epoch": "1647902392.176830000"
        },
        {
          "udp_stream": 128,
          "frame_number": 9041,
          "display_filter": "frame.number == 9041",
          "timestamp_epoch": "1647902992.140343000"
        },
        {
          "udp_stream": 132,
          "frame_number": 9197,
          "display_filter": "frame.number == 9197",
          "timestamp_epoch": "1647903592.105367000"
        },
        {
          "udp_stream": 138,
          "frame_number": 9368,
          "display_filter": "frame.number == 9368",
          "timestamp_epoch": "1647904192.085004000"
        },
        {
          "udp_stream": 147,
          "frame_number": 9699,
          "display_filter": "frame.number == 9699",
          "timestamp_epoch": "1647904792.054737000"
        },
        {
          "udp_stream": 155,
          "frame_number": 9947,
          "display_filter": "frame.number == 9947",
          "timestamp_epoch": "1647905392.017569000"
        },
        {
          "udp_stream": 160,
          "frame_number": 10157,
          "display_filter": "frame.number == 10157",
          "timestamp_epoch": "1647905991.987275000"
        },
        {
          "udp_stream": 165,
          "frame_number": 10355,
          "display_filter": "frame.number == 10355",
          "timestamp_epoch": "1647906591.950253000"
        },
        {
          "udp_stream": 171,
          "frame_number": 10754,
          "display_filter": "frame.number == 10754",
          "timestamp_epoch": "1647907191.917931000"
        },
        {
          "udp_stream": 176,
          "frame_number": 10913,
          "display_filter": "frame.number == 10913",
          "timestamp_epoch": "1647907791.889455000"
        },
        {
          "udp_stream": 183,
          "frame_number": 11158,
          "display_filter": "frame.number == 11158",
          "timestamp_epoch": "1647908391.857378000"
        },
        {
          "udp_stream": 205,
          "frame_number": 11782,
          "display_filter": "frame.number == 11782",
          "timestamp_epoch": "1647908991.827209000"
        },
        {
          "udp_stream": 213,
          "frame_number": 12004,
          "display_filter": "frame.number == 12004",
          "timestamp_epoch": "1647909591.794268000"
        },
        {
          "udp_stream": 222,
          "frame_number": 12284,
          "display_filter": "frame.number == 12284",
          "timestamp_epoch": "1647910191.759611000"
        },
        {
          "udp_stream": 231,
          "frame_number": 12525,
          "display_filter": "frame.number == 12525",
          "timestamp_epoch": "1647910791.721741000"
        },
        {
          "udp_stream": 246,
          "frame_number": 12926,
          "display_filter": "frame.number == 12926",
          "timestamp_epoch": "1647911391.684226000"
        },
        {
          "udp_stream": 256,
          "frame_number": 13202,
          "display_filter": "frame.number == 13202",
          "timestamp_epoch": "1647911991.654034000"
        },
        {
          "udp_stream": 265,
          "frame_number": 13412,
          "display_filter": "frame.number == 13412",
          "timestamp_epoch": "1647912591.627274000"
        },
        {
          "udp_stream": 274,
          "frame_number": 13795,
          "display_filter": "frame.number == 13795",
          "timestamp_epoch": "1647913191.596107000"
        },
        {
          "udp_stream": 280,
          "frame_number": 13989,
          "display_filter": "frame.number == 13989",
          "timestamp_epoch": "1647913791.566161000"
        },
        {
          "udp_stream": 289,
          "frame_number": 14312,
          "display_filter": "frame.number == 14312",
          "timestamp_epoch": "1647914391.542881000"
        },
        {
          "udp_stream": 299,
          "frame_number": 14537,
          "display_filter": "frame.number == 14537",
          "timestamp_epoch": "1647914991.518068000"
        },
        {
          "udp_stream": 311,
          "frame_number": 14826,
          "display_filter": "frame.number == 14826",
          "timestamp_epoch": "1647915591.487537000"
        },
        {
          "udp_stream": 322,
          "frame_number": 15145,
          "display_filter": "frame.number == 15145",
          "timestamp_epoch": "1647916191.461328000"
        },
        {
          "udp_stream": 331,
          "frame_number": 15372,
          "display_filter": "frame.number == 15372",
          "timestamp_epoch": "1647916791.434427000"
        },
        {
          "udp_stream": 339,
          "frame_number": 15570,
          "display_filter": "frame.number == 15570",
          "timestamp_epoch": "1647917391.399245000"
        },
        {
          "udp_stream": 346,
          "frame_number": 15767,
          "display_filter": "frame.number == 15767",
          "timestamp_epoch": "1647917991.360726000"
        },
        {
          "udp_stream": 355,
          "frame_number": 16001,
          "display_filter": "frame.number == 16001",
          "timestamp_epoch": "1647918591.326440000"
        }
      ]
    },
    {
      "id": "finding-c34632857f7cbf7d79146e68",
      "type": "pcap-finding",
      "label": "Repeated unsuccessful DNS resolution",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "domain": "wpad.mshome.net",
        "source": "10.0.19.14",
        "response_count": 41
      },
      "rule_id": "repeated-nxdomain",
      "severity": "low",
      "confidence": 0.5,
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "explanation": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "udp_stream": 12,
          "frame_number": 3300,
          "display_filter": "frame.number == 3300",
          "timestamp_epoch": "1647896803.732244000"
        },
        {
          "udp_stream": 21,
          "frame_number": 3586,
          "display_filter": "frame.number == 3586",
          "timestamp_epoch": "1647897403.699036000"
        },
        {
          "udp_stream": 43,
          "frame_number": 3851,
          "display_filter": "frame.number == 3851",
          "timestamp_epoch": "1647898111.855443000"
        },
        {
          "udp_stream": 51,
          "frame_number": 3918,
          "display_filter": "frame.number == 3918",
          "timestamp_epoch": "1647898113.839108000"
        },
        {
          "udp_stream": 56,
          "frame_number": 4016,
          "display_filter": "frame.number == 4016",
          "timestamp_epoch": "1647898132.383920000"
        },
        {
          "udp_stream": 61,
          "frame_number": 4081,
          "display_filter": "frame.number == 4081",
          "timestamp_epoch": "1647898192.392675000"
        },
        {
          "udp_stream": 63,
          "frame_number": 4121,
          "display_filter": "frame.number == 4121",
          "timestamp_epoch": "1647898792.362398000"
        },
        {
          "udp_stream": 84,
          "frame_number": 5016,
          "display_filter": "frame.number == 5016",
          "timestamp_epoch": "1647899392.326523000"
        },
        {
          "udp_stream": 91,
          "frame_number": 5784,
          "display_filter": "frame.number == 5784",
          "timestamp_epoch": "1647899730.288672000"
        },
        {
          "udp_stream": 99,
          "frame_number": 6093,
          "display_filter": "frame.number == 6093",
          "timestamp_epoch": "1647899992.298308000"
        },
        {
          "udp_stream": 104,
          "frame_number": 7953,
          "display_filter": "frame.number == 7953",
          "timestamp_epoch": "1647900592.257878000"
        },
        {
          "udp_stream": 111,
          "frame_number": 8433,
          "display_filter": "frame.number == 8433",
          "timestamp_epoch": "1647901192.232240000"
        },
        {
          "udp_stream": 118,
          "frame_number": 8654,
          "display_filter": "frame.number == 8654",
          "timestamp_epoch": "1647901792.205809000"
        },
        {
          "udp_stream": 123,
          "frame_number": 8820,
          "display_filter": "frame.number == 8820",
          "timestamp_epoch": "1647902392.178780000"
        },
        {
          "udp_stream": 129,
          "frame_number": 9043,
          "display_filter": "frame.number == 9043",
          "timestamp_epoch": "1647902992.142589000"
        },
        {
          "udp_stream": 133,
          "frame_number": 9199,
          "display_filter": "frame.number == 9199",
          "timestamp_epoch": "1647903592.110381000"
        },
        {
          "udp_stream": 139,
          "frame_number": 9370,
          "display_filter": "frame.number == 9370",
          "timestamp_epoch": "1647904192.087383000"
        },
        {
          "udp_stream": 148,
          "frame_number": 9701,
          "display_filter": "frame.number == 9701",
          "timestamp_epoch": "1647904792.056888000"
        },
        {
          "udp_stream": 156,
          "frame_number": 9949,
          "display_filter": "frame.number == 9949",
          "timestamp_epoch": "1647905392.019817000"
        },
        {
          "udp_stream": 115,
          "frame_number": 10159,
          "display_filter": "frame.number == 10159",
          "timestamp_epoch": "1647905991.989608000"
        },
        {
          "udp_stream": 166,
          "frame_number": 10357,
          "display_filter": "frame.number == 10357",
          "timestamp_epoch": "1647906591.952736000"
        },
        {
          "udp_stream": 172,
          "frame_number": 10756,
          "display_filter": "frame.number == 10756",
          "timestamp_epoch": "1647907191.920306000"
        },
        {
          "udp_stream": 177,
          "frame_number": 10915,
          "display_filter": "frame.number == 10915",
          "timestamp_epoch": "1647907791.891321000"
        },
        {
          "udp_stream": 184,
          "frame_number": 11160,
          "display_filter": "frame.number == 11160",
          "timestamp_epoch": "1647908391.859182000"
        },
        {
          "udp_stream": 206,
          "frame_number": 11784,
          "display_filter": "frame.number == 11784",
          "timestamp_epoch": "1647908991.828577000"
        },
        {
          "udp_stream": 214,
          "frame_number": 12006,
          "display_filter": "frame.number == 12006",
          "timestamp_epoch": "1647909591.796744000"
        },
        {
          "udp_stream": 223,
          "frame_number": 12286,
          "display_filter": "frame.number == 12286",
          "timestamp_epoch": "1647910191.761968000"
        },
        {
          "udp_stream": 232,
          "frame_number": 12527,
          "display_filter": "frame.number == 12527",
          "timestamp_epoch": "1647910791.723893000"
        },
        {
          "udp_stream": 247,
          "frame_number": 12928,
          "display_filter": "frame.number == 12928",
          "timestamp_epoch": "1647911391.686640000"
        },
        {
          "udp_stream": 257,
          "frame_number": 13204,
          "display_filter": "frame.number == 13204",
          "timestamp_epoch": "1647911991.656408000"
        },
        {
          "udp_stream": 266,
          "frame_number": 13414,
          "display_filter": "frame.number == 13414",
          "timestamp_epoch": "1647912591.629330000"
        },
        {
          "udp_stream": 275,
          "frame_number": 13797,
          "display_filter": "frame.number == 13797",
          "timestamp_epoch": "1647913191.597895000"
        },
        {
          "udp_stream": 281,
          "frame_number": 13991,
          "display_filter": "frame.number == 13991",
          "timestamp_epoch": "1647913791.568310000"
        },
        {
          "udp_stream": 290,
          "frame_number": 14314,
          "display_filter": "frame.number == 14314",
          "timestamp_epoch": "1647914391.544845000"
        },
        {
          "udp_stream": 300,
          "frame_number": 14539,
          "display_filter": "frame.number == 14539",
          "timestamp_epoch": "1647914991.520269000"
        },
        {
          "udp_stream": 312,
          "frame_number": 14828,
          "display_filter": "frame.number == 14828",
          "timestamp_epoch": "1647915591.489576000"
        },
        {
          "udp_stream": 323,
          "frame_number": 15147,
          "display_filter": "frame.number == 15147",
          "timestamp_epoch": "1647916191.463679000"
        },
        {
          "udp_stream": 332,
          "frame_number": 15374,
          "display_filter": "frame.number == 15374",
          "timestamp_epoch": "1647916791.436655000"
        },
        {
          "udp_stream": 340,
          "frame_number": 15572,
          "display_filter": "frame.number == 15572",
          "timestamp_epoch": "1647917391.401519000"
        },
        {
          "udp_stream": 347,
          "frame_number": 15769,
          "display_filter": "frame.number == 15769",
          "timestamp_epoch": "1647917991.362925000"
        },
        {
          "udp_stream": 356,
          "frame_number": 16003,
          "display_filter": "frame.number == 16003",
          "timestamp_epoch": "1647918591.328918000"
        }
      ]
    },
    {
      "id": "finding-593a108c471240a6e4d77f6a",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.0.19.14",
        "protocol": "drsuapi",
        "destination": "10.0.19.9",
        "event_count": 82,
        "operation_numbers": [
          "0",
          "1",
          "12"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 23,
          "frame_number": 3450,
          "display_filter": "frame.number == 3450",
          "timestamp_epoch": "1647897130.329916000"
        },
        {
          "tcp_stream": 23,
          "frame_number": 3452,
          "display_filter": "frame.number == 3452",
          "timestamp_epoch": "1647897130.330833000"
        },
        {
          "tcp_stream": 23,
          "frame_number": 3454,
          "display_filter": "frame.number == 3454",
          "timestamp_epoch": "1647897130.331661000"
        },
        {
          "tcp_stream": 23,
          "frame_number": 3458,
          "display_filter": "frame.number == 3458",
          "timestamp_epoch": "1647897130.333439000"
        },
        {
          "tcp_stream": 23,
          "frame_number": 3460,
          "display_filter": "frame.number == 3460",
          "timestamp_epoch": "1647897130.333988000"
        },
        {
          "tcp_stream": 23,
          "frame_number": 3462,
          "display_filter": "frame.number == 3462",
          "timestamp_epoch": "1647897130.334759000"
        },
        {
          "tcp_stream": 42,
          "frame_number": 4206,
          "display_filter": "frame.number == 4206",
          "timestamp_epoch": "1647899008.789886000"
        },
        {
          "tcp_stream": 42,
          "frame_number": 4208,
          "display_filter": "frame.number == 4208",
          "timestamp_epoch": "1647899008.790396000"
        },
        {
          "tcp_stream": 42,
          "frame_number": 4210,
          "display_filter": "frame.number == 4210",
          "timestamp_epoch": "1647899008.791156000"
        },
        {
          "tcp_stream": 42,
          "frame_number": 4212,
          "display_filter": "frame.number == 4212",
          "timestamp_epoch": "1647899008.791779000"
        },
        {
          "tcp_stream": 72,
          "frame_number": 4843,
          "display_filter": "frame.number == 4843",
          "timestamp_epoch": "1647899069.647910000"
        },
        {
          "tcp_stream": 72,
          "frame_number": 4845,
          "display_filter": "frame.number == 4845",
          "timestamp_epoch": "1647899069.648662000"
        },
        {
          "tcp_stream": 72,
          "frame_number": 4847,
          "display_filter": "frame.number == 4847",
          "timestamp_epoch": "1647899069.649532000"
        },
        {
          "tcp_stream": 72,
          "frame_number": 4851,
          "display_filter": "frame.number == 4851",
          "timestamp_epoch": "1647899069.650809000"
        },
        {
          "tcp_stream": 72,
          "frame_number": 4853,
          "display_filter": "frame.number == 4853",
          "timestamp_epoch": "1647899069.651273000"
        },
        {
          "tcp_stream": 72,
          "frame_number": 4855,
          "display_filter": "frame.number == 4855",
          "timestamp_epoch": "1647899069.652082000"
        },
        {
          "tcp_stream": 126,
          "frame_number": 8021,
          "display_filter": "frame.number == 8021",
          "timestamp_epoch": "1647900730.232183000"
        },
        {
          "tcp_stream": 126,
          "frame_number": 8023,
          "display_filter": "frame.number == 8023",
          "timestamp_epoch": "1647900730.233113000"
        },
        {
          "tcp_stream": 126,
          "frame_number": 8025,
          "display_filter": "frame.number == 8025",
          "timestamp_epoch": "1647900730.234054000"
        },
        {
          "tcp_stream": 126,
          "frame_number": 8029,
          "display_filter": "frame.number == 8029",
          "timestamp_epoch": "1647900730.236009000"
        },
        {
          "tcp_stream": 126,
          "frame_number": 8031,
          "display_filter": "frame.number == 8031",
          "timestamp_epoch": "1647900730.236528000"
        },
        {
          "tcp_stream": 126,
          "frame_number": 8033,
          "display_filter": "frame.number == 8033",
          "timestamp_epoch": "1647900730.237364000"
        },
        {
          "tcp_stream": 130,
          "frame_number": 8098,
          "display_filter": "frame.number == 8098",
          "timestamp_epoch": "1647900774.085161000"
        },
        {
          "tcp_stream": 130,
          "frame_number": 8100,
          "display_filter": "frame.number == 8100",
          "timestamp_epoch": "1647900774.085821000"
        },
        {
          "tcp_stream": 130,
          "frame_number": 8102,
          "display_filter": "frame.number == 8102",
          "timestamp_epoch": "1647900774.086655000"
        },
        {
          "tcp_stream": 159,
          "frame_number": 9438,
          "display_filter": "frame.number == 9438",
          "timestamp_epoch": "1647904330.058457000"
        },
        {
          "tcp_stream": 159,
          "frame_number": 9440,
          "display_filter": "frame.number == 9440",
          "timestamp_epoch": "1647904330.059151000"
        },
        {
          "tcp_stream": 159,
          "frame_number": 9442,
          "display_filter": "frame.number == 9442",
          "timestamp_epoch": "1647904330.060195000"
        },
        {
          "tcp_stream": 159,
          "frame_number": 9446,
          "display_filter": "frame.number == 9446",
          "timestamp_epoch": "1647904330.061393000"
        },
        {
          "tcp_stream": 159,
          "frame_number": 9448,
          "display_filter": "frame.number == 9448",
          "timestamp_epoch": "1647904330.061881000"
        },
        {
          "tcp_stream": 159,
          "frame_number": 9450,
          "display_filter": "frame.number == 9450",
          "timestamp_epoch": "1647904330.062663000"
        },
        {
          "tcp_stream": 165,
          "frame_number": 9590,
          "display_filter": "frame.number == 9590",
          "timestamp_epoch": "1647904588.486786000"
        },
        {
          "tcp_stream": 165,
          "frame_number": 9592,
          "display_filter": "frame.number == 9592",
          "timestamp_epoch": "1647904588.487394000"
        },
        {
          "tcp_stream": 165,
          "frame_number": 9594,
          "display_filter": "frame.number == 9594",
          "timestamp_epoch": "1647904588.487966000"
        },
        {
          "tcp_stream": 188,
          "frame_number": 10460,
          "display_filter": "frame.number == 10460",
          "timestamp_epoch": "1647906954.856669000"
        },
        {
          "tcp_stream": 188,
          "frame_number": 10462,
          "display_filter": "frame.number == 10462",
          "timestamp_epoch": "1647906954.857548000"
        },
        {
          "tcp_stream": 188,
          "frame_number": 10464,
          "display_filter": "frame.number == 10464",
          "timestamp_epoch": "1647906954.858600000"
        },
        {
          "tcp_stream": 198,
          "frame_number": 10969,
          "display_filter": "frame.number == 10969",
          "timestamp_epoch": "1647907930.110233000"
        },
        {
          "tcp_stream": 198,
          "frame_number": 10971,
          "display_filter": "frame.number == 10971",
          "timestamp_epoch": "1647907930.110995000"
        },
        {
          "tcp_stream": 198,
          "frame_number": 10973,
          "display_filter": "frame.number == 10973",
          "timestamp_epoch": "1647907930.111776000"
        },
        {
          "tcp_stream": 198,
          "frame_number": 10977,
          "display_filter": "frame.number == 10977",
          "timestamp_epoch": "1647907930.112974000"
        },
        {
          "tcp_stream": 198,
          "frame_number": 10979,
          "display_filter": "frame.number == 10979",
          "timestamp_epoch": "1647907930.113518000"
        },
        {
          "tcp_stream": 198,
          "frame_number": 10981,
          "display_filter": "frame.number == 10981",
          "timestamp_epoch": "1647907930.113942000"
        },
        {
          "tcp_stream": 223,
          "frame_number": 11475,
          "display_filter": "frame.number == 11475",
          "timestamp_epoch": "1647908840.696407000"
        },
        {
          "tcp_stream": 223,
          "frame_number": 11480,
          "display_filter": "frame.number == 11480",
          "timestamp_epoch": "1647908840.696950000"
        },
        {
          "tcp_stream": 223,
          "frame_number": 11483,
          "display_filter": "frame.number == 11483",
          "timestamp_epoch": "1647908840.697862000"
        },
        {
          "tcp_stream": 225,
          "frame_number": 11497,
          "display_filter": "frame.number == 11497",
          "timestamp_epoch": "1647908840.701487000"
        },
        {
          "tcp_stream": 225,
          "frame_number": 11499,
          "display_filter": "frame.number == 11499",
          "timestamp_epoch": "1647908840.702094000"
        },
        {
          "tcp_stream": 225,
          "frame_number": 11501,
          "display_filter": "frame.number == 11501",
          "timestamp_epoch": "1647908840.702969000"
        },
        {
          "tcp_stream": 225,
          "frame_number": 11505,
          "display_filter": "frame.number == 11505",
          "timestamp_epoch": "1647908840.704548000"
        },
        {
          "tcp_stream": 225,
          "frame_number": 11507,
          "display_filter": "frame.number == 11507",
          "timestamp_epoch": "1647908840.704817000"
        },
        {
          "tcp_stream": 225,
          "frame_number": 11509,
          "display_filter": "frame.number == 11509",
          "timestamp_epoch": "1647908840.705354000"
        },
        {
          "tcp_stream": 261,
          "frame_number": 12220,
          "display_filter": "frame.number == 12220",
          "timestamp_epoch": "1647910170.412565000"
        },
        {
          "tcp_stream": 261,
          "frame_number": 12222,
          "display_filter": "frame.number == 12222",
          "timestamp_epoch": "1647910170.413416000"
        },
        {
          "tcp_stream": 261,
          "frame_number": 12224,
          "display_filter": "frame.number == 12224",
          "timestamp_epoch": "1647910170.414352000"
        },
        {
          "tcp_stream": 300,
          "frame_number": 12978,
          "display_filter": "frame.number == 12978",
          "timestamp_epoch": "1647911530.003178000"
        },
        {
          "tcp_stream": 300,
          "frame_number": 12980,
          "display_filter": "frame.number == 12980",
          "timestamp_epoch": "1647911530.003944000"
        },
        {
          "tcp_stream": 300,
          "frame_number": 12982,
          "display_filter": "frame.number == 12982",
          "timestamp_epoch": "1647911530.004826000"
        },
        {
          "tcp_stream": 300,
          "frame_number": 12986,
          "display_filter": "frame.number == 12986",
          "timestamp_epoch": "1647911530.006063000"
        },
        {
          "tcp_stream": 300,
          "frame_number": 12988,
          "display_filter": "frame.number == 12988",
          "timestamp_epoch": "1647911530.006552000"
        },
        {
          "tcp_stream": 300,
          "frame_number": 12990,
          "display_filter": "frame.number == 12990",
          "timestamp_epoch": "1647911530.007251000"
        },
        {
          "tcp_stream": 332,
          "frame_number": 13569,
          "display_filter": "frame.number == 13569",
          "timestamp_epoch": "1647913134.468590000"
        },
        {
          "tcp_stream": 332,
          "frame_number": 13571,
          "display_filter": "frame.number == 13571",
          "timestamp_epoch": "1647913134.469202000"
        },
        {
          "tcp_stream": 332,
          "frame_number": 13573,
          "display_filter": "frame.number == 13573",
          "timestamp_epoch": "1647913134.470106000"
        },
        {
          "tcp_stream": 356,
          "frame_number": 14098,
          "display_filter": "frame.number == 14098",
          "timestamp_epoch": "1647914217.148203000"
        },
        {
          "tcp_stream": 356,
          "frame_number": 14100,
          "display_filter": "frame.number == 14100",
          "timestamp_epoch": "1647914217.148795000"
        },
        {
          "tcp_stream": 356,
          "frame_number": 14102,
          "display_filter": "frame.number == 14102",
          "timestamp_epoch": "1647914217.149362000"
        },
        {
          "tcp_stream": 376,
          "frame_number": 14565,
          "display_filter": "frame.number == 14565",
          "timestamp_epoch": "1647915129.856757000"
        },
        {
          "tcp_stream": 376,
          "frame_number": 14567,
          "display_filter": "frame.number == 14567",
          "timestamp_epoch": "1647915129.857508000"
        },
        {
          "tcp_stream": 376,
          "frame_number": 14569,
          "display_filter": "frame.number == 14569",
          "timestamp_epoch": "1647915129.858309000"
        },
        {
          "tcp_stream": 376,
          "frame_number": 14573,
          "display_filter": "frame.number == 14573",
          "timestamp_epoch": "1647915129.859628000"
        },
        {
          "tcp_stream": 376,
          "frame_number": 14575,
          "display_filter": "frame.number == 14575",
          "timestamp_epoch": "1647915129.860112000"
        },
        {
          "tcp_stream": 376,
          "frame_number": 14577,
          "display_filter": "frame.number == 14577",
          "timestamp_epoch": "1647915129.860818000"
        },
        {
          "tcp_stream": 393,
          "frame_number": 14876,
          "display_filter": "frame.number == 14876",
          "timestamp_epoch": "1647915749.943400000"
        },
        {
          "tcp_stream": 393,
          "frame_number": 14878,
          "display_filter": "frame.number == 14878",
          "timestamp_epoch": "1647915749.943940000"
        },
        {
          "tcp_stream": 393,
          "frame_number": 14880,
          "display_filter": "frame.number == 14880",
          "timestamp_epoch": "1647915749.944642000"
        },
        {
          "tcp_stream": 455,
          "frame_number": 16088,
          "display_filter": "frame.number == 16088",
          "timestamp_epoch": "1647918729.788121000"
        },
        {
          "tcp_stream": 455,
          "frame_number": 16090,
          "display_filter": "frame.number == 16090",
          "timestamp_epoch": "1647918729.788791000"
        },
        {
          "tcp_stream": 455,
          "frame_number": 16092,
          "display_filter": "frame.number == 16092",
          "timestamp_epoch": "1647918729.789657000"
        },
        {
          "tcp_stream": 455,
          "frame_number": 16096,
          "display_filter": "frame.number == 16096",
          "timestamp_epoch": "1647918729.790856000"
        },
        {
          "tcp_stream": 455,
          "frame_number": 16098,
          "display_filter": "frame.number == 16098",
          "timestamp_epoch": "1647918729.791316000"
        },
        {
          "tcp_stream": 455,
          "frame_number": 16100,
          "display_filter": "frame.number == 16100",
          "timestamp_epoch": "1647918729.792122000"
        }
      ]
    },
    {
      "id": "finding-5f3db67192d2d79c57dd665c",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.0.19.14",
        "protocol": "ldap",
        "destination": "10.0.19.9",
        "event_count": 182,
        "operation_numbers": [
          "0",
          "2",
          "3"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 24,
          "frame_number": 3473,
          "display_filter": "frame.number == 3473",
          "timestamp_epoch": "1647897130.443849000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 3478,
          "display_filter": "frame.number == 3478",
          "timestamp_epoch": "1647897130.446665000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 3481,
          "display_filter": "frame.number == 3481",
          "timestamp_epoch": "1647897130.448276000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 3483,
          "display_filter": "frame.number == 3483",
          "timestamp_epoch": "1647897130.449057000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 3485,
          "display_filter": "frame.number == 3485",
          "timestamp_epoch": "1647897130.449815000"
        },
        {
          "tcp_stream": 25,
          "frame_number": 3491,
          "display_filter": "frame.number == 3491",
          "timestamp_epoch": "1647897130.456341000"
        },
        {
          "tcp_stream": 25,
          "frame_number": 3494,
          "display_filter": "frame.number == 3494",
          "timestamp_epoch": "1647897130.457863000"
        },
        {
          "tcp_stream": 25,
          "frame_number": 3499,
          "display_filter": "frame.number == 3499",
          "timestamp_epoch": "1647897130.459238000"
        },
        {
          "tcp_stream": 25,
          "frame_number": 3501,
          "display_filter": "frame.number == 3501",
          "timestamp_epoch": "1647897130.459792000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 3503,
          "display_filter": "frame.number == 3503",
          "timestamp_epoch": "1647897130.460220000"
        },
        {
          "tcp_stream": 30,
          "frame_number": 3804,
          "display_filter": "frame.number == 3804",
          "timestamp_epoch": "1647898110.964639000"
        },
        {
          "tcp_stream": 30,
          "frame_number": 3809,
          "display_filter": "frame.number == 3809",
          "timestamp_epoch": "1647898110.966086000"
        },
        {
          "tcp_stream": 30,
          "frame_number": 3812,
          "display_filter": "frame.number == 3812",
          "timestamp_epoch": "1647898110.967231000"
        },
        {
          "tcp_stream": 55,
          "frame_number": 4378,
          "display_filter": "frame.number == 4378",
          "timestamp_epoch": "1647899009.107932000"
        },
        {
          "tcp_stream": 55,
          "frame_number": 4383,
          "display_filter": "frame.number == 4383",
          "timestamp_epoch": "1647899009.109732000"
        },
        {
          "tcp_stream": 55,
          "frame_number": 4386,
          "display_filter": "frame.number == 4386",
          "timestamp_epoch": "1647899009.116568000"
        },
        {
          "tcp_stream": 56,
          "frame_number": 4392,
          "display_filter": "frame.number == 4392",
          "timestamp_epoch": "1647899009.119228000"
        },
        {
          "tcp_stream": 56,
          "frame_number": 4395,
          "display_filter": "frame.number == 4395",
          "timestamp_epoch": "1647899009.120885000"
        },
        {
          "tcp_stream": 56,
          "frame_number": 4397,
          "display_filter": "frame.number == 4397",
          "timestamp_epoch": "1647899009.121276000"
        },
        {
          "tcp_stream": 55,
          "frame_number": 4399,
          "display_filter": "frame.number == 4399",
          "timestamp_epoch": "1647899009.122580000"
        },
        {
          "tcp_stream": 56,
          "frame_number": 4406,
          "display_filter": "frame.number == 4406",
          "timestamp_epoch": "1647899009.435538000"
        },
        {
          "tcp_stream": 55,
          "frame_number": 4410,
          "display_filter": "frame.number == 4410",
          "timestamp_epoch": "1647899009.437661000"
        },
        {
          "tcp_stream": 73,
          "frame_number": 4860,
          "display_filter": "frame.number == 4860",
          "timestamp_epoch": "1647899069.653574000"
        },
        {
          "tcp_stream": 73,
          "frame_number": 4865,
          "display_filter": "frame.number == 4865",
          "timestamp_epoch": "1647899069.654943000"
        },
        {
          "tcp_stream": 73,
          "frame_number": 4868,
          "display_filter": "frame.number == 4868",
          "timestamp_epoch": "1647899069.656581000"
        },
        {
          "tcp_stream": 73,
          "frame_number": 4870,
          "display_filter": "frame.number == 4870",
          "timestamp_epoch": "1647899069.657280000"
        },
        {
          "tcp_stream": 73,
          "frame_number": 4872,
          "display_filter": "frame.number == 4872",
          "timestamp_epoch": "1647899069.657888000"
        },
        {
          "tcp_stream": 74,
          "frame_number": 4878,
          "display_filter": "frame.number == 4878",
          "timestamp_epoch": "1647899069.660236000"
        },
        {
          "tcp_stream": 74,
          "frame_number": 4881,
          "display_filter": "frame.number == 4881",
          "timestamp_epoch": "1647899069.661912000"
        },
        {
          "tcp_stream": 74,
          "frame_number": 4886,
          "display_filter": "frame.number == 4886",
          "timestamp_epoch": "1647899069.662851000"
        },
        {
          "tcp_stream": 74,
          "frame_number": 4888,
          "display_filter": "frame.number == 4888",
          "timestamp_epoch": "1647899069.663504000"
        },
        {
          "tcp_stream": 73,
          "frame_number": 4890,
          "display_filter": "frame.number == 4890",
          "timestamp_epoch": "1647899069.663604000"
        },
        {
          "tcp_stream": 104,
          "frame_number": 6994,
          "display_filter": "frame.number == 6994",
          "timestamp_epoch": "1647900354.449183000"
        },
        {
          "tcp_stream": 104,
          "frame_number": 7011,
          "display_filter": "frame.number == 7011",
          "timestamp_epoch": "1647900354.454129000"
        },
        {
          "tcp_stream": 104,
          "frame_number": 7014,
          "display_filter": "frame.number == 7014",
          "timestamp_epoch": "1647900354.458460000"
        },
        {
          "tcp_stream": 104,
          "frame_number": 7019,
          "display_filter": "frame.number == 7019",
          "timestamp_epoch": "1647900354.459585000"
        },
        {
          "tcp_stream": 106,
          "frame_number": 7027,
          "display_filter": "frame.number == 7027",
          "timestamp_epoch": "1647900354.461285000"
        },
        {
          "tcp_stream": 106,
          "frame_number": 7030,
          "display_filter": "frame.number == 7030",
          "timestamp_epoch": "1647900354.462864000"
        },
        {
          "tcp_stream": 106,
          "frame_number": 7032,
          "display_filter": "frame.number == 7032",
          "timestamp_epoch": "1647900354.463895000"
        },
        {
          "tcp_stream": 106,
          "frame_number": 7034,
          "display_filter": "frame.number == 7034",
          "timestamp_epoch": "1647900354.464614000"
        },
        {
          "tcp_stream": 106,
          "frame_number": 7042,
          "display_filter": "frame.number == 7042",
          "timestamp_epoch": "1647900354.466502000"
        },
        {
          "tcp_stream": 106,
          "frame_number": 7044,
          "display_filter": "frame.number == 7044",
          "timestamp_epoch": "1647900354.467062000"
        },
        {
          "tcp_stream": 106,
          "frame_number": 7046,
          "display_filter": "frame.number == 7046",
          "timestamp_epoch": "1647900354.467536000"
        },
        {
          "tcp_stream": 106,
          "frame_number": 7048,
          "display_filter": "frame.number == 7048",
          "timestamp_epoch": "1647900354.470742000"
        },
        {
          "tcp_stream": 106,
          "frame_number": 7364,
          "display_filter": "frame.number == 7364",
          "timestamp_epoch": "1647900354.547930000"
        },
        {
          "tcp_stream": 106,
          "frame_number": 7366,
          "display_filter": "frame.number == 7366",
          "timestamp_epoch": "1647900354.551729000"
        },
        {
          "tcp_stream": 127,
          "frame_number": 8038,
          "display_filter": "frame.number == 8038",
          "timestamp_epoch": "1647900730.239879000"
        },
        {
          "tcp_stream": 127,
          "frame_number": 8043,
          "display_filter": "frame.number == 8043",
          "timestamp_epoch": "1647900730.241525000"
        },
        {
          "tcp_stream": 127,
          "frame_number": 8046,
          "display_filter": "frame.number == 8046",
          "timestamp_epoch": "1647900730.243268000"
        },
        {
          "tcp_stream": 127,
          "frame_number": 8048,
          "display_filter": "frame.number == 8048",
          "timestamp_epoch": "1647900730.243842000"
        },
        {
          "tcp_stream": 127,
          "frame_number": 8050,
          "display_filter": "frame.number == 8050",
          "timestamp_epoch": "1647900730.244387000"
        },
        {
          "tcp_stream": 128,
          "frame_number": 8056,
          "display_filter": "frame.number == 8056",
          "timestamp_epoch": "1647900730.246986000"
        },
        {
          "tcp_stream": 128,
          "frame_number": 8059,
          "display_filter": "frame.number == 8059",
          "timestamp_epoch": "1647900730.248658000"
        },
        {
          "tcp_stream": 128,
          "frame_number": 8064,
          "display_filter": "frame.number == 8064",
          "timestamp_epoch": "1647900730.249607000"
        },
        {
          "tcp_stream": 128,
          "frame_number": 8066,
          "display_filter": "frame.number == 8066",
          "timestamp_epoch": "1647900730.250180000"
        },
        {
          "tcp_stream": 127,
          "frame_number": 8068,
          "display_filter": "frame.number == 8068",
          "timestamp_epoch": "1647900730.250278000"
        },
        {
          "tcp_stream": 131,
          "frame_number": 8111,
          "display_filter": "frame.number == 8111",
          "timestamp_epoch": "1647900774.396959000"
        },
        {
          "tcp_stream": 131,
          "frame_number": 8116,
          "display_filter": "frame.number == 8116",
          "timestamp_epoch": "1647900774.398700000"
        },
        {
          "tcp_stream": 131,
          "frame_number": 8119,
          "display_filter": "frame.number == 8119",
          "timestamp_epoch": "1647900774.406542000"
        },
        {
          "tcp_stream": 132,
          "frame_number": 8125,
          "display_filter": "frame.number == 8125",
          "timestamp_epoch": "1647900774.409200000"
        },
        {
          "tcp_stream": 132,
          "frame_number": 8128,
          "display_filter": "frame.number == 8128",
          "timestamp_epoch": "1647900774.410956000"
        },
        {
          "tcp_stream": 132,
          "frame_number": 8130,
          "display_filter": "frame.number == 8130",
          "timestamp_epoch": "1647900774.411273000"
        },
        {
          "tcp_stream": 131,
          "frame_number": 8132,
          "display_filter": "frame.number == 8132",
          "timestamp_epoch": "1647900774.412115000"
        },
        {
          "tcp_stream": 132,
          "frame_number": 8271,
          "display_filter": "frame.number == 8271",
          "timestamp_epoch": "1647900774.787829000"
        },
        {
          "tcp_stream": 131,
          "frame_number": 8275,
          "display_filter": "frame.number == 8275",
          "timestamp_epoch": "1647900774.792853000"
        },
        {
          "tcp_stream": 160,
          "frame_number": 9461,
          "display_filter": "frame.number == 9461",
          "timestamp_epoch": "1647904330.170760000"
        },
        {
          "tcp_stream": 160,
          "frame_number": 9466,
          "display_filter": "frame.number == 9466",
          "timestamp_epoch": "1647904330.173540000"
        },
        {
          "tcp_stream": 160,
          "frame_number": 9469,
          "display_filter": "frame.number == 9469",
          "timestamp_epoch": "1647904330.175091000"
        },
        {
          "tcp_stream": 160,
          "frame_number": 9471,
          "display_filter": "frame.number == 9471",
          "timestamp_epoch": "1647904330.175929000"
        },
        {
          "tcp_stream": 160,
          "frame_number": 9473,
          "display_filter": "frame.number == 9473",
          "timestamp_epoch": "1647904330.176753000"
        },
        {
          "tcp_stream": 161,
          "frame_number": 9479,
          "display_filter": "frame.number == 9479",
          "timestamp_epoch": "1647904330.183723000"
        },
        {
          "tcp_stream": 161,
          "frame_number": 9482,
          "display_filter": "frame.number == 9482",
          "timestamp_epoch": "1647904330.185261000"
        },
        {
          "tcp_stream": 161,
          "frame_number": 9487,
          "display_filter": "frame.number == 9487",
          "timestamp_epoch": "1647904330.186488000"
        },
        {
          "tcp_stream": 161,
          "frame_number": 9489,
          "display_filter": "frame.number == 9489",
          "timestamp_epoch": "1647904330.187120000"
        },
        {
          "tcp_stream": 160,
          "frame_number": 9491,
          "display_filter": "frame.number == 9491",
          "timestamp_epoch": "1647904330.187616000"
        },
        {
          "tcp_stream": 167,
          "frame_number": 9618,
          "display_filter": "frame.number == 9618",
          "timestamp_epoch": "1647904588.928065000"
        },
        {
          "tcp_stream": 167,
          "frame_number": 9623,
          "display_filter": "frame.number == 9623",
          "timestamp_epoch": "1647904588.929938000"
        },
        {
          "tcp_stream": 167,
          "frame_number": 9626,
          "display_filter": "frame.number == 9626",
          "timestamp_epoch": "1647904588.935196000"
        },
        {
          "tcp_stream": 168,
          "frame_number": 9632,
          "display_filter": "frame.number == 9632",
          "timestamp_epoch": "1647904588.938139000"
        },
        {
          "tcp_stream": 168,
          "frame_number": 9635,
          "display_filter": "frame.number == 9635",
          "timestamp_epoch": "1647904588.939972000"
        },
        {
          "tcp_stream": 168,
          "frame_number": 9637,
          "display_filter": "frame.number == 9637",
          "timestamp_epoch": "1647904588.940374000"
        },
        {
          "tcp_stream": 167,
          "frame_number": 9639,
          "display_filter": "frame.number == 9639",
          "timestamp_epoch": "1647904588.941217000"
        },
        {
          "tcp_stream": 168,
          "frame_number": 9645,
          "display_filter": "frame.number == 9645",
          "timestamp_epoch": "1647904589.255267000"
        },
        {
          "tcp_stream": 167,
          "frame_number": 9649,
          "display_filter": "frame.number == 9649",
          "timestamp_epoch": "1647904589.257630000"
        },
        {
          "tcp_stream": 189,
          "frame_number": 10473,
          "display_filter": "frame.number == 10473",
          "timestamp_epoch": "1647906955.060541000"
        },
        {
          "tcp_stream": 189,
          "frame_number": 10478,
          "display_filter": "frame.number == 10478",
          "timestamp_epoch": "1647906955.062253000"
        },
        {
          "tcp_stream": 189,
          "frame_number": 10481,
          "display_filter": "frame.number == 10481",
          "timestamp_epoch": "1647906955.068834000"
        },
        {
          "tcp_stream": 190,
          "frame_number": 10491,
          "display_filter": "frame.number == 10491",
          "timestamp_epoch": "1647906955.179897000"
        },
        {
          "tcp_stream": 190,
          "frame_number": 10494,
          "display_filter": "frame.number == 10494",
          "timestamp_epoch": "1647906955.182116000"
        },
        {
          "tcp_stream": 190,
          "frame_number": 10496,
          "display_filter": "frame.number == 10496",
          "timestamp_epoch": "1647906955.182881000"
        },
        {
          "tcp_stream": 189,
          "frame_number": 10498,
          "display_filter": "frame.number == 10498",
          "timestamp_epoch": "1647906955.184570000"
        },
        {
          "tcp_stream": 190,
          "frame_number": 10637,
          "display_filter": "frame.number == 10637",
          "timestamp_epoch": "1647906955.553261000"
        },
        {
          "tcp_stream": 189,
          "frame_number": 10641,
          "display_filter": "frame.number == 10641",
          "timestamp_epoch": "1647906955.556880000"
        },
        {
          "tcp_stream": 199,
          "frame_number": 10986,
          "display_filter": "frame.number == 10986",
          "timestamp_epoch": "1647907930.115333000"
        },
        {
          "tcp_stream": 199,
          "frame_number": 10991,
          "display_filter": "frame.number == 10991",
          "timestamp_epoch": "1647907930.116627000"
        },
        {
          "tcp_stream": 199,
          "frame_number": 10994,
          "display_filter": "frame.number == 10994",
          "timestamp_epoch": "1647907930.117789000"
        },
        {
          "tcp_stream": 199,
          "frame_number": 10996,
          "display_filter": "frame.number == 10996",
          "timestamp_epoch": "1647907930.118054000"
        },
        {
          "tcp_stream": 199,
          "frame_number": 10998,
          "display_filter": "frame.number == 10998",
          "timestamp_epoch": "1647907930.118326000"
        },
        {
          "tcp_stream": 200,
          "frame_number": 11004,
          "display_filter": "frame.number == 11004",
          "timestamp_epoch": "1647907930.120660000"
        },
        {
          "tcp_stream": 200,
          "frame_number": 11007,
          "display_filter": "frame.number == 11007",
          "timestamp_epoch": "1647907930.121650000"
        }
      ]
    },
    {
      "id": "finding-897b1f6799ffb5e559c204ca",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.0.19.14",
        "protocol": "samr",
        "destination": "10.0.19.9",
        "event_count": 51,
        "operation_numbers": [
          "1",
          "16",
          "17",
          "18",
          "19",
          "20",
          "25",
          "3",
          "34",
          "36",
          "39",
          "5",
          "6",
          "64",
          "7"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 12,
          "frame_number": 816,
          "display_filter": "frame.number == 816",
          "timestamp_epoch": "1647896381.095711000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 818,
          "display_filter": "frame.number == 818",
          "timestamp_epoch": "1647896381.096261000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 820,
          "display_filter": "frame.number == 820",
          "timestamp_epoch": "1647896381.096678000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 822,
          "display_filter": "frame.number == 822",
          "timestamp_epoch": "1647896381.097074000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 824,
          "display_filter": "frame.number == 824",
          "timestamp_epoch": "1647896381.097515000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 826,
          "display_filter": "frame.number == 826",
          "timestamp_epoch": "1647896381.097970000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 828,
          "display_filter": "frame.number == 828",
          "timestamp_epoch": "1647896381.098472000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 830,
          "display_filter": "frame.number == 830",
          "timestamp_epoch": "1647896381.098861000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 832,
          "display_filter": "frame.number == 832",
          "timestamp_epoch": "1647896381.099183000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 834,
          "display_filter": "frame.number == 834",
          "timestamp_epoch": "1647896381.099575000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 846,
          "display_filter": "frame.number == 846",
          "timestamp_epoch": "1647896381.101875000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 848,
          "display_filter": "frame.number == 848",
          "timestamp_epoch": "1647896381.102276000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 850,
          "display_filter": "frame.number == 850",
          "timestamp_epoch": "1647896381.102669000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 852,
          "display_filter": "frame.number == 852",
          "timestamp_epoch": "1647896381.102982000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 854,
          "display_filter": "frame.number == 854",
          "timestamp_epoch": "1647896381.103307000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 856,
          "display_filter": "frame.number == 856",
          "timestamp_epoch": "1647896381.103795000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 858,
          "display_filter": "frame.number == 858",
          "timestamp_epoch": "1647896381.104259000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 860,
          "display_filter": "frame.number == 860",
          "timestamp_epoch": "1647896381.104696000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 862,
          "display_filter": "frame.number == 862",
          "timestamp_epoch": "1647896381.105037000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 864,
          "display_filter": "frame.number == 864",
          "timestamp_epoch": "1647896381.105372000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 866,
          "display_filter": "frame.number == 866",
          "timestamp_epoch": "1647896381.105662000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3681,
          "display_filter": "frame.number == 3681",
          "timestamp_epoch": "1647897816.611458000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3683,
          "display_filter": "frame.number == 3683",
          "timestamp_epoch": "1647897816.612142000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3685,
          "display_filter": "frame.number == 3685",
          "timestamp_epoch": "1647897816.612669000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3687,
          "display_filter": "frame.number == 3687",
          "timestamp_epoch": "1647897816.613135000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3689,
          "display_filter": "frame.number == 3689",
          "timestamp_epoch": "1647897816.613810000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3691,
          "display_filter": "frame.number == 3691",
          "timestamp_epoch": "1647897816.614434000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3693,
          "display_filter": "frame.number == 3693",
          "timestamp_epoch": "1647897816.615140000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3695,
          "display_filter": "frame.number == 3695",
          "timestamp_epoch": "1647897816.616146000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3697,
          "display_filter": "frame.number == 3697",
          "timestamp_epoch": "1647897816.617090000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3699,
          "display_filter": "frame.number == 3699",
          "timestamp_epoch": "1647897816.617874000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3701,
          "display_filter": "frame.number == 3701",
          "timestamp_epoch": "1647897816.618400000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3703,
          "display_filter": "frame.number == 3703",
          "timestamp_epoch": "1647897816.618923000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3705,
          "display_filter": "frame.number == 3705",
          "timestamp_epoch": "1647897816.619345000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3707,
          "display_filter": "frame.number == 3707",
          "timestamp_epoch": "1647897816.619815000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3709,
          "display_filter": "frame.number == 3709",
          "timestamp_epoch": "1647897816.620282000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4286,
          "display_filter": "frame.number == 4286",
          "timestamp_epoch": "1647899008.803809000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4288,
          "display_filter": "frame.number == 4288",
          "timestamp_epoch": "1647899008.804203000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4290,
          "display_filter": "frame.number == 4290",
          "timestamp_epoch": "1647899008.804548000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4292,
          "display_filter": "frame.number == 4292",
          "timestamp_epoch": "1647899008.804874000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4294,
          "display_filter": "frame.number == 4294",
          "timestamp_epoch": "1647899008.805311000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4296,
          "display_filter": "frame.number == 4296",
          "timestamp_epoch": "1647899008.805736000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4303,
          "display_filter": "frame.number == 4303",
          "timestamp_epoch": "1647899008.806272000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4311,
          "display_filter": "frame.number == 4311",
          "timestamp_epoch": "1647899008.807109000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4319,
          "display_filter": "frame.number == 4319",
          "timestamp_epoch": "1647899008.807815000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4321,
          "display_filter": "frame.number == 4321",
          "timestamp_epoch": "1647899008.808319000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4329,
          "display_filter": "frame.number == 4329",
          "timestamp_epoch": "1647899008.808946000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4331,
          "display_filter": "frame.number == 4331",
          "timestamp_epoch": "1647899008.809305000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4333,
          "display_filter": "frame.number == 4333",
          "timestamp_epoch": "1647899008.809642000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4335,
          "display_filter": "frame.number == 4335",
          "timestamp_epoch": "1647899008.809986000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4337,
          "display_filter": "frame.number == 4337",
          "timestamp_epoch": "1647899008.810323000"
        }
      ]
    },
    {
      "id": "finding-6d28dc4eeda888f87080f720",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.0.19.9",
        "protocol": "drsuapi",
        "destination": "10.0.19.14",
        "event_count": 82,
        "operation_numbers": [
          "0",
          "1",
          "12"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 23,
          "frame_number": 3451,
          "display_filter": "frame.number == 3451",
          "timestamp_epoch": "1647897130.330464000"
        },
        {
          "tcp_stream": 23,
          "frame_number": 3453,
          "display_filter": "frame.number == 3453",
          "timestamp_epoch": "1647897130.331478000"
        },
        {
          "tcp_stream": 23,
          "frame_number": 3455,
          "display_filter": "frame.number == 3455",
          "timestamp_epoch": "1647897130.331868000"
        },
        {
          "tcp_stream": 23,
          "frame_number": 3459,
          "display_filter": "frame.number == 3459",
          "timestamp_epoch": "1647897130.333787000"
        },
        {
          "tcp_stream": 23,
          "frame_number": 3461,
          "display_filter": "frame.number == 3461",
          "timestamp_epoch": "1647897130.334601000"
        },
        {
          "tcp_stream": 23,
          "frame_number": 3463,
          "display_filter": "frame.number == 3463",
          "timestamp_epoch": "1647897130.334959000"
        },
        {
          "tcp_stream": 42,
          "frame_number": 4207,
          "display_filter": "frame.number == 4207",
          "timestamp_epoch": "1647899008.790196000"
        },
        {
          "tcp_stream": 42,
          "frame_number": 4209,
          "display_filter": "frame.number == 4209",
          "timestamp_epoch": "1647899008.791040000"
        },
        {
          "tcp_stream": 42,
          "frame_number": 4211,
          "display_filter": "frame.number == 4211",
          "timestamp_epoch": "1647899008.791690000"
        },
        {
          "tcp_stream": 42,
          "frame_number": 4213,
          "display_filter": "frame.number == 4213",
          "timestamp_epoch": "1647899008.792028000"
        },
        {
          "tcp_stream": 72,
          "frame_number": 4844,
          "display_filter": "frame.number == 4844",
          "timestamp_epoch": "1647899069.648413000"
        },
        {
          "tcp_stream": 72,
          "frame_number": 4846,
          "display_filter": "frame.number == 4846",
          "timestamp_epoch": "1647899069.649388000"
        },
        {
          "tcp_stream": 72,
          "frame_number": 4848,
          "display_filter": "frame.number == 4848",
          "timestamp_epoch": "1647899069.649830000"
        },
        {
          "tcp_stream": 72,
          "frame_number": 4852,
          "display_filter": "frame.number == 4852",
          "timestamp_epoch": "1647899069.651114000"
        },
        {
          "tcp_stream": 72,
          "frame_number": 4854,
          "display_filter": "frame.number == 4854",
          "timestamp_epoch": "1647899069.651939000"
        },
        {
          "tcp_stream": 72,
          "frame_number": 4856,
          "display_filter": "frame.number == 4856",
          "timestamp_epoch": "1647899069.652331000"
        },
        {
          "tcp_stream": 126,
          "frame_number": 8022,
          "display_filter": "frame.number == 8022",
          "timestamp_epoch": "1647900730.232641000"
        },
        {
          "tcp_stream": 126,
          "frame_number": 8024,
          "display_filter": "frame.number == 8024",
          "timestamp_epoch": "1647900730.233793000"
        },
        {
          "tcp_stream": 126,
          "frame_number": 8026,
          "display_filter": "frame.number == 8026",
          "timestamp_epoch": "1647900730.234210000"
        },
        {
          "tcp_stream": 126,
          "frame_number": 8030,
          "display_filter": "frame.number == 8030",
          "timestamp_epoch": "1647900730.236260000"
        },
        {
          "tcp_stream": 126,
          "frame_number": 8032,
          "display_filter": "frame.number == 8032",
          "timestamp_epoch": "1647900730.237141000"
        },
        {
          "tcp_stream": 126,
          "frame_number": 8034,
          "display_filter": "frame.number == 8034",
          "timestamp_epoch": "1647900730.237519000"
        },
        {
          "tcp_stream": 130,
          "frame_number": 8099,
          "display_filter": "frame.number == 8099",
          "timestamp_epoch": "1647900774.085535000"
        },
        {
          "tcp_stream": 130,
          "frame_number": 8101,
          "display_filter": "frame.number == 8101",
          "timestamp_epoch": "1647900774.086435000"
        },
        {
          "tcp_stream": 130,
          "frame_number": 8103,
          "display_filter": "frame.number == 8103",
          "timestamp_epoch": "1647900774.086815000"
        },
        {
          "tcp_stream": 159,
          "frame_number": 9439,
          "display_filter": "frame.number == 9439",
          "timestamp_epoch": "1647904330.058917000"
        },
        {
          "tcp_stream": 159,
          "frame_number": 9441,
          "display_filter": "frame.number == 9441",
          "timestamp_epoch": "1647904330.060052000"
        },
        {
          "tcp_stream": 159,
          "frame_number": 9443,
          "display_filter": "frame.number == 9443",
          "timestamp_epoch": "1647904330.060448000"
        },
        {
          "tcp_stream": 159,
          "frame_number": 9447,
          "display_filter": "frame.number == 9447",
          "timestamp_epoch": "1647904330.061712000"
        },
        {
          "tcp_stream": 159,
          "frame_number": 9449,
          "display_filter": "frame.number == 9449",
          "timestamp_epoch": "1647904330.062522000"
        },
        {
          "tcp_stream": 159,
          "frame_number": 9451,
          "display_filter": "frame.number == 9451",
          "timestamp_epoch": "1647904330.062912000"
        },
        {
          "tcp_stream": 165,
          "frame_number": 9591,
          "display_filter": "frame.number == 9591",
          "timestamp_epoch": "1647904588.487085000"
        },
        {
          "tcp_stream": 165,
          "frame_number": 9593,
          "display_filter": "frame.number == 9593",
          "timestamp_epoch": "1647904588.487713000"
        },
        {
          "tcp_stream": 165,
          "frame_number": 9595,
          "display_filter": "frame.number == 9595",
          "timestamp_epoch": "1647904588.488042000"
        },
        {
          "tcp_stream": 188,
          "frame_number": 10461,
          "display_filter": "frame.number == 10461",
          "timestamp_epoch": "1647906954.857096000"
        },
        {
          "tcp_stream": 188,
          "frame_number": 10463,
          "display_filter": "frame.number == 10463",
          "timestamp_epoch": "1647906954.858287000"
        },
        {
          "tcp_stream": 188,
          "frame_number": 10465,
          "display_filter": "frame.number == 10465",
          "timestamp_epoch": "1647906954.858873000"
        },
        {
          "tcp_stream": 198,
          "frame_number": 10970,
          "display_filter": "frame.number == 10970",
          "timestamp_epoch": "1647907930.110749000"
        },
        {
          "tcp_stream": 198,
          "frame_number": 10972,
          "display_filter": "frame.number == 10972",
          "timestamp_epoch": "1647907930.111583000"
        },
        {
          "tcp_stream": 198,
          "frame_number": 10974,
          "display_filter": "frame.number == 10974",
          "timestamp_epoch": "1647907930.112026000"
        },
        {
          "tcp_stream": 198,
          "frame_number": 10978,
          "display_filter": "frame.number == 10978",
          "timestamp_epoch": "1647907930.113346000"
        },
        {
          "tcp_stream": 198,
          "frame_number": 10980,
          "display_filter": "frame.number == 10980",
          "timestamp_epoch": "1647907930.113766000"
        },
        {
          "tcp_stream": 198,
          "frame_number": 10982,
          "display_filter": "frame.number == 10982",
          "timestamp_epoch": "1647907930.114099000"
        },
        {
          "tcp_stream": 223,
          "frame_number": 11479,
          "display_filter": "frame.number == 11479",
          "timestamp_epoch": "1647908840.696826000"
        },
        {
          "tcp_stream": 223,
          "frame_number": 11482,
          "display_filter": "frame.number == 11482",
          "timestamp_epoch": "1647908840.697765000"
        },
        {
          "tcp_stream": 223,
          "frame_number": 11485,
          "display_filter": "frame.number == 11485",
          "timestamp_epoch": "1647908840.698022000"
        },
        {
          "tcp_stream": 225,
          "frame_number": 11498,
          "display_filter": "frame.number == 11498",
          "timestamp_epoch": "1647908840.701869000"
        },
        {
          "tcp_stream": 225,
          "frame_number": 11500,
          "display_filter": "frame.number == 11500",
          "timestamp_epoch": "1647908840.702783000"
        },
        {
          "tcp_stream": 225,
          "frame_number": 11502,
          "display_filter": "frame.number == 11502",
          "timestamp_epoch": "1647908840.703170000"
        },
        {
          "tcp_stream": 225,
          "frame_number": 11506,
          "display_filter": "frame.number == 11506",
          "timestamp_epoch": "1647908840.704658000"
        },
        {
          "tcp_stream": 225,
          "frame_number": 11508,
          "display_filter": "frame.number == 11508",
          "timestamp_epoch": "1647908840.705128000"
        },
        {
          "tcp_stream": 225,
          "frame_number": 11510,
          "display_filter": "frame.number == 11510",
          "timestamp_epoch": "1647908840.705419000"
        },
        {
          "tcp_stream": 261,
          "frame_number": 12221,
          "display_filter": "frame.number == 12221",
          "timestamp_epoch": "1647910170.412890000"
        },
        {
          "tcp_stream": 261,
          "frame_number": 12223,
          "display_filter": "frame.number == 12223",
          "timestamp_epoch": "1647910170.413997000"
        },
        {
          "tcp_stream": 261,
          "frame_number": 12225,
          "display_filter": "frame.number == 12225",
          "timestamp_epoch": "1647910170.414508000"
        },
        {
          "tcp_stream": 300,
          "frame_number": 12979,
          "display_filter": "frame.number == 12979",
          "timestamp_epoch": "1647911530.003637000"
        },
        {
          "tcp_stream": 300,
          "frame_number": 12981,
          "display_filter": "frame.number == 12981",
          "timestamp_epoch": "1647911530.004663000"
        },
        {
          "tcp_stream": 300,
          "frame_number": 12983,
          "display_filter": "frame.number == 12983",
          "timestamp_epoch": "1647911530.005078000"
        },
        {
          "tcp_stream": 300,
          "frame_number": 12987,
          "display_filter": "frame.number == 12987",
          "timestamp_epoch": "1647911530.006336000"
        },
        {
          "tcp_stream": 300,
          "frame_number": 12989,
          "display_filter": "frame.number == 12989",
          "timestamp_epoch": "1647911530.007117000"
        },
        {
          "tcp_stream": 300,
          "frame_number": 12991,
          "display_filter": "frame.number == 12991",
          "timestamp_epoch": "1647911530.007501000"
        },
        {
          "tcp_stream": 332,
          "frame_number": 13570,
          "display_filter": "frame.number == 13570",
          "timestamp_epoch": "1647913134.468953000"
        },
        {
          "tcp_stream": 332,
          "frame_number": 13572,
          "display_filter": "frame.number == 13572",
          "timestamp_epoch": "1647913134.469962000"
        },
        {
          "tcp_stream": 332,
          "frame_number": 13574,
          "display_filter": "frame.number == 13574",
          "timestamp_epoch": "1647913134.470412000"
        },
        {
          "tcp_stream": 356,
          "frame_number": 14099,
          "display_filter": "frame.number == 14099",
          "timestamp_epoch": "1647914217.148610000"
        },
        {
          "tcp_stream": 356,
          "frame_number": 14101,
          "display_filter": "frame.number == 14101",
          "timestamp_epoch": "1647914217.149233000"
        },
        {
          "tcp_stream": 356,
          "frame_number": 14103,
          "display_filter": "frame.number == 14103",
          "timestamp_epoch": "1647914217.149525000"
        },
        {
          "tcp_stream": 376,
          "frame_number": 14566,
          "display_filter": "frame.number == 14566",
          "timestamp_epoch": "1647915129.857261000"
        },
        {
          "tcp_stream": 376,
          "frame_number": 14568,
          "display_filter": "frame.number == 14568",
          "timestamp_epoch": "1647915129.858163000"
        },
        {
          "tcp_stream": 376,
          "frame_number": 14570,
          "display_filter": "frame.number == 14570",
          "timestamp_epoch": "1647915129.858619000"
        },
        {
          "tcp_stream": 376,
          "frame_number": 14574,
          "display_filter": "frame.number == 14574",
          "timestamp_epoch": "1647915129.859941000"
        },
        {
          "tcp_stream": 376,
          "frame_number": 14576,
          "display_filter": "frame.number == 14576",
          "timestamp_epoch": "1647915129.860677000"
        },
        {
          "tcp_stream": 376,
          "frame_number": 14578,
          "display_filter": "frame.number == 14578",
          "timestamp_epoch": "1647915129.861069000"
        },
        {
          "tcp_stream": 393,
          "frame_number": 14877,
          "display_filter": "frame.number == 14877",
          "timestamp_epoch": "1647915749.943809000"
        },
        {
          "tcp_stream": 393,
          "frame_number": 14879,
          "display_filter": "frame.number == 14879",
          "timestamp_epoch": "1647915749.944573000"
        },
        {
          "tcp_stream": 393,
          "frame_number": 14881,
          "display_filter": "frame.number == 14881",
          "timestamp_epoch": "1647915749.944882000"
        },
        {
          "tcp_stream": 455,
          "frame_number": 16089,
          "display_filter": "frame.number == 16089",
          "timestamp_epoch": "1647918729.788462000"
        },
        {
          "tcp_stream": 455,
          "frame_number": 16091,
          "display_filter": "frame.number == 16091",
          "timestamp_epoch": "1647918729.789463000"
        },
        {
          "tcp_stream": 455,
          "frame_number": 16093,
          "display_filter": "frame.number == 16093",
          "timestamp_epoch": "1647918729.789814000"
        },
        {
          "tcp_stream": 455,
          "frame_number": 16097,
          "display_filter": "frame.number == 16097",
          "timestamp_epoch": "1647918729.791089000"
        },
        {
          "tcp_stream": 455,
          "frame_number": 16099,
          "display_filter": "frame.number == 16099",
          "timestamp_epoch": "1647918729.791931000"
        },
        {
          "tcp_stream": 455,
          "frame_number": 16101,
          "display_filter": "frame.number == 16101",
          "timestamp_epoch": "1647918729.792269000"
        }
      ]
    },
    {
      "id": "finding-9efbfc0f8ac7dc15a8f29bc2",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.0.19.9",
        "protocol": "ldap",
        "destination": "10.0.19.14",
        "event_count": 146,
        "operation_numbers": [
          "1",
          "4,19,19,19,5",
          "4,4,4,5",
          "4,5",
          "5"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 24,
          "frame_number": 3475,
          "display_filter": "frame.number == 3475",
          "timestamp_epoch": "1647897130.444539000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 3480,
          "display_filter": "frame.number == 3480",
          "timestamp_epoch": "1647897130.447415000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 3482,
          "display_filter": "frame.number == 3482",
          "timestamp_epoch": "1647897130.448652000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 3484,
          "display_filter": "frame.number == 3484",
          "timestamp_epoch": "1647897130.449446000"
        },
        {
          "tcp_stream": 24,
          "frame_number": 3486,
          "display_filter": "frame.number == 3486",
          "timestamp_epoch": "1647897130.449967000"
        },
        {
          "tcp_stream": 25,
          "frame_number": 3493,
          "display_filter": "frame.number == 3493",
          "timestamp_epoch": "1647897130.457079000"
        },
        {
          "tcp_stream": 25,
          "frame_number": 3497,
          "display_filter": "frame.number == 3497",
          "timestamp_epoch": "1647897130.458656000"
        },
        {
          "tcp_stream": 25,
          "frame_number": 3500,
          "display_filter": "frame.number == 3500",
          "timestamp_epoch": "1647897130.459447000"
        },
        {
          "tcp_stream": 30,
          "frame_number": 3806,
          "display_filter": "frame.number == 3806",
          "timestamp_epoch": "1647898110.965251000"
        },
        {
          "tcp_stream": 30,
          "frame_number": 3811,
          "display_filter": "frame.number == 3811",
          "timestamp_epoch": "1647898110.966963000"
        },
        {
          "tcp_stream": 55,
          "frame_number": 4380,
          "display_filter": "frame.number == 4380",
          "timestamp_epoch": "1647899009.108807000"
        },
        {
          "tcp_stream": 55,
          "frame_number": 4385,
          "display_filter": "frame.number == 4385",
          "timestamp_epoch": "1647899009.111125000"
        },
        {
          "tcp_stream": 55,
          "frame_number": 4387,
          "display_filter": "frame.number == 4387",
          "timestamp_epoch": "1647899009.117212000"
        },
        {
          "tcp_stream": 56,
          "frame_number": 4394,
          "display_filter": "frame.number == 4394",
          "timestamp_epoch": "1647899009.120599000"
        },
        {
          "tcp_stream": 56,
          "frame_number": 4396,
          "display_filter": "frame.number == 4396",
          "timestamp_epoch": "1647899009.121107000"
        },
        {
          "tcp_stream": 56,
          "frame_number": 4398,
          "display_filter": "frame.number == 4398",
          "timestamp_epoch": "1647899009.121530000"
        },
        {
          "tcp_stream": 55,
          "frame_number": 4400,
          "display_filter": "frame.number == 4400",
          "timestamp_epoch": "1647899009.123168000"
        },
        {
          "tcp_stream": 73,
          "frame_number": 4862,
          "display_filter": "frame.number == 4862",
          "timestamp_epoch": "1647899069.654272000"
        },
        {
          "tcp_stream": 73,
          "frame_number": 4867,
          "display_filter": "frame.number == 4867",
          "timestamp_epoch": "1647899069.656347000"
        },
        {
          "tcp_stream": 73,
          "frame_number": 4869,
          "display_filter": "frame.number == 4869",
          "timestamp_epoch": "1647899069.657116000"
        },
        {
          "tcp_stream": 73,
          "frame_number": 4871,
          "display_filter": "frame.number == 4871",
          "timestamp_epoch": "1647899069.657633000"
        },
        {
          "tcp_stream": 73,
          "frame_number": 4873,
          "display_filter": "frame.number == 4873",
          "timestamp_epoch": "1647899069.658294000"
        },
        {
          "tcp_stream": 74,
          "frame_number": 4880,
          "display_filter": "frame.number == 4880",
          "timestamp_epoch": "1647899069.661690000"
        },
        {
          "tcp_stream": 74,
          "frame_number": 4884,
          "display_filter": "frame.number == 4884",
          "timestamp_epoch": "1647899069.662733000"
        },
        {
          "tcp_stream": 74,
          "frame_number": 4887,
          "display_filter": "frame.number == 4887",
          "timestamp_epoch": "1647899069.663368000"
        },
        {
          "tcp_stream": 104,
          "frame_number": 6996,
          "display_filter": "frame.number == 6996",
          "timestamp_epoch": "1647900354.450032000"
        },
        {
          "tcp_stream": 104,
          "frame_number": 7013,
          "display_filter": "frame.number == 7013",
          "timestamp_epoch": "1647900354.455609000"
        },
        {
          "tcp_stream": 104,
          "frame_number": 7017,
          "display_filter": "frame.number == 7017",
          "timestamp_epoch": "1647900354.459404000"
        },
        {
          "tcp_stream": 106,
          "frame_number": 7029,
          "display_filter": "frame.number == 7029",
          "timestamp_epoch": "1647900354.462709000"
        },
        {
          "tcp_stream": 106,
          "frame_number": 7031,
          "display_filter": "frame.number == 7031",
          "timestamp_epoch": "1647900354.463138000"
        },
        {
          "tcp_stream": 106,
          "frame_number": 7033,
          "display_filter": "frame.number == 7033",
          "timestamp_epoch": "1647900354.464508000"
        },
        {
          "tcp_stream": 106,
          "frame_number": 7040,
          "display_filter": "frame.number == 7040",
          "timestamp_epoch": "1647900354.466354000"
        },
        {
          "tcp_stream": 106,
          "frame_number": 7043,
          "display_filter": "frame.number == 7043",
          "timestamp_epoch": "1647900354.466963000"
        },
        {
          "tcp_stream": 106,
          "frame_number": 7045,
          "display_filter": "frame.number == 7045",
          "timestamp_epoch": "1647900354.467490000"
        },
        {
          "tcp_stream": 106,
          "frame_number": 7047,
          "display_filter": "frame.number == 7047",
          "timestamp_epoch": "1647900354.467881000"
        },
        {
          "tcp_stream": 106,
          "frame_number": 7362,
          "display_filter": "frame.number == 7362",
          "timestamp_epoch": "1647900354.506596000"
        },
        {
          "tcp_stream": 106,
          "frame_number": 7365,
          "display_filter": "frame.number == 7365",
          "timestamp_epoch": "1647900354.548251000"
        },
        {
          "tcp_stream": 106,
          "frame_number": 7372,
          "display_filter": "frame.number == 7372",
          "timestamp_epoch": "1647900354.553730000"
        },
        {
          "tcp_stream": 127,
          "frame_number": 8040,
          "display_filter": "frame.number == 8040",
          "timestamp_epoch": "1647900730.240537000"
        },
        {
          "tcp_stream": 127,
          "frame_number": 8045,
          "display_filter": "frame.number == 8045",
          "timestamp_epoch": "1647900730.242950000"
        },
        {
          "tcp_stream": 127,
          "frame_number": 8047,
          "display_filter": "frame.number == 8047",
          "timestamp_epoch": "1647900730.243600000"
        },
        {
          "tcp_stream": 127,
          "frame_number": 8049,
          "display_filter": "frame.number == 8049",
          "timestamp_epoch": "1647900730.244212000"
        },
        {
          "tcp_stream": 127,
          "frame_number": 8051,
          "display_filter": "frame.number == 8051",
          "timestamp_epoch": "1647900730.244712000"
        },
        {
          "tcp_stream": 128,
          "frame_number": 8058,
          "display_filter": "frame.number == 8058",
          "timestamp_epoch": "1647900730.248438000"
        },
        {
          "tcp_stream": 128,
          "frame_number": 8062,
          "display_filter": "frame.number == 8062",
          "timestamp_epoch": "1647900730.249442000"
        },
        {
          "tcp_stream": 128,
          "frame_number": 8065,
          "display_filter": "frame.number == 8065",
          "timestamp_epoch": "1647900730.250043000"
        },
        {
          "tcp_stream": 131,
          "frame_number": 8113,
          "display_filter": "frame.number == 8113",
          "timestamp_epoch": "1647900774.397637000"
        },
        {
          "tcp_stream": 131,
          "frame_number": 8118,
          "display_filter": "frame.number == 8118",
          "timestamp_epoch": "1647900774.400149000"
        },
        {
          "tcp_stream": 131,
          "frame_number": 8120,
          "display_filter": "frame.number == 8120",
          "timestamp_epoch": "1647900774.407213000"
        },
        {
          "tcp_stream": 132,
          "frame_number": 8127,
          "display_filter": "frame.number == 8127",
          "timestamp_epoch": "1647900774.410661000"
        },
        {
          "tcp_stream": 132,
          "frame_number": 8129,
          "display_filter": "frame.number == 8129",
          "timestamp_epoch": "1647900774.411124000"
        },
        {
          "tcp_stream": 132,
          "frame_number": 8131,
          "display_filter": "frame.number == 8131",
          "timestamp_epoch": "1647900774.411575000"
        },
        {
          "tcp_stream": 131,
          "frame_number": 8133,
          "display_filter": "frame.number == 8133",
          "timestamp_epoch": "1647900774.413002000"
        },
        {
          "tcp_stream": 160,
          "frame_number": 9463,
          "display_filter": "frame.number == 9463",
          "timestamp_epoch": "1647904330.171499000"
        },
        {
          "tcp_stream": 160,
          "frame_number": 9468,
          "display_filter": "frame.number == 9468",
          "timestamp_epoch": "1647904330.174261000"
        },
        {
          "tcp_stream": 160,
          "frame_number": 9470,
          "display_filter": "frame.number == 9470",
          "timestamp_epoch": "1647904330.175513000"
        },
        {
          "tcp_stream": 160,
          "frame_number": 9472,
          "display_filter": "frame.number == 9472",
          "timestamp_epoch": "1647904330.176339000"
        },
        {
          "tcp_stream": 160,
          "frame_number": 9474,
          "display_filter": "frame.number == 9474",
          "timestamp_epoch": "1647904330.177144000"
        },
        {
          "tcp_stream": 161,
          "frame_number": 9481,
          "display_filter": "frame.number == 9481",
          "timestamp_epoch": "1647904330.184486000"
        },
        {
          "tcp_stream": 161,
          "frame_number": 9485,
          "display_filter": "frame.number == 9485",
          "timestamp_epoch": "1647904330.186013000"
        },
        {
          "tcp_stream": 161,
          "frame_number": 9488,
          "display_filter": "frame.number == 9488",
          "timestamp_epoch": "1647904330.186717000"
        },
        {
          "tcp_stream": 167,
          "frame_number": 9620,
          "display_filter": "frame.number == 9620",
          "timestamp_epoch": "1647904588.928829000"
        },
        {
          "tcp_stream": 167,
          "frame_number": 9625,
          "display_filter": "frame.number == 9625",
          "timestamp_epoch": "1647904588.931407000"
        },
        {
          "tcp_stream": 167,
          "frame_number": 9627,
          "display_filter": "frame.number == 9627",
          "timestamp_epoch": "1647904588.935824000"
        },
        {
          "tcp_stream": 168,
          "frame_number": 9634,
          "display_filter": "frame.number == 9634",
          "timestamp_epoch": "1647904588.939622000"
        },
        {
          "tcp_stream": 168,
          "frame_number": 9636,
          "display_filter": "frame.number == 9636",
          "timestamp_epoch": "1647904588.940139000"
        },
        {
          "tcp_stream": 168,
          "frame_number": 9638,
          "display_filter": "frame.number == 9638",
          "timestamp_epoch": "1647904588.940679000"
        },
        {
          "tcp_stream": 167,
          "frame_number": 9640,
          "display_filter": "frame.number == 9640",
          "timestamp_epoch": "1647904588.941779000"
        },
        {
          "tcp_stream": 189,
          "frame_number": 10475,
          "display_filter": "frame.number == 10475",
          "timestamp_epoch": "1647906955.061243000"
        },
        {
          "tcp_stream": 189,
          "frame_number": 10480,
          "display_filter": "frame.number == 10480",
          "timestamp_epoch": "1647906955.063721000"
        },
        {
          "tcp_stream": 189,
          "frame_number": 10482,
          "display_filter": "frame.number == 10482",
          "timestamp_epoch": "1647906955.069495000"
        },
        {
          "tcp_stream": 190,
          "frame_number": 10493,
          "display_filter": "frame.number == 10493",
          "timestamp_epoch": "1647906955.181313000"
        },
        {
          "tcp_stream": 190,
          "frame_number": 10495,
          "display_filter": "frame.number == 10495",
          "timestamp_epoch": "1647906955.182467000"
        },
        {
          "tcp_stream": 190,
          "frame_number": 10497,
          "display_filter": "frame.number == 10497",
          "timestamp_epoch": "1647906955.183225000"
        },
        {
          "tcp_stream": 189,
          "frame_number": 10499,
          "display_filter": "frame.number == 10499",
          "timestamp_epoch": "1647906955.185548000"
        },
        {
          "tcp_stream": 199,
          "frame_number": 10988,
          "display_filter": "frame.number == 10988",
          "timestamp_epoch": "1647907930.115919000"
        },
        {
          "tcp_stream": 199,
          "frame_number": 10993,
          "display_filter": "frame.number == 10993",
          "timestamp_epoch": "1647907930.117506000"
        },
        {
          "tcp_stream": 199,
          "frame_number": 10995,
          "display_filter": "frame.number == 10995",
          "timestamp_epoch": "1647907930.117911000"
        },
        {
          "tcp_stream": 199,
          "frame_number": 10997,
          "display_filter": "frame.number == 10997",
          "timestamp_epoch": "1647907930.118191000"
        },
        {
          "tcp_stream": 199,
          "frame_number": 10999,
          "display_filter": "frame.number == 10999",
          "timestamp_epoch": "1647907930.118489000"
        },
        {
          "tcp_stream": 200,
          "frame_number": 11006,
          "display_filter": "frame.number == 11006",
          "timestamp_epoch": "1647907930.121390000"
        },
        {
          "tcp_stream": 200,
          "frame_number": 11010,
          "display_filter": "frame.number == 11010",
          "timestamp_epoch": "1647907930.122292000"
        },
        {
          "tcp_stream": 200,
          "frame_number": 11013,
          "display_filter": "frame.number == 11013",
          "timestamp_epoch": "1647907930.122703000"
        },
        {
          "tcp_stream": 226,
          "frame_number": 11539,
          "display_filter": "frame.number == 11539",
          "timestamp_epoch": "1647908840.811717000"
        },
        {
          "tcp_stream": 226,
          "frame_number": 11544,
          "display_filter": "frame.number == 11544",
          "timestamp_epoch": "1647908840.813200000"
        },
        {
          "tcp_stream": 226,
          "frame_number": 11546,
          "display_filter": "frame.number == 11546",
          "timestamp_epoch": "1647908840.813822000"
        },
        {
          "tcp_stream": 226,
          "frame_number": 11548,
          "display_filter": "frame.number == 11548",
          "timestamp_epoch": "1647908840.814228000"
        },
        {
          "tcp_stream": 226,
          "frame_number": 11550,
          "display_filter": "frame.number == 11550",
          "timestamp_epoch": "1647908840.814573000"
        },
        {
          "tcp_stream": 227,
          "frame_number": 11557,
          "display_filter": "frame.number == 11557",
          "timestamp_epoch": "1647908840.818465000"
        },
        {
          "tcp_stream": 227,
          "frame_number": 11561,
          "display_filter": "frame.number == 11561",
          "timestamp_epoch": "1647908840.819302000"
        },
        {
          "tcp_stream": 227,
          "frame_number": 11564,
          "display_filter": "frame.number == 11564",
          "timestamp_epoch": "1647908840.819798000"
        },
        {
          "tcp_stream": 262,
          "frame_number": 12235,
          "display_filter": "frame.number == 12235",
          "timestamp_epoch": "1647910170.634213000"
        },
        {
          "tcp_stream": 262,
          "frame_number": 12240,
          "display_filter": "frame.number == 12240",
          "timestamp_epoch": "1647910170.636624000"
        },
        {
          "tcp_stream": 262,
          "frame_number": 12242,
          "display_filter": "frame.number == 12242",
          "timestamp_epoch": "1647910170.651132000"
        },
        {
          "tcp_stream": 263,
          "frame_number": 12249,
          "display_filter": "frame.number == 12249",
          "timestamp_epoch": "1647910170.657336000"
        },
        {
          "tcp_stream": 263,
          "frame_number": 12251,
          "display_filter": "frame.number == 12251",
          "timestamp_epoch": "1647910170.658123000"
        },
        {
          "tcp_stream": 263,
          "frame_number": 12253,
          "display_filter": "frame.number == 12253",
          "timestamp_epoch": "1647910170.658740000"
        },
        {
          "tcp_stream": 262,
          "frame_number": 12255,
          "display_filter": "frame.number == 12255",
          "timestamp_epoch": "1647910170.660209000"
        },
        {
          "tcp_stream": 280,
          "frame_number": 12597,
          "display_filter": "frame.number == 12597",
          "timestamp_epoch": "1647911020.564721000"
        },
        {
          "tcp_stream": 280,
          "frame_number": 12602,
          "display_filter": "frame.number == 12602",
          "timestamp_epoch": "1647911020.566898000"
        }
      ]
    },
    {
      "id": "finding-2b995c5daa308c57c19adc02",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.0.19.9",
        "protocol": "samr",
        "destination": "10.0.19.14",
        "event_count": 51,
        "operation_numbers": [
          "1",
          "16",
          "17",
          "18",
          "19",
          "20",
          "25",
          "3",
          "34",
          "36",
          "39",
          "5",
          "6",
          "64",
          "7"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 12,
          "frame_number": 817,
          "display_filter": "frame.number == 817",
          "timestamp_epoch": "1647896381.096044000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 819,
          "display_filter": "frame.number == 819",
          "timestamp_epoch": "1647896381.096521000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 821,
          "display_filter": "frame.number == 821",
          "timestamp_epoch": "1647896381.096926000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 823,
          "display_filter": "frame.number == 823",
          "timestamp_epoch": "1647896381.097325000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 825,
          "display_filter": "frame.number == 825",
          "timestamp_epoch": "1647896381.097809000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 827,
          "display_filter": "frame.number == 827",
          "timestamp_epoch": "1647896381.098306000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 829,
          "display_filter": "frame.number == 829",
          "timestamp_epoch": "1647896381.098696000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 831,
          "display_filter": "frame.number == 831",
          "timestamp_epoch": "1647896381.099041000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 833,
          "display_filter": "frame.number == 833",
          "timestamp_epoch": "1647896381.099367000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 835,
          "display_filter": "frame.number == 835",
          "timestamp_epoch": "1647896381.099713000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 847,
          "display_filter": "frame.number == 847",
          "timestamp_epoch": "1647896381.102111000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 849,
          "display_filter": "frame.number == 849",
          "timestamp_epoch": "1647896381.102499000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 851,
          "display_filter": "frame.number == 851",
          "timestamp_epoch": "1647896381.102814000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 853,
          "display_filter": "frame.number == 853",
          "timestamp_epoch": "1647896381.103174000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 855,
          "display_filter": "frame.number == 855",
          "timestamp_epoch": "1647896381.103576000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 857,
          "display_filter": "frame.number == 857",
          "timestamp_epoch": "1647896381.104034000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 859,
          "display_filter": "frame.number == 859",
          "timestamp_epoch": "1647896381.104481000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 861,
          "display_filter": "frame.number == 861",
          "timestamp_epoch": "1647896381.104879000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 863,
          "display_filter": "frame.number == 863",
          "timestamp_epoch": "1647896381.105216000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 865,
          "display_filter": "frame.number == 865",
          "timestamp_epoch": "1647896381.105502000"
        },
        {
          "tcp_stream": 12,
          "frame_number": 867,
          "display_filter": "frame.number == 867",
          "timestamp_epoch": "1647896381.105800000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3682,
          "display_filter": "frame.number == 3682",
          "timestamp_epoch": "1647897816.612077000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3684,
          "display_filter": "frame.number == 3684",
          "timestamp_epoch": "1647897816.612601000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3686,
          "display_filter": "frame.number == 3686",
          "timestamp_epoch": "1647897816.613032000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3688,
          "display_filter": "frame.number == 3688",
          "timestamp_epoch": "1647897816.613753000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3690,
          "display_filter": "frame.number == 3690",
          "timestamp_epoch": "1647897816.614360000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3692,
          "display_filter": "frame.number == 3692",
          "timestamp_epoch": "1647897816.615084000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3694,
          "display_filter": "frame.number == 3694",
          "timestamp_epoch": "1647897816.616039000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3696,
          "display_filter": "frame.number == 3696",
          "timestamp_epoch": "1647897816.616993000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3698,
          "display_filter": "frame.number == 3698",
          "timestamp_epoch": "1647897816.617777000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3700,
          "display_filter": "frame.number == 3700",
          "timestamp_epoch": "1647897816.618281000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3702,
          "display_filter": "frame.number == 3702",
          "timestamp_epoch": "1647897816.618775000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3704,
          "display_filter": "frame.number == 3704",
          "timestamp_epoch": "1647897816.619241000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3706,
          "display_filter": "frame.number == 3706",
          "timestamp_epoch": "1647897816.619754000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3708,
          "display_filter": "frame.number == 3708",
          "timestamp_epoch": "1647897816.620196000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 3710,
          "display_filter": "frame.number == 3710",
          "timestamp_epoch": "1647897816.620689000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4287,
          "display_filter": "frame.number == 4287",
          "timestamp_epoch": "1647899008.804112000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4289,
          "display_filter": "frame.number == 4289",
          "timestamp_epoch": "1647899008.804461000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4291,
          "display_filter": "frame.number == 4291",
          "timestamp_epoch": "1647899008.804796000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4293,
          "display_filter": "frame.number == 4293",
          "timestamp_epoch": "1647899008.805122000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4295,
          "display_filter": "frame.number == 4295",
          "timestamp_epoch": "1647899008.805561000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4301,
          "display_filter": "frame.number == 4301",
          "timestamp_epoch": "1647899008.806089000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4307,
          "display_filter": "frame.number == 4307",
          "timestamp_epoch": "1647899008.806952000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4317,
          "display_filter": "frame.number == 4317",
          "timestamp_epoch": "1647899008.807692000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4320,
          "display_filter": "frame.number == 4320",
          "timestamp_epoch": "1647899008.808242000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4324,
          "display_filter": "frame.number == 4324",
          "timestamp_epoch": "1647899008.808757000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4330,
          "display_filter": "frame.number == 4330",
          "timestamp_epoch": "1647899008.809201000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4332,
          "display_filter": "frame.number == 4332",
          "timestamp_epoch": "1647899008.809495000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4334,
          "display_filter": "frame.number == 4334",
          "timestamp_epoch": "1647899008.809881000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4336,
          "display_filter": "frame.number == 4336",
          "timestamp_epoch": "1647899008.810217000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4338,
          "display_filter": "frame.number == 4338",
          "timestamp_epoch": "1647899008.810629000"
        }
      ]
    },
    {
      "id": "identity-2a4241613ba373b5bdb6675f",
      "type": "identity",
      "label": "account: DESKTOP-5QS3D5D$",
      "value": "DESKTOP-5QS3D5D$",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "10.0.19.14"
      ],
      "identity_type": "account",
      "frame_evidence": [
        {
          "tcp_stream": 282,
          "frame_number": 12633,
          "display_filter": "frame.number == 12633",
          "timestamp_epoch": "1647911020.809733000"
        },
        {
          "tcp_stream": 283,
          "frame_number": 12641,
          "display_filter": "frame.number == 12641",
          "timestamp_epoch": "1647911020.825241000"
        },
        {
          "tcp_stream": 283,
          "frame_number": 12643,
          "display_filter": "frame.number == 12643",
          "timestamp_epoch": "1647911020.826922000"
        },
        {
          "tcp_stream": 284,
          "frame_number": 12655,
          "display_filter": "frame.number == 12655",
          "timestamp_epoch": "1647911020.830086000"
        },
        {
          "tcp_stream": 420,
          "frame_number": 15402,
          "display_filter": "frame.number == 15402",
          "timestamp_epoch": "1647917039.078464000"
        },
        {
          "tcp_stream": 421,
          "frame_number": 15414,
          "display_filter": "frame.number == 15414",
          "timestamp_epoch": "1647917039.081571000"
        },
        {
          "tcp_stream": 441,
          "frame_number": 15741,
          "display_filter": "frame.number == 15741",
          "timestamp_epoch": "1647917939.047983000"
        },
        {
          "tcp_stream": 457,
          "frame_number": 16053,
          "display_filter": "frame.number == 16053",
          "timestamp_epoch": "1647918729.757812000"
        },
        {
          "tcp_stream": 458,
          "frame_number": 16061,
          "display_filter": "frame.number == 16061",
          "timestamp_epoch": "1647918729.779634000"
        },
        {
          "tcp_stream": 458,
          "frame_number": 16063,
          "display_filter": "frame.number == 16063",
          "timestamp_epoch": "1647918729.781341000"
        },
        {
          "tcp_stream": 459,
          "frame_number": 16077,
          "display_filter": "frame.number == 16077",
          "timestamp_epoch": "1647918729.784514000"
        }
      ]
    },
    {
      "id": "identity-44d78aa32c6481d13eb35655",
      "type": "identity",
      "label": "account: patrick.zimmerman",
      "value": "patrick.zimmerman",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "10.0.19.14"
      ],
      "identity_type": "account",
      "frame_evidence": [
        {
          "tcp_stream": 29,
          "frame_number": 3696,
          "display_filter": "frame.number == 3696",
          "timestamp_epoch": "1647897816.616993000"
        },
        {
          "tcp_stream": 41,
          "frame_number": 4150,
          "display_filter": "frame.number == 4150",
          "timestamp_epoch": "1647899008.771958000"
        },
        {
          "tcp_stream": 43,
          "frame_number": 4162,
          "display_filter": "frame.number == 4162",
          "timestamp_epoch": "1647899008.773229000"
        },
        {
          "tcp_stream": 44,
          "frame_number": 4171,
          "display_filter": "frame.number == 4171",
          "timestamp_epoch": "1647899008.778106000"
        },
        {
          "tcp_stream": 44,
          "frame_number": 4173,
          "display_filter": "frame.number == 4173",
          "timestamp_epoch": "1647899008.779758000"
        },
        {
          "tcp_stream": 45,
          "frame_number": 4181,
          "display_filter": "frame.number == 4181",
          "timestamp_epoch": "1647899008.782862000"
        },
        {
          "tcp_stream": 45,
          "frame_number": 4183,
          "display_filter": "frame.number == 4183",
          "timestamp_epoch": "1647899008.784427000"
        },
        {
          "tcp_stream": 46,
          "frame_number": 4195,
          "display_filter": "frame.number == 4195",
          "timestamp_epoch": "1647899008.787474000"
        },
        {
          "tcp_stream": 47,
          "frame_number": 4235,
          "display_filter": "frame.number == 4235",
          "timestamp_epoch": "1647899008.798204000"
        },
        {
          "tcp_stream": 50,
          "frame_number": 4253,
          "display_filter": "frame.number == 4253",
          "timestamp_epoch": "1647899008.799509000"
        },
        {
          "tcp_stream": 49,
          "frame_number": 4255,
          "display_filter": "frame.number == 4255",
          "timestamp_epoch": "1647899008.800293000"
        },
        {
          "tcp_stream": 51,
          "frame_number": 4300,
          "display_filter": "frame.number == 4300",
          "timestamp_epoch": "1647899008.806011000"
        },
        {
          "tcp_stream": 51,
          "frame_number": 4306,
          "display_filter": "frame.number == 4306",
          "timestamp_epoch": "1647899008.806952000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4317,
          "display_filter": "frame.number == 4317",
          "timestamp_epoch": "1647899008.807692000"
        },
        {
          "tcp_stream": 52,
          "frame_number": 4323,
          "display_filter": "frame.number == 4323",
          "timestamp_epoch": "1647899008.808757000"
        },
        {
          "tcp_stream": 54,
          "frame_number": 4359,
          "display_filter": "frame.number == 4359",
          "timestamp_epoch": "1647899008.902878000"
        },
        {
          "tcp_stream": 105,
          "frame_number": 7005,
          "display_filter": "frame.number == 7005",
          "timestamp_epoch": "1647900354.453638000"
        }
      ]
    },
    {
      "id": "identity-72755737df202221413f04f1",
      "type": "identity",
      "label": "full-name: Patrick Zimmerman",
      "value": "Patrick Zimmerman",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "10.0.19.14"
      ],
      "identity_type": "full-name",
      "frame_evidence": [
        {
          "tcp_stream": 29,
          "frame_number": 3696,
          "display_filter": "frame.number == 3696",
          "timestamp_epoch": "1647897816.616993000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 4317,
          "display_filter": "frame.number == 4317",
          "timestamp_epoch": "1647899008.807692000"
        }
      ]
    },
    {
      "id": "identity-7ac8610f0db400a7547dd3cd",
      "type": "identity",
      "label": "hostname: BURNINCANDLE",
      "value": "BURNINCANDLE",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "10.0.19.14",
        "169.254.179.89"
      ],
      "identity_type": "hostname",
      "frame_evidence": [
        {
          "udp_stream": 26,
          "frame_number": 3763,
          "display_filter": "frame.number == 3763",
          "timestamp_epoch": "1647898105.665651000"
        },
        {
          "udp_stream": 26,
          "frame_number": 3764,
          "display_filter": "frame.number == 3764",
          "timestamp_epoch": "1647898106.415606000"
        },
        {
          "udp_stream": 26,
          "frame_number": 3765,
          "display_filter": "frame.number == 3765",
          "timestamp_epoch": "1647898107.165747000"
        },
        {
          "udp_stream": 26,
          "frame_number": 3766,
          "display_filter": "frame.number == 3766",
          "timestamp_epoch": "1647898107.931579000"
        },
        {
          "udp_stream": 6,
          "frame_number": 3933,
          "display_filter": "frame.number == 3933",
          "timestamp_epoch": "1647898117.056425000"
        },
        {
          "udp_stream": 5,
          "frame_number": 3937,
          "display_filter": "frame.number == 3937",
          "timestamp_epoch": "1647898117.057486000"
        },
        {
          "udp_stream": 8,
          "frame_number": 3938,
          "display_filter": "frame.number == 3938",
          "timestamp_epoch": "1647898117.057620000"
        },
        {
          "udp_stream": 6,
          "frame_number": 3965,
          "display_filter": "frame.number == 3965",
          "timestamp_epoch": "1647898117.175200000"
        }
      ]
    },
    {
      "id": "identity-db69bb10353cead93d493c08",
      "type": "identity",
      "label": "hostname: BURNINCANDLE-DC",
      "value": "BURNINCANDLE-DC",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "10.0.19.9"
      ],
      "identity_type": "hostname",
      "frame_evidence": [
        {
          "tcp_stream": 34,
          "frame_number": 3980,
          "display_filter": "frame.number == 3980",
          "timestamp_epoch": "1647898117.180785000"
        }
      ]
    },
    {
      "id": "identity-3093adbb9490c8edf125441f",
      "type": "identity",
      "label": "hostname: DESKTOP-5QS3D5D",
      "value": "DESKTOP-5QS3D5D",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "10.0.19.14",
        "169.254.179.89"
      ],
      "identity_type": "hostname",
      "frame_evidence": [
        {
          "udp_stream": 30,
          "frame_number": 3771,
          "display_filter": "frame.number == 3771",
          "timestamp_epoch": "1647898110.838235000"
        },
        {
          "udp_stream": 30,
          "frame_number": 3773,
          "display_filter": "frame.number == 3773",
          "timestamp_epoch": "1647898110.843938000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 744,
          "display_filter": "frame.number == 744",
          "timestamp_epoch": "1647896380.935810000"
        },
        {
          "udp_stream": 5,
          "frame_number": 3241,
          "display_filter": "frame.number == 3241",
          "timestamp_epoch": "1647896486.782059000"
        },
        {
          "udp_stream": 5,
          "frame_number": 3513,
          "display_filter": "frame.number == 3513",
          "timestamp_epoch": "1647897206.969096000"
        },
        {
          "udp_stream": 26,
          "frame_number": 3723,
          "display_filter": "frame.number == 3723",
          "timestamp_epoch": "1647898089.463553000"
        },
        {
          "udp_stream": 26,
          "frame_number": 3725,
          "display_filter": "frame.number == 3725",
          "timestamp_epoch": "1647898089.463705000"
        },
        {
          "udp_stream": 26,
          "frame_number": 3727,
          "display_filter": "frame.number == 3727",
          "timestamp_epoch": "1647898090.213290000"
        },
        {
          "udp_stream": 26,
          "frame_number": 3729,
          "display_filter": "frame.number == 3729",
          "timestamp_epoch": "1647898090.213449000"
        },
        {
          "udp_stream": 26,
          "frame_number": 3731,
          "display_filter": "frame.number == 3731",
          "timestamp_epoch": "1647898090.994480000"
        },
        {
          "udp_stream": 26,
          "frame_number": 3733,
          "display_filter": "frame.number == 3733",
          "timestamp_epoch": "1647898090.994651000"
        },
        {
          "udp_stream": 26,
          "frame_number": 3734,
          "display_filter": "frame.number == 3734",
          "timestamp_epoch": "1647898091.744584000"
        },
        {
          "udp_stream": 26,
          "frame_number": 3736,
          "display_filter": "frame.number == 3736",
          "timestamp_epoch": "1647898091.744698000"
        },
        {
          "udp_stream": 28,
          "frame_number": 3743,
          "display_filter": "frame.number == 3743",
          "timestamp_epoch": "1647898095.636081000"
        },
        {
          "udp_stream": 28,
          "frame_number": 3744,
          "display_filter": "frame.number == 3744",
          "timestamp_epoch": "1647898095.639796000"
        },
        {
          "udp_stream": 28,
          "frame_number": 3746,
          "display_filter": "frame.number == 3746",
          "timestamp_epoch": "1647898097.135990000"
        },
        {
          "udp_stream": 28,
          "frame_number": 3748,
          "display_filter": "frame.number == 3748",
          "timestamp_epoch": "1647898098.636150000"
        },
        {
          "udp_stream": 28,
          "frame_number": 3750,
          "display_filter": "frame.number == 3750",
          "timestamp_epoch": "1647898100.136185000"
        },
        {
          "udp_stream": 28,
          "frame_number": 3751,
          "display_filter": "frame.number == 3751",
          "timestamp_epoch": "1647898101.636244000"
        },
        {
          "udp_stream": 28,
          "frame_number": 3753,
          "display_filter": "frame.number == 3753",
          "timestamp_epoch": "1647898102.636332000"
        }
      ]
    },
    {
      "id": "identity-6a4dd1565ad9630ae9bc9a9d",
      "type": "identity",
      "label": "netbios-group: BURNINCANDLE",
      "value": "BURNINCANDLE",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [],
      "identity_type": "netbios-group",
      "frame_evidence": [
        {
          "udp_stream": 26,
          "frame_number": 3724,
          "display_filter": "frame.number == 3724",
          "timestamp_epoch": "1647898089.463705000"
        },
        {
          "udp_stream": 26,
          "frame_number": 3728,
          "display_filter": "frame.number == 3728",
          "timestamp_epoch": "1647898090.213449000"
        },
        {
          "udp_stream": 26,
          "frame_number": 3732,
          "display_filter": "frame.number == 3732",
          "timestamp_epoch": "1647898090.994651000"
        },
        {
          "udp_stream": 26,
          "frame_number": 3735,
          "display_filter": "frame.number == 3735",
          "timestamp_epoch": "1647898091.744698000"
        },
        {
          "udp_stream": 26,
          "frame_number": 3737,
          "display_filter": "frame.number == 3737",
          "timestamp_epoch": "1647898092.557145000"
        },
        {
          "udp_stream": 26,
          "frame_number": 3738,
          "display_filter": "frame.number == 3738",
          "timestamp_epoch": "1647898093.322841000"
        },
        {
          "udp_stream": 26,
          "frame_number": 3740,
          "display_filter": "frame.number == 3740",
          "timestamp_epoch": "1647898094.088809000"
        },
        {
          "udp_stream": 26,
          "frame_number": 3741,
          "display_filter": "frame.number == 3741",
          "timestamp_epoch": "1647898094.854186000"
        },
        {
          "udp_stream": 6,
          "frame_number": 3840,
          "display_filter": "frame.number == 3840",
          "timestamp_epoch": "1647898111.838130000"
        },
        {
          "udp_stream": 6,
          "frame_number": 3908,
          "display_filter": "frame.number == 3908",
          "timestamp_epoch": "1647898112.603273000"
        },
        {
          "udp_stream": 6,
          "frame_number": 3914,
          "display_filter": "frame.number == 3914",
          "timestamp_epoch": "1647898113.353272000"
        },
        {
          "udp_stream": 6,
          "frame_number": 3920,
          "display_filter": "frame.number == 3920",
          "timestamp_epoch": "1647898113.963345000"
        },
        {
          "udp_stream": 6,
          "frame_number": 3922,
          "display_filter": "frame.number == 3922",
          "timestamp_epoch": "1647898114.119089000"
        },
        {
          "udp_stream": 6,
          "frame_number": 3926,
          "display_filter": "frame.number == 3926",
          "timestamp_epoch": "1647898114.712700000"
        },
        {
          "udp_stream": 6,
          "frame_number": 3928,
          "display_filter": "frame.number == 3928",
          "timestamp_epoch": "1647898115.478242000"
        },
        {
          "udp_stream": 6,
          "frame_number": 3930,
          "display_filter": "frame.number == 3930",
          "timestamp_epoch": "1647898116.228516000"
        },
        {
          "udp_stream": 6,
          "frame_number": 3971,
          "display_filter": "frame.number == 3971",
          "timestamp_epoch": "1647898117.176561000"
        },
        {
          "udp_stream": 6,
          "frame_number": 3991,
          "display_filter": "frame.number == 3991",
          "timestamp_epoch": "1647898117.915697000"
        },
        {
          "udp_stream": 6,
          "frame_number": 3994,
          "display_filter": "frame.number == 3994",
          "timestamp_epoch": "1647898118.668493000"
        },
        {
          "udp_stream": 6,
          "frame_number": 3995,
          "display_filter": "frame.number == 3995",
          "timestamp_epoch": "1647898119.418463000"
        }
      ]
    },
    {
      "id": "artifact-d24255e48e0070f8c225c93c",
      "type": "file-artifact",
      "label": "%2f",
      "value": "ac64292e91738bf97842e7e5d28373a3a52bdb0aa2bc48a0df512e34d1b41501",
      "sha256": "ac64292e91738bf97842e7e5d28373a3a52bdb0aa2bc48a0df512e34d1b41501",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 393277,
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-5492fcec932ba9fc3902fb19",
      "type": "file-artifact",
      "label": "%2f(1)",
      "value": "67add1166b020ae61b8f5fc96813c04c2aa589960796865572a3c7e737613dfd",
      "sha256": "67add1166b020ae61b8f5fc96813c04c2aa589960796865572a3c7e737613dfd",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1306,
      "source_ref": "2022-03-21-traffic-analysis-exercise.pcap",
      "analysis_id": "6df36b51-4b44-4660-b534-2fa89705e807",
      "source_refs": [
        "2022-03-21-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    }
  ],
  "evidence_edges": [],
  "timeline": [
    {
      "at": "2026-09-19T12:50:17.892Z",
      "event": "Added Log/PCAP analysis 2022-03-21-traffic-analysis-exercise.pcap",
      "source": "Log/PCAP analysis 2022-03-21-traffic-analysis-exercise.pcap",
      "actor_count": 0,
      "report_count": 0,
      "technique_count": 0
    },
    {
      "at": "2026-09-19T12:58:07.059Z",
      "event": "Added Log/PCAP analysis 2022-03-21-traffic-analysis-exercise.pcap",
      "source": "Log/PCAP analysis 2022-03-21-traffic-analysis-exercise.pcap",
      "actor_count": 0,
      "report_count": 0,
      "technique_count": 0
    }
  ],
  "created_at": "2026-09-19T12:50:14.467796+00:00",
  "updated_at": "2026-09-19T12:58:07.080408+00:00"
}