{ "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b", "session_id": "a894fbbc-d0d5-4309-bd04-2eda8773adfa", "status": "completed", "filename": "2024-08-15-traffic-analysis-exercise.pcap", "source_sha256": "e154de6895c5f0a9edd07b1279b33014507236dbb44a449790c255b87a327a3c", "source_size_bytes": 11965173, "schema_version": "pcap-analysis-v1", "semantic_sha256": "f1e40c750b6946d0db5734f3fb390579d65b42e1dbb9cdd67b0a5c6d2f3174ab", "analyzer_manifest": { "schema_version": "pcap-analyzer-manifest-v1", "profile_id": "tshark-evidence-v3", "rulepack_version": "pcap-rules-v3", "tshark_version": "TShark (Wireshark) 4.4.18.", "implementation_sha256": "9e8d2397c92213d4143ee2e4e2f86f0c1606d085cc7a81fd3ab98e687a5a9388", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "limits": { "max_upload_bytes": 536870912, "tool_timeout_seconds": 300, "max_tool_output_bytes": 268435456, "max_events_per_kind": 50000, "max_flows": 50000, "max_endpoints": 20000, "max_exported_objects": 500, "max_object_hash_index": 50000, "max_exported_object_bytes": 52428800, "max_exported_total_bytes": 268435456 }, "requested_fields_sha256": "fb9865915ed277886a75f522c6f27708f67e4e28e7a9d4a051ed816dd6783b15", "supported_profile_fields_sha256": "917cc2ac17024ecb151d0baaf8ddfb0767624db4f29d127ec668d6ebb5d80604", "profile_sha256": "7bdd5b06266e645efbbef1674e9934e21a27fcb37b084c18bcfe6abd8192ade3", "manifest_sha256": "ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde" }, "summary": "Decoded 18189 packets across 75 IP endpoints and 698 transport flows. Observed 430 DNS events, 404 HTTP requests, 174 TLS ClientHello events, and 18 exported HTTP object(s). Deterministic rules produced 8 finding(s): 1 high, 0 medium, and 7 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2024-08-15-traffic-analysis-exercise.pcap\nCapture SHA-256: `e154de6895c5f0a9edd07b1279b33014507236dbb44a449790c255b87a327a3c`\nSemantic result SHA-256: `f1e40c750b6946d0db5734f3fb390579d65b42e1dbb9cdd67b0a5c6d2f3174ab`\nAnalyzer manifest SHA-256: `ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde`\n\n## Executive summary\n\nDecoded 18189 packets across 75 IP endpoints and 698 transport flows. Observed 430 DNS events, 404 HTTP requests, 174 TLS ClientHello events, and 18 exported HTTP object(s). Deterministic rules produced 8 finding(s): 1 high, 0 medium, and 7 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 18189\n- Duration: 1962.204948 seconds\n- Captured bytes: 11674125\n- Endpoints: 75\n- Flows: 698\n\n## Deterministic findings\n\n### HIGH — Periodic HTTP callback pattern\n\nRepeated requests have a stable cadence consistent with automated callback or beacon behavior.\n\nRule: `periodic-http-callbacks@pcap-rules-v3`; confidence: 0.88; evidence: frame 11028 / TCP stream 142, frame 11505 / TCP stream 145, frame 11619 / TCP stream 151, frame 11688 / TCP stream 155, frame 11962 / TCP stream 164.\n\nMetrics: `{\"destination\":\"72.5.43.29\",\"host\":\"72.5.43.29\",\"median_absolute_deviation\":1.037,\"median_interval_seconds\":5.685,\"method\":\"GET\",\"port\":80,\"request_count\":303,\"source\":\"10.8.15.133\",\"uri\":\"/\"}`\n\n### LOW — Repeated unsuccessful DNS resolution\n\nRepeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.\n\nRule: `repeated-nxdomain@pcap-rules-v3`; confidence: 0.5; evidence: frame 56, frame 60, frame 962, frame 964, frame 2106.\n\nMetrics: `{\"domain\":\"wpad.lafontainebleu.org\",\"response_count\":20,\"source\":\"10.8.15.133\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 281 / TCP stream 11, frame 285 / TCP stream 11, frame 292 / TCP stream 11, frame 297 / TCP stream 11, frame 312 / TCP stream 11.\n\nMetrics: `{\"destination\":\"10.8.15.4\",\"event_count\":69,\"operation_numbers\":[\"0\",\"1\",\"12\",\"13\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"10.8.15.133\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 37 / TCP stream 0, frame 288 / TCP stream 19, frame 295 / TCP stream 19, frame 300 / TCP stream 19, frame 304 / TCP stream 19.\n\nMetrics: `{\"destination\":\"10.8.15.4\",\"event_count\":143,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.8.15.133\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 1096 / TCP stream 1, frame 1098 / TCP stream 1, frame 1100 / TCP stream 1, frame 1102 / TCP stream 1, frame 1104 / TCP stream 1.\n\nMetrics: `{\"destination\":\"10.8.15.4\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.8.15.133\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 282 / TCP stream 11, frame 287 / TCP stream 11, frame 293 / TCP stream 11, frame 298 / TCP stream 11, frame 313 / TCP stream 11.\n\nMetrics: `{\"destination\":\"10.8.15.133\",\"event_count\":69,\"operation_numbers\":[\"0\",\"1\",\"12\",\"13\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"10.8.15.4\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 39 / TCP stream 0, frame 290 / TCP stream 19, frame 299 / TCP stream 19, frame 302 / TCP stream 19, frame 305 / TCP stream 19.\n\nMetrics: `{\"destination\":\"10.8.15.133\",\"event_count\":113,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.8.15.4\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 1097 / TCP stream 1, frame 1099 / TCP stream 1, frame 1101 / TCP stream 1, frame 1103 / TCP stream 1, frame 1105 / TCP stream 1.\n\nMetrics: `{\"destination\":\"10.8.15.133\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.8.15.4\"}`\n\n## ATT&CK candidates\n\n- T1071.001 Application Layer Protocol: Web Protocols (command-and-control), confidence=0.85, status=suggested; basis=versioned-deterministic-rule.\n\n## Identities\n\n- account: `desktop-h8alzbv$`; client IPs: 10.8.15.133; frames: 151, 166, 169, 173, 187\n- account: `plucero`; client IPs: 10.8.15.133; frames: 975, 983, 985, 997, 1011\n- full-name: `Pierce Lucero`; client IPs: 10.8.15.133; frames: 1111\n- hostname: `DESKTOP-H8ALZBV`; client IPs: 10.8.15.133; frames: 1, 3, 5, 30, 58\n- netbios-group: `LAFONTAINEBLEU`; client IPs: unbound subject; frames: 31, 57, 103, 447\n\n## IOC and artifact candidates\n\n- domain: `a1834.dscg2.akamai.net`; roles: dns-cname\n- domain: `acroipm2.adobe.com`; roles: dns-query, http-host\n- domain: `api.msn.com`; roles: dns-query, tls-sni\n- domain: `app-edge.smartscreen.microsoft.com`; roles: dns-query, tls-sni\n- domain: `armmf.adobe.com`; roles: dns-query, tls-sni\n- domain: `assets.msn.com`; roles: dns-query, tls-sni\n- domain: `blob.mwh03prdstf02a.store.core.windows.net`; roles: dns-cname\n- domain: `browser.events.data.msn.com`; roles: dns-query, tls-sni\n- domain: `business.bing.com`; roles: dns-query, tls-sni\n- domain: `business.checkfedexexp.com`; roles: dns-query, tls-sni\n- domain: `bzib.nelreports.net`; roles: dns-query, tls-sni\n- domain: `c-msn-com-nsatc.trafficmanager.net`; roles: dns-cname\n- domain: `c-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `c.bing.com`; roles: dns-query, tls-sni\n- domain: `c.msn.com`; roles: dns-query, tls-sni\n- domain: `client.wns.windows.com`; roles: dns-query, tls-sni\n- domain: `cxcs.microsoft.net`; roles: dns-query, tls-sni\n- domain: `default.exp-tas.com`; roles: dns-query, tls-sni\n- domain: `displaycatalog.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `dl-edge.smartscreen.microsoft.com`; roles: dns-query\n- domain: `dual-s-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `ecn-us.dev.virtualearth.net`; roles: dns-query, tls-sni\n- domain: `ecs.office.com`; roles: dns-query, tls-sni\n- domain: `edge-consumer-static.azureedge.net`; roles: dns-query, tls-sni\n- domain: `edge-microsoft-com.dual-a-0036.a-msedge.net`; roles: dns-cname\n- domain: `edge.microsoft.com`; roles: dns-query, tls-sni\n- domain: `edgeservices.bing.com`; roles: dns-query, tls-sni\n- domain: `fd.api.iris.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fe2cr.update.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fe2cr.update.msft.com.trafficmanager.net`; roles: dns-cname\n- domain: `fe3cr.delivery.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fp.msedge.net`; roles: dns-query, tls-sni\n- domain: `g.live.com`; roles: dns-query, tls-sni\n- domain: `go.microsoft.com`; roles: dns-query, tls-sni\n- domain: `img-s-msn-com.akamaized.net`; roles: dns-query, tls-sni\n- domain: `img.s-msn.com`; roles: dns-query, tls-sni\n- domain: `licensing.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `login.microsoftonline.com`; roles: dns-query, tls-sni\n- domain: `mobile.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `mrodevicemgr.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `msedge.b.tlu.dl.delivery.mp.microsoft.com`; roles: dns-query, http-host\n- domain: `nav-edge.smartscreen.microsoft.com`; roles: dns-query, tls-sni\n- domain: `nav.smartscreen.microsoft.com`; roles: dns-query, tls-sni\n- domain: `ntp.msn.com`; roles: dns-query, tls-sni\n- domain: `odc.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `officeclient.microsoft.com`; roles: dns-query, tls-sni\n- domain: `oneclient.sfx.ms`; roles: dns-query, tls-sni\n- domain: `oneocsp.microsoft.com`; roles: dns-query, http-host\n- domain: `ow1.res.office365.com`; roles: dns-query, tls-sni\n- domain: `prod.mrodevicemgr.live.com.akadns.net`; roles: dns-cname\n- domain: `pti.store.microsoft.com`; roles: dns-query\n- domain: `quote.checkfedexexp.com`; roles: dns-query, http-host\n- domain: `r-msftstatic-com.a-0016.a-msedge.net`; roles: dns-cname\n- domain: `r.bing.com`; roles: dns-query, tls-sni\n- domain: `r.msftstatic.com`; roles: dns-query, tls-sni\n- domain: `sb.scorecardresearch.com`; roles: dns-query, tls-sni\n- domain: `settings-win.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `srtb.msn.com`; roles: dns-query, tls-sni\n- domain: `storecatalogrevocation.storequality.microsoft.com`; roles: dns-query, tls-sni\n- domain: `th.bing.com`; roles: dns-query, tls-sni\n- domain: `v10.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `v20.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `weathermapdata.blob.core.windows.net`; roles: dns-query, tls-sni\n- domain: `win-jegjix7q9rs.lafontainebleu.org`; roles: dns-query\n- domain: `windows.msn.com`; roles: dns-query, tls-sni\n- domain: `wns.notify.trafficmanager.net`; roles: dns-cname\n- domain: `wpad.lafontainebleu.org`; roles: dns-query\n- domain: `www.bing.com`; roles: dns-query, tls-sni\n- domain: `www.msftconnecttest.com`; roles: dns-query, http-host\n- domain: `www.msn.com`; roles: dns-query, tls-sni\n- ipv4: `0.0.0.0`; roles: network-endpoint\n- ipv4: `10.8.15.133`; roles: network-endpoint\n- ipv4: `10.8.15.255`; roles: network-endpoint\n- ipv4: `10.8.15.4`; roles: dns-answer, network-endpoint\n- ipv4: `104.21.55.70`; roles: dns-answer, network-endpoint\n- ipv4: `104.40.82.182`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.21.237`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.21.239`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.246.57`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.4.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.5.93`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.6.158`; roles: dns-answer, network-endpoint\n- ipv4: `13.70.79.200`; roles: dns-answer, network-endpoint\n- ipv4: `13.85.23.206`; roles: dns-answer, network-endpoint\n- ipv4: `13.89.179.13`; roles: dns-answer, network-endpoint\n- ipv4: `172.67.170.159`; roles: dns-answer, network-endpoint\n- ipv4: `18.160.156.115`; roles: dns-answer, network-endpoint\n- ipv4: `18.160.156.14`; roles: dns-answer\n- ipv4: `18.160.156.41`; roles: dns-answer\n- ipv4: `18.160.156.89`; roles: dns-answer\n- ipv4: `199.232.210.172`; roles: dns-answer, network-endpoint\n- ipv4: `199.232.214.172`; roles: dns-answer\n- ipv4: `20.10.31.115`; roles: dns-answer, network-endpoint\n- ipv4: `20.125.209.212`; roles: dns-answer, network-endpoint\n- ipv4: `20.163.45.186`; roles: dns-answer\n- ipv4: `20.189.173.9`; roles: dns-answer, network-endpoint\n- ipv4: `20.190.157.9`; roles: dns-answer\n- ipv4: `20.241.44.114`; roles: dns-answer, network-endpoint\n- ipv4: `20.25.227.174`; roles: dns-answer, network-endpoint\n- ipv4: `20.3.0.251`; roles: dns-answer, network-endpoint\n- ipv4: `20.42.65.88`; roles: dns-answer, network-endpoint\n- ipv4: `20.42.65.94`; roles: dns-answer, network-endpoint\n- ipv4: `20.42.72.131`; roles: dns-answer, network-endpoint\n- ipv4: `20.44.10.122`; roles: dns-answer, network-endpoint\n- ipv4: `20.60.228.1`; roles: dns-answer, network-endpoint\n- ipv4: `20.96.153.111`; roles: dns-answer, network-endpoint\n- ipv4: `20.99.184.37`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.203`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.219`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.222`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.237`; roles: dns-answer\n- ipv4: `204.79.197.239`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.251`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.194.68.140`; roles: dns-answer, network-endpoint\n- ipv4: `23.195.200.230`; roles: dns-answer, network-endpoint\n- ipv4: `23.205.110.12`; roles: dns-answer, network-endpoint\n- ipv4: `23.205.110.48`; roles: dns-answer, network-endpoint\n- ipv4: `23.205.110.59`; roles: dns-answer\n- ipv4: `23.205.110.62`; roles: dns-answer\n- ipv4: `23.215.55.139`; roles: dns-answer, network-endpoint\n- ipv4: `23.215.55.144`; roles: dns-answer\n- ipv4: `23.220.103.18`; roles: dns-answer, network-endpoint\n- ipv4: `23.220.103.72`; roles: dns-answer, network-endpoint\n- ipv4: `23.220.103.78`; roles: dns-answer\n- ipv4: `23.220.103.8`; roles: dns-answer, network-endpoint\n- ipv4: `23.220.251.196`; roles: dns-answer\n- ipv4: `23.220.251.208`; roles: dns-answer, network-endpoint\n- ipv4: `23.221.36.164`; roles: dns-answer, network-endpoint\n- ipv4: `23.223.31.29`; roles: dns-answer\n- ipv4: `23.223.31.31`; roles: dns-answer\n- ipv4: `23.223.31.32`; roles: dns-answer\n- ipv4: `23.223.31.33`; roles: dns-answer\n- ipv4: `23.223.31.34`; roles: dns-answer, network-endpoint\n- ipv4: `23.223.31.36`; roles: dns-answer\n- ipv4: `23.223.31.37`; roles: dns-answer\n- ipv4: `23.223.31.39`; roles: dns-answer\n- ipv4: `23.223.31.40`; roles: dns-answer\n- ipv4: `23.33.138.184`; roles: dns-answer, network-endpoint\n- ipv4: `23.43.244.167`; roles: dns-answer, network-endpoint\n- ipv4: `23.53.13.196`; roles: dns-answer, network-endpoint\n- ipv4: `23.53.13.197`; roles: dns-answer, network-endpoint\n- ipv4: `23.53.13.198`; roles: dns-answer\n- ipv4: `23.53.13.199`; roles: dns-answer\n- ipv4: `23.53.13.200`; roles: dns-answer\n- ipv4: `23.53.13.202`; roles: dns-answer\n- ipv4: `23.53.13.203`; roles: dns-answer, network-endpoint\n- ipv4: `23.53.13.204`; roles: dns-answer\n- ipv4: `23.53.13.205`; roles: dns-answer, network-endpoint\n- ipv4: `23.53.13.206`; roles: dns-answer\n- ipv4: `23.53.13.207`; roles: dns-answer\n- ipv4: `23.53.13.208`; roles: dns-answer\n- ipv4: `23.56.233.15`; roles: dns-answer, network-endpoint\n- ipv4: `23.60.57.94`; roles: dns-answer, network-endpoint\n- ipv4: `23.63.205.134`; roles: dns-answer, network-endpoint\n- ipv4: `23.96.180.189`; roles: dns-answer, network-endpoint\n- ipv4: `239.255.255.250`; roles: http-host, network-endpoint\n- ipv4: `255.255.255.255`; roles: network-endpoint\n- ipv4: `40.126.29.10`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.29.11`; roles: dns-answer\n- ipv4: `40.126.29.12`; roles: dns-answer\n- ipv4: `40.126.29.13`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.29.15`; roles: dns-answer\n- ipv4: `40.126.29.5`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.29.6`; roles: dns-answer\n- ipv4: `40.126.29.7`; roles: dns-answer\n- ipv4: `40.126.29.8`; roles: dns-answer\n- ipv4: `40.126.29.9`; roles: dns-answer\n- ipv4: `51.116.253.170`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.0.136`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.0.142`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.20.38`; roles: dns-answer, network-endpoint\n- ipv4: `52.113.194.132`; roles: dns-answer, network-endpoint\n- ipv4: `52.123.128.254`; roles: dns-answer, network-endpoint\n- ipv4: `52.123.129.254`; roles: dns-answer\n- ipv4: `52.137.106.217`; roles: dns-answer, network-endpoint\n- ipv4: `52.152.180.153`; roles: dns-answer, network-endpoint\n- ipv4: `52.168.117.170`; roles: dns-answer, network-endpoint\n- ipv4: `52.182.143.215`; roles: dns-answer, network-endpoint\n- ipv4: `72.5.43.29`; roles: http-host, network-endpoint\n- ja3: `08c552d3bb717cfa625b1c2e6293fbc3`; roles: tls-client-fingerprint\n- ja3: `091f51a7a1c3a4504a224cc081ce9cee`; roles: tls-client-fingerprint\n- ja3: `09218b185cadc5bc9ac32dd4af1d80ba`; roles: tls-client-fingerprint\n- ja3: `0940eef199c4e4a2d7fff1702ca8e267`; roles: tls-client-fingerprint\n- ja3: `09d2a38ae19e8be7fa018ad87e43b2ff`; roles: tls-client-fingerprint\n- ja3: `11156bf1dc969c54ae91bbfe52874a88`; roles: tls-client-fingerprint\n- ja3: `11702f6f4b7b9c9b2999ebcf2c354984`; roles: tls-client-fingerprint\n- ja3: `173448d57b47fba3f0be89e6bd4599af`; roles: tls-client-fingerprint\n- ja3: `218b9f26907447fdbf2c8a52418444b7`; roles: tls-client-fingerprint\n- ja3: `22833c8ba3c4d8d22ef4b3ff2fdd992e`; roles: tls-client-fingerprint\n- ja3: `258a5a1e95b8a911872bae9081526644`; roles: tls-client-fingerprint\n- ja3: `25e0b3677a2832677e0c136c73a02311`; roles: tls-client-fingerprint\n- ja3: `26abc27bb714c3e30049154ed7f03422`; roles: tls-client-fingerprint\n- ja3: `2f7a1c53b0a1abfffcdeff101f69baf4`; roles: tls-client-fingerprint\n- ja3: `33717d60eef91a9c824c343c9b904387`; roles: tls-client-fingerprint\n- ja3: `34f7d1c3fe8b7bb4b8cee1ceefa986a5`; roles: tls-client-fingerprint\n- ja3: `38ff17125ac547fdaf43cbc78d13056e`; roles: tls-client-fingerprint\n- ja3: `3c293bdf2a25c07559b560ba86debc77`; roles: tls-client-fingerprint\n- ja3: `3c4eb72b882d4d1442c67ce73f1292a9`; roles: tls-client-fingerprint\n- ja3: `3ec074ef84f1118c439e56727227cea3`; roles: tls-client-fingerprint\n- ja3: `46a78af27de56cd4c85b04f57deb3f79`; roles: tls-client-fingerprint\n- ja3: `46f5131e766d248db0248a86c494b71c`; roles: tls-client-fingerprint\n- ja3: `48ae6b908317f4f14e23cfd06798d78a`; roles: tls-client-fingerprint\n- ja3: `49122e3f86717743d247b0e57255881e`; roles: tls-client-fingerprint\n- ja3: `49a844a20d27ed5590377789c1ff9a1c`; roles: tls-client-fingerprint\n- ja3: `4d09d5e0a7539f71bfd5ab61fc77938e`; roles: tls-client-fingerprint\n- ja3: `4e00cf4e4608830803d4914864014e8c`; roles: tls-client-fingerprint\n- ja3: `4e96df7dcbca32c279f0af5a0930aa87`; roles: tls-client-fingerprint\n- ja3: `589c33f5c966de68b38bf824fc667e6b`; roles: tls-client-fingerprint\n- ja3: `5919f6108f098e14c2f37619021ebd4d`; roles: tls-client-fingerprint\n- ja3: `5c263245de4d50106d8e0d6087b0fcc5`; roles: tls-client-fingerprint\n- ja3: `5c576ee905a82c07ad7987fce4f39cfe`; roles: tls-client-fingerprint\n- ja3: `65005c9d9ae0f0ebeaf22c210571d482`; roles: tls-client-fingerprint\n- ja3: `68b1b54a6edfe7729708738380263a3a`; roles: tls-client-fingerprint\n- ja3: `6925f81e11a98d706da3f0cd0f7bc648`; roles: tls-client-fingerprint\n- ja3: `6a5d235ee78c6aede6a61448b4e9ff1e`; roles: tls-client-fingerprint\n- ja3: `736a3b58b94abd6c394392ae94f501c3`; roles: tls-client-fingerprint\n- ja3: `775ceba0b13f74a42447a14045d31fcc`; roles: tls-client-fingerprint\n- ja3: `973e5ee0c53bfc4aaff964c70002dcc3`; roles: tls-client-fingerprint\n- ja3: `a2fa4f21077551ea651d383707835d7b`; roles: tls-client-fingerprint\n- ja3: `ab9d07f6268ed23da4f708263cc7ed49`; roles: tls-client-fingerprint\n- ja3: `af8bdb53babadf751a582d1ed25c0eda`; roles: tls-client-fingerprint\n- ja3: `b1e1912cc21fd3c163c8ddf91f56123a`; roles: tls-client-fingerprint\n- ja3: `b4162be74fb260b4576b62481ee819de`; roles: tls-client-fingerprint\n- ja3: `b74979b1b06e1413e302d2c817ca33db`; roles: tls-client-fingerprint\n- ja3: `b7e6d0a42505ebdcb4ca793e16825d04`; roles: tls-client-fingerprint\n- ja3: `c44656a187a470fa1e85dfc1707da993`; roles: tls-client-fingerprint\n- ja3: `c6e2484ca73f97e2cbb72bacc9c9916b`; roles: tls-client-fingerprint\n- ja3: `cd51c3a587eeacaf4f714e3920764550`; roles: tls-client-fingerprint\n- ja3: `d108c2f321a2af5781ed4b63b5b28472`; roles: tls-client-fingerprint\n- ja3: `e978fa4306e6fe19e2d404321d215b00`; roles: tls-client-fingerprint\n- ja3: `eb6eb038162eb12fda714a4a5860dc83`; roles: tls-client-fingerprint\n- ja3: `ec93fbad48fbc839a6e52e85c3f5af8d`; roles: tls-client-fingerprint\n- ja3: `f0a0d117d2207afbb65df9114a8c6321`; roles: tls-client-fingerprint\n- ja3: `f957ed04f16c95c78f474482505d5e89`; roles: tls-client-fingerprint\n- ja3: `fc2ac8b293f08f588c5b93dd8b87eef6`; roles: tls-client-fingerprint\n- ja3: `fe624dd6795521519b6fbbd082375f4f`; roles: tls-client-fingerprint\n- sha256: `0078330840159b7adc1ec144a36905642a0469d68c4879febf76dbda26ffd5b2`; roles: exported-object\n- sha256: `261daf6d8ef4a2ea145dbcd589a3808af3d734af40319248dbf81746bab0f594`; roles: exported-object\n- sha256: `2ba81673f8cd827df283ad30f52bcaa0514fc065fef4398dafed3a0f612517f6`; roles: exported-object\n- sha256: `41e87d5cfc89b6168dd794c2b32cdf83bff7fe164a603416d5d7d7e399109c9b`; roles: exported-object\n- sha256: `5e4b21db2742377a82d65f7553eb8d183f781a561ff60f9421baee33b743fac4`; roles: exported-object\n- sha256: `5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61`; roles: exported-object\n- sha256: `69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820`; roles: exported-object\n- sha256: `6a42906135e357167d748aee9f36cb40bf5ba4584e85e7e1df4433ee8f38680c`; roles: exported-object\n- sha256: `798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5`; roles: exported-object\n- sha256: `8fcd6135214262cc9ef17efb67055b2a1baa9036a22325d8679192683c025e47`; roles: exported-object\n- sha256: `9579dca191a7420bab906998ffd624709de7deda27481b53f6da693765f03499`; roles: exported-object\n- sha256: `b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6`; roles: exported-object\n- sha256: `be2882b8c36a2a65594e72f3cedb87b34523d2a8b13e23e902c4cd952a0a4252`; roles: exported-object\n- sha256: `c54e6bd06d5c09a075e274a55c6d3ce31a2fabebbea38ce7083a9ebb7034a110`; roles: exported-object\n- sha256: `dff7255b90139fbc8d3e76f31b480e65fc3eb7f49f70e7876cfb3f1cb56e5123`; roles: exported-object\n- sha256: `f300d3238190768cae396cbc02636955abc1d8d2a1d9cf2b27bbd1a4d691ea64`; roles: exported-object\n- sha256: `f394b14f8fb0b1d746f13e2acb5921e4c5962984836c1187147e341fcb693b0e`; roles: exported-object\n- sha256: `f8313d5ec5090e37e52eef9455de8085810a8362db2e1226f3dc42f747651332`; roles: exported-object\n- url: `http://239.255.255.250:1900*`; roles: http-request\n- url: `http://72.5.43.29/`; roles: http-request\n- url: `http://72.5.43.29/data/0f60a3e7baecf2748b1c8183ed37d1e4`; roles: http-request\n- url: `http://acroipm2.adobe.com/assets/Owner/arm/ProcessMAU.txt`; roles: http-request\n- url: `http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8f2381c2-652d-48a2-86f6-19cb7757f5dc?P1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d`; roles: http-request\n- url: `http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6?P1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d`; roles: http-request\n- url: `http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBR2JNtr0JxEvYySpbyBWaqBmealCgQUzhUWO%2BoCo6Zr2tkr%2FeWMUr56UKgCEzMAPnPpacmgFoSqVQMAAAA%2Bc%2Bk%3D`; roles: http-request\n- url: `http://quote.checkfedexexp.com/managements?16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215`; roles: http-request\n- url: `http://www.msftconnecttest.com/connecttest.txt`; roles: http-request\n- user_agent: `Microsoft BITS/7.8`; roles: http-client\n- user_agent: `Microsoft Edge/127.0.2651.98 Windows`; roles: http-client\n- user_agent: `Microsoft NCSI`; roles: http-client\n- user_agent: `Microsoft-CryptoAPI/10.0`; roles: http-client\n- user_agent: `Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)`; roles: http-client\n- user_agent: `Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E)`; roles: http-client\n- user_agent: `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0`; roles: http-client\n- exported object `managements%3f16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215`; SHA-256 `798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5`; size 2767804 bytes\n Static content: `{\"content_kind\":\"zip\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `0f60a3e7baecf2748b1c8183ed37d1e4`; SHA-256 `b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6`; size 159232 bytes\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":159232,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `%2f(3)`; SHA-256 `261daf6d8ef4a2ea145dbcd589a3808af3d734af40319248dbf81746bab0f594`; size 305148 bytes\n- exported object `f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d(3)`; SHA-256 `8fcd6135214262cc9ef17efb67055b2a1baa9036a22325d8679192683c025e47`; size 108543 bytes\n- exported object `f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d(2)`; SHA-256 `6a42906135e357167d748aee9f36cb40bf5ba4584e85e7e1df4433ee8f38680c`; size 29990 bytes\n- exported object `f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d`; SHA-256 `f8313d5ec5090e37e52eef9455de8085810a8362db2e1226f3dc42f747651332`; size 18882 bytes\n- exported object `f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d(1)`; SHA-256 `be2882b8c36a2a65594e72f3cedb87b34523d2a8b13e23e902c4cd952a0a4252`; size 13809 bytes\n- exported object `8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d(3)`; SHA-256 `9579dca191a7420bab906998ffd624709de7deda27481b53f6da693765f03499`; size 7930 bytes\n- exported object `8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d(2)`; SHA-256 `41e87d5cfc89b6168dd794c2b32cdf83bff7fe164a603416d5d7d7e399109c9b`; size 4630 bytes\n- exported object `MFQwUjBQME4wTDAJBgUrDgMCGgUABBR2JNtr0JxEvYySpbyBWaqBmealCgQUzhUWO%2BoCo6Zr2tkr%2FeWMUr56UKgCEzMAPnPpacmgFoSqVQMAAAA%2Bc%2Bk%3D`; SHA-256 `2ba81673f8cd827df283ad30f52bcaa0514fc065fef4398dafed3a0f612517f6`; size 1782 bytes\n- exported object `8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d(1)`; SHA-256 `0078330840159b7adc1ec144a36905642a0469d68c4879febf76dbda26ffd5b2`; size 1340 bytes\n- exported object `8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d`; SHA-256 `c54e6bd06d5c09a075e274a55c6d3ce31a2fabebbea38ce7083a9ebb7034a110`; size 1120 bytes\n- exported object `%2f(5)`; SHA-256 `f300d3238190768cae396cbc02636955abc1d8d2a1d9cf2b27bbd1a4d691ea64`; size 732 bytes\n- exported object `%2f(1)`; SHA-256 `5e4b21db2742377a82d65f7553eb8d183f781a561ff60f9421baee33b743fac4`; size 124 bytes\n- exported object `%2f(10)`; SHA-256 `f394b14f8fb0b1d746f13e2acb5921e4c5962984836c1187147e341fcb693b0e`; size 94 bytes\n- exported object `%2f`; SHA-256 `dff7255b90139fbc8d3e76f31b480e65fc3eb7f49f70e7876cfb3f1cb56e5123`; size 32 bytes\n- exported object `connecttest.txt`; SHA-256 `5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61`; size 22 bytes\n- exported object `ProcessMAU.txt`; SHA-256 `69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820`; size 4 bytes\n\n## Actor similarity leads\n\n- Orangeworm (G0071): 50% TTP overlap. This is an investigation lead, not attribution.\n- SilverTerrier (G0083): 25% TTP overlap. This is an investigation lead, not attribution.\n- RedEcho (G1042): 20% TTP overlap. This is an investigation lead, not attribution.\n- Metador (G1013): 11% TTP overlap. This is an investigation lead, not attribution.\n- Rancor (G0075): 11% TTP overlap. This is an investigation lead, not attribution.\n- APT18 (G0026): 8% TTP overlap. This is an investigation lead, not attribution.\n- FIN4 (G0085): 8% TTP overlap. This is an investigation lead, not attribution.\n- Dark Caracal (G0070): 8% TTP overlap. This is an investigation lead, not attribution.\n- TA551 (G0127): 7% TTP overlap. This is an investigation lead, not attribution.\n- BITTER (G1002): 6% TTP overlap. This is an investigation lead, not attribution.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `d16753b47de8ecdb023abba50189bbcdbc68cf5a1d4b318a005b594ca7c48206`; recorded 2026-09-19T12:08:57.190731+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":272,\"observable_limit\":5000,\"observables_checked\":272,\"observables_total\":272,\"prior_case_limit_reached\":false,\"prior_cases_checked\":8,\"truncated\":false}`\n\n- Catalog T1071.001: https://attack.mitre.org/techniques/T1071/001; detection strategies: [{\"attack_id\":\"DET0027\",\"name\":\"Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets\",\"stix_id\":\"x-mitre-detection-strategy--e6496b9b-2458-4616-9712-a7c0da7fd3bc\"}]\n- Prior analysis `faf041c3-70e0-4a01-8780-10917e5e187c` shares 42 observations. This does not establish a common campaign.\n- Prior analysis `08324647-35af-4af2-8d82-4387eec03918` shares 46 observations. This does not establish a common campaign.\n- Prior analysis `616a90fa-f15e-4fcb-8d56-7b8e0eff5785` shares 12 observations. This does not establish a common campaign.\n- Prior analysis `459e119d-191f-49e8-85ea-c78f9de41826` shares 33 observations. This does not establish a common campaign.\n- Prior analysis `7a2cfe72-f48d-4894-8a2d-8889cb3b11b2` shares 53 observations. This does not establish a common campaign.\n- Prior analysis `81373b30-6a59-49d1-89b0-bad73ed19eaa` shares 37 observations. This does not establish a common campaign.\n- Prior analysis `38851ad7-b3a0-423d-ae89-3b7be4e4b908` shares 36 observations. This does not establish a common campaign.\n- Prior analysis `bfccc426-aa9b-4007-8558-a66d37ecb90c` shares 69 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":18,\"exported_objects\":322,\"hashed_bytes\":3449794,\"hashed_objects\":322,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":18,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":18}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 8/8, identities 5/5, observables 272/272, artifacts 18/18. Full returned inventory is in the JSON result.\n", "result": { "schema_version": "pcap-analysis-v1", "analysis_key_material": { "source_sha256": "e154de6895c5f0a9edd07b1279b33014507236dbb44a449790c255b87a327a3c", "analyzer_manifest_sha256": "ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde", "rulepack_version": "pcap-rules-v3" }, "analyzer_manifest": { "schema_version": "pcap-analyzer-manifest-v1", "profile_id": "tshark-evidence-v3", "rulepack_version": "pcap-rules-v3", "tshark_version": "TShark (Wireshark) 4.4.18.", "implementation_sha256": "9e8d2397c92213d4143ee2e4e2f86f0c1606d085cc7a81fd3ab98e687a5a9388", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "limits": { "max_upload_bytes": 536870912, "tool_timeout_seconds": 300, "max_tool_output_bytes": 268435456, "max_events_per_kind": 50000, "max_flows": 50000, "max_endpoints": 20000, "max_exported_objects": 500, "max_object_hash_index": 50000, "max_exported_object_bytes": 52428800, "max_exported_total_bytes": 268435456 }, "requested_fields_sha256": "fb9865915ed277886a75f522c6f27708f67e4e28e7a9d4a051ed816dd6783b15", "supported_profile_fields_sha256": "917cc2ac17024ecb151d0baaf8ddfb0767624db4f29d127ec668d6ebb5d80604", "profile_sha256": "7bdd5b06266e645efbbef1674e9934e21a27fcb37b084c18bcfe6abd8192ade3", "manifest_sha256": "ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde" }, "capture": { "packet_count": 18189, "captured_bytes": 11674125, "first_packet_epoch": "1723680583.804291", "last_packet_epoch": "1723682546.009239", "duration_seconds": 1962.204948, "interface_ids": [], "encapsulation_types": [ 1 ], "format": "pcap-le-microsecond", "source_sha256": "e154de6895c5f0a9edd07b1279b33014507236dbb44a449790c255b87a327a3c", "source_size_bytes": 11965173, "protocol_counts": { "eth": 18189, "ethertype": 18189, "ip": 18119, "tcp": 15367, "udp": 2733, "tls": 2257, "quic": 2151, "x509sat": 831, "x509ce": 766, "http": 658, "spnego-krb5": 584, "dns": 430, "dcerpc": 344, "data-text-lines": 309, "ldap": 271, "nbss": 270, "smb2": 267, "gss-api": 215, "data": 184, "spnego": 135, "ssdp": 82, "arp": 81, "pkix1implicit": 78, "kerberos": 50, "ocsp": 46, "cldap": 36, "pkix1explicit": 28, "igmp": 16, "nbns": 12, "icmp": 11, "media": 8, "smb": 7, "dhcp": 6, "ntp": 6, "mdns": 5, "browser": 4, "nbdgm": 4, "pkcs-1": 4, "llmnr": 1 } }, "endpoints": [ { "endpoint_id": "endpoint-15bdf0f36cf343768ed10d62", "ip": "0.0.0.0", "ip_version": 4, "is_private": true, "mac_addresses": [ "00:1c:bf:03:54:82" ], "packets_sent": 3, "packets_received": 0, "bytes_sent": 1114, "bytes_received": 0, "first_seen_epoch": "1723680583.804291", "last_seen_epoch": "1723680583.827903", "evidence_frames": [ 1, 3, 5 ] }, { "endpoint_id": "endpoint-655d10141ccd7a7910daf026", "ip": "10.8.15.133", "ip_version": 4, "is_private": true, "mac_addresses": [ "00:1c:bf:03:54:82" ], "packets_sent": 6646, "packets_received": 11456, "bytes_sent": 1829183, "bytes_received": 9839373, "first_seen_epoch": "1723680583.853056", "last_seen_epoch": "1723682546.009239", "evidence_frames": [ 9, 11, 12, 13, 14 ] }, { "endpoint_id": "endpoint-e98f4caec797fd16fa241b5b", "ip": "10.8.15.255", "ip_version": 4, "is_private": true, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "packets_sent": 0, "packets_received": 16, "bytes_sent": 0, "bytes_received": 2292, "first_seen_epoch": "1723680584.241556", "last_seen_epoch": "1723682026.693492", "evidence_frames": [ 30, 31, 57, 58, 103 ] }, { "endpoint_id": "endpoint-72c7e30a4ff4cf9b39f7fba7", "ip": "10.8.15.4", "ip_version": 4, "is_private": true, "mac_addresses": [ "64:00:6a:8c:9c:40" ], "packets_sent": 1047, "packets_received": 1204, "bytes_sent": 280979, "bytes_received": 299501, "first_seen_epoch": "1723680583.805046", "last_seen_epoch": "1723682505.432634", "evidence_frames": [ 2, 4, 6, 20, 21 ] }, { "endpoint_id": "endpoint-7bf42bbc2188991db4cfd8b8", "ip": "104.21.55.70", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 2013, "packets_received": 262, "bytes_sent": 2878151, "bytes_received": 14822, "first_seen_epoch": "1723680658.488114", "last_seen_epoch": "1723682509.723977", "evidence_frames": [ 6410, 6411, 6414, 6415, 6416 ] }, { "endpoint_id": "endpoint-4c7fd6d034af68beebbbf902", "ip": "104.40.82.182", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 21, "packets_received": 19, "bytes_sent": 9421, "bytes_received": 5161, "first_seen_epoch": "1723680668.317351", "last_seen_epoch": "1723680848.840504", "evidence_frames": [ 8720, 8721, 8722, 8723, 8724 ] }, { "endpoint_id": "endpoint-028d9e66d89821213b7221db", "ip": "13.107.21.237", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 15, "packets_received": 9, "bytes_sent": 8667, "bytes_received": 2858, "first_seen_epoch": "1723680647.723675", "last_seen_epoch": "1723680654.077979", "evidence_frames": [ 3837, 3865, 3866, 3867, 3868 ] }, { "endpoint_id": "endpoint-193bd96c0c8da2ac98c2909f", "ip": "13.107.21.239", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 35, "packets_received": 27, "bytes_sent": 16059, "bytes_received": 7659, "first_seen_epoch": "1723680619.001936", "last_seen_epoch": "1723681019.72073", "evidence_frames": [ 2117, 2144, 2145, 2146, 2147 ] }, { "endpoint_id": "endpoint-9c1662d6a242922fc8212a83", "ip": "13.107.246.57", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 19, "packets_received": 14, "bytes_sent": 8880, "bytes_received": 3598, "first_seen_epoch": "1723680648.461041", "last_seen_epoch": "1723680654.036574", "evidence_frames": [ 4407, 4416, 4417, 4418, 4419 ] }, { "endpoint_id": "endpoint-944c4415adcbf8d9a5c5a831", "ip": "13.107.4.254", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 18, "packets_received": 16, "bytes_sent": 8393, "bytes_received": 2087, "first_seen_epoch": "1723680798.272128", "last_seen_epoch": "1723680925.819115", "evidence_frames": [ 11767, 11768, 11769, 11770, 11771 ] }, { "endpoint_id": "endpoint-0d5120169bbb6acdf9802ff9", "ip": "13.107.5.93", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 19, "packets_received": 10, "bytes_sent": 15401, "bytes_received": 1817, "first_seen_epoch": "1723680626.089946", "last_seen_epoch": "1723680693.67379", "evidence_frames": [ 3543, 3544, 3545, 3546, 3547 ] }, { "endpoint_id": "endpoint-fbc11e725d6ccaeed873bdff", "ip": "13.107.6.158", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 38, "packets_received": 29, "bytes_sent": 19111, "bytes_received": 7420, "first_seen_epoch": "1723680646.466976", "last_seen_epoch": "1723680654.080948", "evidence_frames": [ 3665, 3666, 3667, 3668, 3669 ] }, { "endpoint_id": "endpoint-8e9f40e9eb12bd1156f734d7", "ip": "13.70.79.200", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 29, "packets_received": 27, "bytes_sent": 15217, "bytes_received": 5284, "first_seen_epoch": "1723682392.122793", "last_seen_epoch": "1723682502.42269", "evidence_frames": [ 17807, 17808, 17809, 17810, 17811 ] }, { "endpoint_id": "endpoint-02e9589367e9a9c144d20f88", "ip": "13.85.23.206", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 74, "packets_received": 73, "bytes_sent": 8022, "bytes_received": 91329, "first_seen_epoch": "1723680990.28839", "last_seen_epoch": "1723680998.017753", "evidence_frames": [ 13895, 13896, 13897, 13898, 13899 ] }, { "endpoint_id": "endpoint-c373a40d212f565575ef1e34", "ip": "13.89.179.13", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 39, "packets_received": 36, "bytes_sent": 16099, "bytes_received": 15541, "first_seen_epoch": "1723680588.112268", "last_seen_epoch": "1723680698.112202", "evidence_frames": [ 729, 731, 732, 733, 734 ] }, { "endpoint_id": "endpoint-b9c0731e4e6ea400636f7bfc", "ip": "172.67.170.159", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 1021, "packets_received": 122, "bytes_sent": 1472342, "bytes_received": 7250, "first_seen_epoch": "1723680684.029806", "last_seen_epoch": "1723680712.474421", "evidence_frames": [ 9028, 9029, 9030, 9031, 9032 ] }, { "endpoint_id": "endpoint-829cd14375297c10d94b9801", "ip": "18.160.156.115", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 12, "packets_received": 10, "bytes_sent": 6637, "bytes_received": 2350, "first_seen_epoch": "1723680647.762487", "last_seen_epoch": "1723680653.664093", "evidence_frames": [ 3862, 3872, 3883, 3908, 3909 ] }, { "endpoint_id": "endpoint-335f0b734200358d153e2db8", "ip": "199.232.210.172", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 158, "packets_received": 52, "bytes_sent": 201228, "bytes_received": 6963, "first_seen_epoch": "1723680685.765693", "last_seen_epoch": "1723680795.76507", "evidence_frames": [ 10195, 10196, 10197, 10198, 10199 ] }, { "endpoint_id": "endpoint-aba967d9a6f77a64784f7dd5", "ip": "20.10.31.115", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 54, "packets_received": 53, "bytes_sent": 13917, "bytes_received": 8212, "first_seen_epoch": "1723680610.593951", "last_seen_epoch": "1723682520.241749", "evidence_frames": [ 1244, 1247, 1249, 1252, 1253 ] }, { "endpoint_id": "endpoint-f7b53d211954fc1c388b76db", "ip": "20.125.209.212", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 12, "packets_received": 8, "bytes_sent": 7073, "bytes_received": 2256, "first_seen_epoch": "1723680647.731613", "last_seen_epoch": "1723680653.862234", "evidence_frames": [ 3840, 3876, 3886, 3904, 3905 ] }, { "endpoint_id": "endpoint-cf65381fc677c7c3405a15f9", "ip": "20.189.173.9", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 15, "packets_received": 12, "bytes_sent": 5492, "bytes_received": 2835, "first_seen_epoch": "1723681909.537116", "last_seen_epoch": "1723681910.052387", "evidence_frames": [ 16793, 16794, 16795, 16796, 16797 ] }, { "endpoint_id": "endpoint-e5102116adace52615620f5a", "ip": "20.241.44.114", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 30, "packets_received": 24, "bytes_sent": 15085, "bytes_received": 2759, "first_seen_epoch": "1723680622.361519", "last_seen_epoch": "1723681264.819012", "evidence_frames": [ 3004, 3010, 3012, 3015, 3016 ] }, { "endpoint_id": "endpoint-8f2d5d7bb377394d582ef96a", "ip": "20.25.227.174", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 42, "packets_received": 33, "bytes_sent": 19177, "bytes_received": 9632, "first_seen_epoch": "1723680657.317044", "last_seen_epoch": "1723681517.946127", "evidence_frames": [ 6375, 6376, 6377, 6378, 6379 ] }, { "endpoint_id": "endpoint-2273046d5fc41399d8a3e49b", "ip": "20.3.0.251", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 25, "packets_received": 17, "bytes_sent": 15498, "bytes_received": 7253, "first_seen_epoch": "1723681282.525073", "last_seen_epoch": "1723681283.088725", "evidence_frames": [ 15108, 15109, 15110, 15111, 15112 ] }, { "endpoint_id": "endpoint-3db279d354f95757764d74e8", "ip": "20.42.65.88", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 16, "packets_received": 13, "bytes_sent": 5546, "bytes_received": 3351, "first_seen_epoch": "1723681312.791867", "last_seen_epoch": "1723681313.267763", "evidence_frames": [ 15276, 15277, 15278, 15279, 15280 ] }, { "endpoint_id": "endpoint-86231d9a15f6a436fa65546b", "ip": "20.42.65.94", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 35, "packets_received": 28, "bytes_sent": 11360, "bytes_received": 9531, "first_seen_epoch": "1723681003.137486", "last_seen_epoch": "1723681007.654135", "evidence_frames": [ 14099, 14100, 14101, 14102, 14103 ] }, { "endpoint_id": "endpoint-41d2a43742c327fabefd5904", "ip": "20.42.72.131", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 222, "packets_received": 209, "bytes_sent": 37442, "bytes_received": 209731, "first_seen_epoch": "1723680647.69599", "last_seen_epoch": "1723680802.427005", "evidence_frames": [ 3830, 3851, 3852, 3854, 3855 ] }, { "endpoint_id": "endpoint-fc397c426bdb3741e8aff602", "ip": "20.44.10.122", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 16, "packets_received": 13, "bytes_sent": 5588, "bytes_received": 3241, "first_seen_epoch": "1723681209.83342", "last_seen_epoch": "1723681214.119305", "evidence_frames": [ 14928, 14929, 14930, 14931, 14932 ] }, { "endpoint_id": "endpoint-de90faaf64c8bdc5d9dd126b", "ip": "20.60.228.1", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 17, "packets_received": 15, "bytes_sent": 11233, "bytes_received": 1909, "first_seen_epoch": "1723680857.765188", "last_seen_epoch": "1723680969.356211", "evidence_frames": [ 12104, 12105, 12106, 12107, 12108 ] }, { "endpoint_id": "endpoint-60876851a711f0c8f439eb82", "ip": "20.96.153.111", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 36, "packets_received": 29, "bytes_sent": 18400, "bytes_received": 5807, "first_seen_epoch": "1723680610.58835", "last_seen_epoch": "1723681666.616862", "evidence_frames": [ 1243, 1246, 1248, 1250, 1251 ] }, { "endpoint_id": "endpoint-9f1388ee298cbdce36db4b1d", "ip": "20.99.184.37", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 15, "packets_received": 12, "bytes_sent": 7308, "bytes_received": 2687, "first_seen_epoch": "1723680988.367546", "last_seen_epoch": "1723680988.91108", "evidence_frames": [ 13851, 13852, 13853, 13854, 13855 ] }, { "endpoint_id": "endpoint-e3114e010d9889324ed48e4a", "ip": "204.79.197.203", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 415, "packets_received": 215, "bytes_sent": 352689, "bytes_received": 53872, "first_seen_epoch": "1723680613.646007", "last_seen_epoch": "1723681920.686428", "evidence_frames": [ 1486, 1492, 1493, 1494, 1495 ] }, { "endpoint_id": "endpoint-008498dd6a446c0a9c70682f", "ip": "204.79.197.219", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 28, "packets_received": 19, "bytes_sent": 14730, "bytes_received": 5794, "first_seen_epoch": "1723680649.702119", "last_seen_epoch": "1723680653.850795", "evidence_frames": [ 4808, 4845, 4861, 4862, 4863 ] }, { "endpoint_id": "endpoint-dba7c7265c02a5f886f63b67", "ip": "204.79.197.222", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 19, "packets_received": 17, "bytes_sent": 8178, "bytes_received": 2618, "first_seen_epoch": "1723680798.728173", "last_seen_epoch": "1723680927.150563", "evidence_frames": [ 11803, 11804, 11805, 11806, 11807 ] }, { "endpoint_id": "endpoint-6eb166c9faed83600afe5555", "ip": "204.79.197.239", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 68, "packets_received": 60, "bytes_sent": 26174, "bytes_received": 27794, "first_seen_epoch": "1723680619.373571", "last_seen_epoch": "1723680844.202403", "evidence_frames": [ 2283, 2290, 2291, 2292, 2293 ] }, { "endpoint_id": "endpoint-4b1b181000924c628b379cfa", "ip": "224.0.0.22", "ip_version": 4, "is_private": false, "mac_addresses": [ "01:00:5e:00:00:16" ], "packets_sent": 0, "packets_received": 8, "bytes_sent": 0, "bytes_received": 432, "first_seen_epoch": "1723680583.853056", "last_seen_epoch": "1723680609.370533", "evidence_frames": [ 9, 11, 12, 13, 14 ] }, { "endpoint_id": "endpoint-9e5810596a76095b3db190d1", "ip": "224.0.0.251", "ip_version": 4, "is_private": false, "mac_addresses": [ "01:00:5e:00:00:fb" ], "packets_sent": 0, "packets_received": 5, "bytes_sent": 0, "bytes_received": 418, "first_seen_epoch": "1723680583.88383", "last_seen_epoch": "1723680656.683939", "evidence_frames": [ 15, 16, 6150, 6199, 6369 ] }, { "endpoint_id": "endpoint-a76d41f7c3577a36b4d305ec", "ip": "224.0.0.252", "ip_version": 4, "is_private": false, "mac_addresses": [ "01:00:5e:00:00:fc" ], "packets_sent": 0, "packets_received": 1, "bytes_sent": 0, "bytes_received": 75, "first_seen_epoch": "1723680583.886077", "last_seen_epoch": "1723680583.886077", "evidence_frames": [ 17 ] }, { "endpoint_id": "endpoint-4a0f8256afd76c5cdb1da759", "ip": "23.194.68.140", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 13, "packets_received": 9, "bytes_sent": 7183, "bytes_received": 1167, "first_seen_epoch": "1723681289.635564", "last_seen_epoch": "1723681289.830999", "evidence_frames": [ 15178, 15179, 15180, 15181, 15182 ] }, { "endpoint_id": "endpoint-436f614627cc9f94da47e691", "ip": "23.195.200.230", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 14, "packets_received": 13, "bytes_sent": 7549, "bytes_received": 1309, "first_seen_epoch": "1723680802.829361", "last_seen_epoch": "1723680824.294857", "evidence_frames": [ 11903, 11906, 11907, 11908, 11909 ] }, { "endpoint_id": "endpoint-6fdaf37c073b7da94d6ec484", "ip": "23.205.110.12", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 108, "packets_received": 73, "bytes_sent": 67733, "bytes_received": 11841, "first_seen_epoch": "1723680647.76304", "last_seen_epoch": "1723680915.525227", "evidence_frames": [ 3863, 3882, 3887, 3900, 3901 ] }, { "endpoint_id": "endpoint-cb7f53e886d6fbaffc60d789", "ip": "23.205.110.48", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 4, "packets_received": 5, "bytes_sent": 407, "bytes_received": 393, "first_seen_epoch": "1723680585.094815", "last_seen_epoch": "1723680585.177945", "evidence_frames": [ 63, 64, 65, 66, 67 ] }, { "endpoint_id": "endpoint-ac6f9a4160ee188620a8beb5", "ip": "23.215.55.139", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 53, "packets_received": 52, "bytes_sent": 8042, "bytes_received": 6436, "first_seen_epoch": "1723680681.045759", "last_seen_epoch": "1723682532.036668", "evidence_frames": [ 8918, 8919, 8920, 8921, 8922 ] }, { "endpoint_id": "endpoint-0ce48354a7a9bcabd46627a0", "ip": "23.220.103.18", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 1075, "packets_received": 469, "bytes_sent": 1199762, "bytes_received": 119539, "first_seen_epoch": "1723680609.386304", "last_seen_epoch": "1723680934.623789", "evidence_frames": [ 1161, 1162, 1163, 1164, 1165 ] }, { "endpoint_id": "endpoint-a25a3dd59111d9413510c790", "ip": "23.220.103.72", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 496, "packets_received": 141, "bytes_sent": 568736, "bytes_received": 26024, "first_seen_epoch": "1723680802.830484", "last_seen_epoch": "1723680915.525142", "evidence_frames": [ 11905, 11910, 11911, 11912, 11913 ] }, { "endpoint_id": "endpoint-a2617889727233192a38c6fa", "ip": "23.220.103.8", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 1142, "packets_received": 389, "bytes_sent": 1132280, "bytes_received": 50977, "first_seen_epoch": "1723680614.031861", "last_seen_epoch": "1723680793.218867", "evidence_frames": [ 1593, 1594, 1595, 1596, 1597 ] }, { "endpoint_id": "endpoint-57e548c9bf00bc3706c37c99", "ip": "23.220.251.208", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 3, "packets_received": 5, "bytes_sent": 462, "bytes_received": 530, "first_seen_epoch": "1723681329.828919", "last_seen_epoch": "1723681330.151278", "evidence_frames": [ 15342, 15343, 15344, 15345, 15346 ] }, { "endpoint_id": "endpoint-fbc9c3e97aa584180cd7fd7a", "ip": "23.221.36.164", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 9, "packets_received": 9, "bytes_sent": 4883, "bytes_received": 1224, "first_seen_epoch": "1723681330.037825", "last_seen_epoch": "1723681330.395465", "evidence_frames": [ 15351, 15352, 15353, 15354, 15355 ] }, { "endpoint_id": "endpoint-ef8d17791bd11168993b4208", "ip": "23.223.31.34", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 129, "packets_received": 69, "bytes_sent": 120981, "bytes_received": 13290, "first_seen_epoch": "1723680912.210962", "last_seen_epoch": "1723680915.541867", "evidence_frames": [ 12578, 12579, 12580, 12581, 12582 ] }, { "endpoint_id": "endpoint-ce7ac0cf62eb844cf1b9b699", "ip": "23.33.138.184", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 119, "packets_received": 114, "bytes_sent": 27126, "bytes_received": 38653, "first_seen_epoch": "1723680585.375608", "last_seen_epoch": "1723680911.484591", "evidence_frames": [ 74, 75, 76, 77, 78 ] }, { "endpoint_id": "endpoint-9f9090992619ce222594a6f1", "ip": "23.43.244.167", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 115, "packets_received": 45, "bytes_sent": 147610, "bytes_received": 5035, "first_seen_epoch": "1723680650.494501", "last_seen_epoch": "1723680653.83592", "evidence_frames": [ 5451, 5506, 5507, 5508, 5509 ] }, { "endpoint_id": "endpoint-215a8d8ebdb2de32e591d938", "ip": "23.53.13.196", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 27, "packets_received": 22, "bytes_sent": 17953, "bytes_received": 2889, "first_seen_epoch": "1723680682.290124", "last_seen_epoch": "1723681188.221648", "evidence_frames": [ 9003, 9004, 9005, 9006, 9007 ] }, { "endpoint_id": "endpoint-7a9763ea2a04ef4f3e6e2838", "ip": "23.53.13.197", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 12, "packets_received": 10, "bytes_sent": 7752, "bytes_received": 1109, "first_seen_epoch": "1723681381.439492", "last_seen_epoch": "1723681441.729978", "evidence_frames": [ 15471, 15472, 15473, 15474, 15475 ] }, { "endpoint_id": "endpoint-bfa4fa426b2fbd3d0f08c359", "ip": "23.53.13.203", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 219, "packets_received": 106, "bytes_sent": 242418, "bytes_received": 17533, "first_seen_epoch": "1723680611.000465", "last_seen_epoch": "1723680723.62016", "evidence_frames": [ 1305, 1306, 1307, 1308, 1309 ] }, { "endpoint_id": "endpoint-3cf5b046fac173271f35be75", "ip": "23.53.13.205", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 16, "packets_received": 16, "bytes_sent": 8136, "bytes_received": 1741, "first_seen_epoch": "1723680797.802049", "last_seen_epoch": "1723680918.235287", "evidence_frames": [ 11733, 11734, 11735, 11736, 11737 ] }, { "endpoint_id": "endpoint-398443168c9d4a35be55d3d5", "ip": "23.56.233.15", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 76, "packets_received": 30, "bytes_sent": 94524, "bytes_received": 2577, "first_seen_epoch": "1723681154.918858", "last_seen_epoch": "1723681264.521612", "evidence_frames": [ 14528, 14529, 14530, 14531, 14532 ] }, { "endpoint_id": "endpoint-dd68a348a6d6ec04ac1740ed", "ip": "23.60.57.94", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 15, "packets_received": 12, "bytes_sent": 7201, "bytes_received": 3175, "first_seen_epoch": "1723680913.278733", "last_seen_epoch": "1723680915.503366", "evidence_frames": [ 12822, 12879, 12881, 12884, 12885 ] }, { "endpoint_id": "endpoint-b8af126273af8d0bd09a1d58", "ip": "23.63.205.134", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 16, "packets_received": 15, "bytes_sent": 10844, "bytes_received": 1558, "first_seen_epoch": "1723680622.993053", "last_seen_epoch": "1723680732.294822", "evidence_frames": [ 3070, 3071, 3072, 3073, 3074 ] }, { "endpoint_id": "endpoint-0dbfc33a70a4374cb6e6e2c3", "ip": "23.96.180.189", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 15, "packets_received": 14, "bytes_sent": 7689, "bytes_received": 2876, "first_seen_epoch": "1723680800.900999", "last_seen_epoch": "1723680824.296041", "evidence_frames": [ 11867, 11870, 11871, 11872, 11873 ] }, { "endpoint_id": "endpoint-a1bd4e5ca7112d2f1276ed8c", "ip": "239.255.255.250", "ip_version": 4, "is_private": false, "mac_addresses": [ "01:00:5e:7f:ff:fa" ], "packets_sent": 0, "packets_received": 82, "bytes_sent": 0, "bytes_received": 17262, "first_seen_epoch": "1723680618.769208", "last_seen_epoch": "1723682541.976598", "evidence_frames": [ 2104, 2328, 2700, 2972, 8977 ] }, { "endpoint_id": "endpoint-fd0e1978b418d35fc2ea2124", "ip": "255.255.255.255", "ip_version": 4, "is_private": true, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "packets_sent": 0, "packets_received": 6, "bytes_sent": 0, "bytes_received": 2167, "first_seen_epoch": "1723680583.804291", "last_seen_epoch": "1723680583.828521", "evidence_frames": [ 1, 2, 3, 4, 5 ] }, { "endpoint_id": "endpoint-703eadc2c5ccdfb1eb38c1c8", "ip": "40.126.29.10", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 11, "packets_received": 11, "bytes_sent": 6120, "bytes_received": 1947, "first_seen_epoch": "1723680987.962869", "last_seen_epoch": "1723680989.134692", "evidence_frames": [ 13827, 13829, 13830, 13831, 13832 ] }, { "endpoint_id": "endpoint-8a98b0128cc72e1ed44848b4", "ip": "40.126.29.13", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 12, "packets_received": 12, "bytes_sent": 6175, "bytes_received": 2001, "first_seen_epoch": "1723680619.208704", "last_seen_epoch": "1723680619.59908", "evidence_frames": [ 2246, 2250, 2251, 2256, 2257 ] }, { "endpoint_id": "endpoint-82bdc9253f19b3bcf0475e53", "ip": "40.126.29.5", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 35, "packets_received": 35, "bytes_sent": 18471, "bytes_received": 5949, "first_seen_epoch": "1723680708.002964", "last_seen_epoch": "1723680794.186598", "evidence_frames": [ 10381, 10382, 10383, 10384, 10385 ] }, { "endpoint_id": "endpoint-898ab90c183089289f3d62de", "ip": "51.116.253.170", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 16, "packets_received": 14, "bytes_sent": 5546, "bytes_received": 2781, "first_seen_epoch": "1723680609.68842", "last_seen_epoch": "1723680610.843565", "evidence_frames": [ 1195, 1210, 1212, 1217, 1218 ] }, { "endpoint_id": "endpoint-4d3d4ec3c54c40911821e3e9", "ip": "52.109.0.136", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 16, "packets_received": 11, "bytes_sent": 7356, "bytes_received": 1762, "first_seen_epoch": "1723680909.294716", "last_seen_epoch": "1723680909.743689", "evidence_frames": [ 12262, 12263, 12264, 12265, 12266 ] }, { "endpoint_id": "endpoint-9bff0fa4bed93b96b91c8e02", "ip": "52.109.0.142", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 33, "packets_received": 30, "bytes_sent": 19069, "bytes_received": 4388, "first_seen_epoch": "1723680613.869306", "last_seen_epoch": "1723680737.300856", "evidence_frames": [ 1541, 1564, 1565, 1585, 1586 ] }, { "endpoint_id": "endpoint-8956212efeaf7b2ceec03b26", "ip": "52.109.20.38", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 58, "packets_received": 34, "bytes_sent": 47073, "bytes_received": 3577, "first_seen_epoch": "1723680587.182623", "last_seen_epoch": "1723680745.494228", "evidence_frames": [ 640, 663, 664, 671, 672 ] }, { "endpoint_id": "endpoint-6095dd1cdd787224e56a6eda", "ip": "52.113.194.132", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 134, "packets_received": 87, "bytes_sent": 110286, "bytes_received": 15160, "first_seen_epoch": "1723680622.361245", "last_seen_epoch": "1723682511.740445", "evidence_frames": [ 3002, 3005, 3006, 3007, 3008 ] }, { "endpoint_id": "endpoint-f614497739551bf57993bcd9", "ip": "52.123.128.254", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 19, "packets_received": 16, "bytes_sent": 8727, "bytes_received": 2101, "first_seen_epoch": "1723680797.540735", "last_seen_epoch": "1723680922.543015", "evidence_frames": [ 11697, 11698, 11699, 11700, 11701 ] }, { "endpoint_id": "endpoint-31fb4fa932ec692f5c7cbe70", "ip": "52.137.106.217", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 29, "packets_received": 23, "bytes_sent": 10159, "bytes_received": 3232, "first_seen_epoch": "1723680708.901467", "last_seen_epoch": "1723680990.750976", "evidence_frames": [ 10410, 10427, 10428, 10429, 10430 ] }, { "endpoint_id": "endpoint-850019aa567d3d1992610fc6", "ip": "52.152.180.153", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 70, "packets_received": 51, "bytes_sent": 36000, "bytes_received": 44446, "first_seen_epoch": "1723681192.121207", "last_seen_epoch": "1723681205.433107", "evidence_frames": [ 14768, 14769, 14770, 14771, 14772 ] }, { "endpoint_id": "endpoint-cf84fbab2022146c91d7cff3", "ip": "52.168.117.170", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 21, "packets_received": 17, "bytes_sent": 5925, "bytes_received": 7835, "first_seen_epoch": "1723681672.619588", "last_seen_epoch": "1723681673.316978", "evidence_frames": [ 16281, 16282, 16283, 16284, 16285 ] }, { "endpoint_id": "endpoint-c19b7985e69ed61afeb26d6d", "ip": "52.182.143.215", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 53, "packets_received": 44, "bytes_sent": 12646, "bytes_received": 23241, "first_seen_epoch": "1723680753.043817", "last_seen_epoch": "1723680754.609827", "evidence_frames": [ 10906, 10907, 10908, 10909, 10910 ] }, { "endpoint_id": "endpoint-edb4a0225d2616c33f606229", "ip": "72.5.43.29", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:16:9c:02:a7:4b" ], "packets_sent": 1653, "packets_received": 1844, "bytes_sent": 318105, "bytes_received": 547486, "first_seen_epoch": "1723680718.562192", "last_seen_epoch": "1723682546.009239", "evidence_frames": [ 10598, 10608, 10609, 10610, 10611 ] } ], "identities": [ { "identity_id": "identity-a1d9e1472ff63f841125e94b", "type": "account", "value": "desktop-h8alzbv$", "ip_addresses": [ "10.8.15.133" ], "mac_addresses": [ "00:1c:bf:03:54:82" ], "evidence": [ { "frame_number": 151, "timestamp_epoch": "1723680586.099681000", "display_filter": "frame.number == 151", "tcp_stream": 5 }, { "frame_number": 166, "timestamp_epoch": "1723680586.110090000", "display_filter": "frame.number == 166", "tcp_stream": 8 }, { "frame_number": 169, "timestamp_epoch": "1723680586.110373000", "display_filter": "frame.number == 169", "tcp_stream": 9 }, { "frame_number": 173, "timestamp_epoch": "1723680586.111602000", "display_filter": "frame.number == 173", "tcp_stream": 9 }, { "frame_number": 187, "timestamp_epoch": "1723680586.120910000", "display_filter": "frame.number == 187", "tcp_stream": 10 }, { "frame_number": 195, "timestamp_epoch": "1723680586.122161000", "display_filter": "frame.number == 195", "tcp_stream": 10 }, { "frame_number": 200, "timestamp_epoch": "1723680586.122720000", "display_filter": "frame.number == 200", "tcp_stream": 13 }, { "frame_number": 224, "timestamp_epoch": "1723680586.133379000", "display_filter": "frame.number == 224", "tcp_stream": 16 }, { "frame_number": 226, "timestamp_epoch": "1723680586.134061000", "display_filter": "frame.number == 226", "tcp_stream": 15 }, { "frame_number": 228, "timestamp_epoch": "1723680586.134077000", "display_filter": "frame.number == 228", "tcp_stream": 14 }, { "frame_number": 231, "timestamp_epoch": "1723680586.134839000", "display_filter": "frame.number == 231", "tcp_stream": 16 }, { "frame_number": 261, "timestamp_epoch": "1723680586.153796000", "display_filter": "frame.number == 261", "tcp_stream": 17 }, { "frame_number": 264, "timestamp_epoch": "1723680586.154217000", "display_filter": "frame.number == 264", "tcp_stream": 18 }, { "frame_number": 390, "timestamp_epoch": "1723680586.347727000", "display_filter": "frame.number == 390", "tcp_stream": 23 }, { "frame_number": 493, "timestamp_epoch": "1723680586.914545000", "display_filter": "frame.number == 493", "tcp_stream": 28 }, { "frame_number": 521, "timestamp_epoch": "1723680586.976933000", "display_filter": "frame.number == 521", "tcp_stream": 30 }, { "frame_number": 533, "timestamp_epoch": "1723680586.979822000", "display_filter": "frame.number == 533", "tcp_stream": 31 }, { "frame_number": 922, "timestamp_epoch": "1723680594.933396000", "display_filter": "frame.number == 922", "tcp_stream": 41 }, { "frame_number": 930, "timestamp_epoch": "1723680594.934916000", "display_filter": "frame.number == 930", "tcp_stream": 42 }, { "frame_number": 932, "timestamp_epoch": "1723680594.935625000", "display_filter": "frame.number == 932", "tcp_stream": 42 } ], "bindings": [ { "frame_number": 151, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.133", "conversation_dst": "10.8.15.4", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 166, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.133", "conversation_dst": "10.8.15.4", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 169, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.133", "conversation_dst": "10.8.15.4", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 173, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.4", "conversation_dst": "10.8.15.133", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 187, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.133", "conversation_dst": "10.8.15.4", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 195, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.4", "conversation_dst": "10.8.15.133", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 200, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.133", "conversation_dst": "10.8.15.4", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 224, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.133", "conversation_dst": "10.8.15.4", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 226, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.4", "conversation_dst": "10.8.15.133", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 228, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.4", "conversation_dst": "10.8.15.133", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 231, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.4", "conversation_dst": "10.8.15.133", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 261, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.4", "conversation_dst": "10.8.15.133", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 264, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.4", "conversation_dst": "10.8.15.133", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 390, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.4", "conversation_dst": "10.8.15.133", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 493, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.4", "conversation_dst": "10.8.15.133", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 521, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.4", "conversation_dst": "10.8.15.133", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 533, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.4", "conversation_dst": "10.8.15.133", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 922, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.133", "conversation_dst": "10.8.15.4", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 930, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.133", "conversation_dst": "10.8.15.4", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 932, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.4", "conversation_dst": "10.8.15.133", "account": "", "source_field": "kerberos.CNameString" } ], "raw_values": [ "DESKTOP-H8ALZBV$", "desktop-h8alzbv$" ] }, { "identity_id": "identity-49f63ac83d3ec8fa3cb4336e", "type": "account", "value": "plucero", "ip_addresses": [ "10.8.15.133" ], "mac_addresses": [ "00:1c:bf:03:54:82" ], "evidence": [ { "frame_number": 975, "timestamp_epoch": "1723680608.106952000", "display_filter": "frame.number == 975", "tcp_stream": 44 }, { "frame_number": 983, "timestamp_epoch": "1723680608.115612000", "display_filter": "frame.number == 983", "tcp_stream": 45 }, { "frame_number": 985, "timestamp_epoch": "1723680608.116435000", "display_filter": "frame.number == 985", "tcp_stream": 45 }, { "frame_number": 997, "timestamp_epoch": "1723680608.118716000", "display_filter": "frame.number == 997", "tcp_stream": 46 }, { "frame_number": 1011, "timestamp_epoch": "1723680608.253051000", "display_filter": "frame.number == 1011", "tcp_stream": 47 }, { "frame_number": 1059, "timestamp_epoch": "1723680608.280003000", "display_filter": "frame.number == 1059", "tcp_stream": 50 }, { "frame_number": 1071, "timestamp_epoch": "1723680608.281162000", "display_filter": "frame.number == 1071", "tcp_stream": 51 }, { "frame_number": 1111, "timestamp_epoch": "1723680608.296635000", "display_filter": "frame.number == 1111", "tcp_stream": 1 }, { "frame_number": 1142, "timestamp_epoch": "1723680608.418138000", "display_filter": "frame.number == 1142", "tcp_stream": 53 }, { "frame_number": 11648, "timestamp_epoch": "1723680795.695877000", "display_filter": "frame.number == 11648", "tcp_stream": 153 } ], "bindings": [ { "frame_number": 975, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.133", "conversation_dst": "10.8.15.4", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 983, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.133", "conversation_dst": "10.8.15.4", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 985, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.4", "conversation_dst": "10.8.15.133", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 997, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.4", "conversation_dst": "10.8.15.133", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 1011, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.4", "conversation_dst": "10.8.15.133", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 1059, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.4", "conversation_dst": "10.8.15.133", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 1071, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.4", "conversation_dst": "10.8.15.133", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 1111, "relationship": "directory-subject-returned-to-client", "owner_ip": null, "conversation_src": "10.8.15.4", "conversation_dst": "10.8.15.133", "account": "plucero", "source_field": "samr.samr_UserInfo21.account_name" }, { "frame_number": 1142, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.4", "conversation_dst": "10.8.15.133", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 11648, "relationship": "kerberos-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.4", "conversation_dst": "10.8.15.133", "account": "", "source_field": "kerberos.CNameString" } ], "raw_values": [ "plucero" ] }, { "identity_id": "identity-b8cfb454bcd56e2760ca82cb", "type": "full-name", "value": "Pierce Lucero", "ip_addresses": [ "10.8.15.133" ], "mac_addresses": [], "evidence": [ { "frame_number": 1111, "timestamp_epoch": "1723680608.296635000", "display_filter": "frame.number == 1111", "tcp_stream": 1 } ], "bindings": [ { "frame_number": 1111, "relationship": "directory-name-correlated-with-client-principal", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.4", "conversation_dst": "10.8.15.133", "account": "plucero", "source_field": "samr.samr_UserInfo21.full_name" } ], "raw_values": [ "Pierce Lucero" ] }, { "identity_id": "identity-a54cc6d236e20e959a716415", "type": "hostname", "value": "DESKTOP-H8ALZBV", "ip_addresses": [ "10.8.15.133" ], "mac_addresses": [ "00:1c:bf:03:54:82", "00:1c:bf:03:54:82,00:1c:bf:03:54:82" ], "evidence": [ { "frame_number": 1, "timestamp_epoch": "1723680583.804291000", "display_filter": "frame.number == 1", "udp_stream": 0 }, { "frame_number": 3, "timestamp_epoch": "1723680583.815024000", "display_filter": "frame.number == 3", "udp_stream": 0 }, { "frame_number": 5, "timestamp_epoch": "1723680583.827903000", "display_filter": "frame.number == 5", "udp_stream": 0 }, { "frame_number": 30, "timestamp_epoch": "1723680584.241556000", "display_filter": "frame.number == 30", "udp_stream": 6 }, { "frame_number": 58, "timestamp_epoch": "1723680584.988227000", "display_filter": "frame.number == 58", "udp_stream": 6 }, { "frame_number": 104, "timestamp_epoch": "1723680585.739856000", "display_filter": "frame.number == 104", "udp_stream": 6 }, { "frame_number": 446, "timestamp_epoch": "1723680586.500412000", "display_filter": "frame.number == 446", "udp_stream": 6 }, { "frame_number": 471, "timestamp_epoch": "1723680586.644505000", "display_filter": "frame.number == 471", "udp_stream": 6 }, { "frame_number": 693, "timestamp_epoch": "1723680587.408847000", "display_filter": "frame.number == 693", "udp_stream": 6 }, { "frame_number": 730, "timestamp_epoch": "1723680588.173575000", "display_filter": "frame.number == 730", "udp_stream": 6 }, { "frame_number": 759, "timestamp_epoch": "1723680588.933467000", "display_filter": "frame.number == 759", "udp_stream": 6 }, { "frame_number": 841, "timestamp_epoch": "1723680589.743833000", "display_filter": "frame.number == 841", "udp_stream": 18 }, { "frame_number": 12013, "timestamp_epoch": "1723680827.249355000", "display_filter": "frame.number == 12013", "udp_stream": 18 }, { "frame_number": 15256, "timestamp_epoch": "1723681305.542611000", "display_filter": "frame.number == 15256", "udp_stream": 18 }, { "frame_number": 17047, "timestamp_epoch": "1723682026.693492000", "display_filter": "frame.number == 17047", "udp_stream": 18 } ], "bindings": [ { "frame_number": 1, "relationship": "dhcp-client-assertion", "owner_ip": "0.0.0.0", "conversation_src": "0.0.0.0", "conversation_dst": "255.255.255.255", "account": "", "source_field": "dhcp.option.hostname" }, { "frame_number": 3, "relationship": "dhcp-client-assertion", "owner_ip": "0.0.0.0", "conversation_src": "0.0.0.0", "conversation_dst": "255.255.255.255", "account": "", "source_field": "dhcp.option.hostname" }, { "frame_number": 5, "relationship": "dhcp-client-assertion", "owner_ip": "0.0.0.0", "conversation_src": "0.0.0.0", "conversation_dst": "255.255.255.255", "account": "", "source_field": "dhcp.option.hostname" }, { "frame_number": 30, "relationship": "netbios-registration", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.133", "conversation_dst": "10.8.15.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 58, "relationship": "netbios-registration", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.133", "conversation_dst": "10.8.15.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 104, "relationship": "netbios-registration", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.133", "conversation_dst": "10.8.15.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 446, "relationship": "netbios-registration", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.133", "conversation_dst": "10.8.15.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 471, "relationship": "netbios-registration", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.133", "conversation_dst": "10.8.15.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 693, "relationship": "netbios-registration", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.133", "conversation_dst": "10.8.15.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 730, "relationship": "netbios-registration", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.133", "conversation_dst": "10.8.15.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 759, "relationship": "netbios-registration", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.133", "conversation_dst": "10.8.15.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 841, "relationship": "client-asserted", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.133", "conversation_dst": "10.8.15.255", "account": "", "source_field": "browser.server" }, { "frame_number": 12013, "relationship": "client-asserted", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.133", "conversation_dst": "10.8.15.255", "account": "", "source_field": "browser.server" }, { "frame_number": 15256, "relationship": "client-asserted", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.133", "conversation_dst": "10.8.15.255", "account": "", "source_field": "browser.server" }, { "frame_number": 17047, "relationship": "client-asserted", "owner_ip": "10.8.15.133", "conversation_src": "10.8.15.133", "conversation_dst": "10.8.15.255", "account": "", "source_field": "browser.server" } ], "raw_values": [ "DESKTOP-H8ALZBV", "DESKTOP-H8ALZBV<00>,DESKTOP-H8ALZBV<00> (Workstation/Redirector)", "DESKTOP-H8ALZBV<20>,DESKTOP-H8ALZBV<20> (Server service)" ] }, { "identity_id": "identity-84f2ba2861245fda99f1c11f", "type": "netbios-group", "value": "LAFONTAINEBLEU", "ip_addresses": [], "mac_addresses": [], "evidence": [ { "frame_number": 31, "timestamp_epoch": "1723680584.242030000", "display_filter": "frame.number == 31", "udp_stream": 6 }, { "frame_number": 57, "timestamp_epoch": "1723680584.988087000", "display_filter": "frame.number == 57", "udp_stream": 6 }, { "frame_number": 103, "timestamp_epoch": "1723680585.739794000", "display_filter": "frame.number == 103", "udp_stream": 6 }, { "frame_number": 447, "timestamp_epoch": "1723680586.500505000", "display_filter": "frame.number == 447", "udp_stream": 6 } ], "bindings": [ { "frame_number": 31, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.8.15.133", "conversation_dst": "10.8.15.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 57, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.8.15.133", "conversation_dst": "10.8.15.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 103, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.8.15.133", "conversation_dst": "10.8.15.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 447, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "10.8.15.133", "conversation_dst": "10.8.15.255", "account": "", "source_field": "nbns.name" } ], "raw_values": [ "LAFONTAINEBLEU<00>,LAFONTAINEBLEU<00> (Workstation/Redirector)" ] } ], "flows": [ { "flow_id": "flow-2335ef1c9f2993abc46ed328", "transport": "udp", "stream": 0, "initiator_ip": "0.0.0.0", "initiator_port": 68, "responder_ip": "255.255.255.255", "responder_port": 67, "first_frame": 1, "last_frame": 5, "first_seen_epoch": "1723680583.804291", "last_seen_epoch": "1723680583.827903", "packets": 3, "bytes": 1114, "initiator_bytes": 1114, "responder_bytes": 0 }, { "flow_id": "flow-f16298967fe6f3a2d8a1c84d", "transport": "udp", "stream": 1, "initiator_ip": "10.8.15.4", "initiator_port": 67, "responder_ip": "255.255.255.255", "responder_port": 68, "first_frame": 2, "last_frame": 6, "first_seen_epoch": "1723680583.805046", "last_seen_epoch": "1723680583.828521", "packets": 3, "bytes": 1053, "initiator_bytes": 1053, "responder_bytes": 0 }, { "flow_id": "flow-4ae4a9dc1c4feb04ed2c2976", "transport": "udp", "stream": 2, "initiator_ip": "10.8.15.133", "initiator_port": 5353, "responder_ip": "224.0.0.251", "responder_port": 5353, "first_frame": 15, "last_frame": 6369, "first_seen_epoch": "1723680583.88383", "last_seen_epoch": "1723680656.683939", "packets": 5, "bytes": 418, "initiator_bytes": 418, "responder_bytes": 0 }, { "flow_id": "flow-fc7dbdf168fb8fe4c3fd2dcc", "transport": "udp", "stream": 3, "initiator_ip": "10.8.15.133", "initiator_port": 60139, "responder_ip": "224.0.0.252", "responder_port": 5355, "first_frame": 17, "last_frame": 17, "first_seen_epoch": "1723680583.886077", "last_seen_epoch": "1723680583.886077", "packets": 1, "bytes": 75, "initiator_bytes": 75, "responder_bytes": 0 }, { "flow_id": "flow-9dd9c4b8fd027f88251bd6b7", "transport": "udp", "stream": 4, "initiator_ip": "10.8.15.133", "initiator_port": 59553, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 20, "last_frame": 33, "first_seen_epoch": "1723680584.16312", "last_seen_epoch": "1723680584.314689", "packets": 6, "bytes": 740, "initiator_bytes": 292, "responder_bytes": 448 }, { "flow_id": "flow-3771e351bcac7628c29137f4", "transport": "udp", "stream": 5, "initiator_ip": "10.8.15.133", "initiator_port": 59555, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 24, "last_frame": 27, "first_seen_epoch": "1723680584.194746", "last_seen_epoch": "1723680584.195198", "packets": 2, "bytes": 520, "initiator_bytes": 272, "responder_bytes": 248 }, { "flow_id": "flow-50f8335770907f3bc1c9aef2", "transport": "udp", "stream": 6, "initiator_ip": "10.8.15.133", "initiator_port": 137, "responder_ip": "10.8.15.255", "responder_port": 137, "first_frame": 30, "last_frame": 759, "first_seen_epoch": "1723680584.241556", "last_seen_epoch": "1723680588.933467", "packets": 12, "bytes": 1320, "initiator_bytes": 1320, "responder_bytes": 0 }, { "flow_id": "flow-efcf14a54a86c21129d495cf", "transport": "tcp", "stream": 0, "initiator_ip": "10.8.15.133", "initiator_port": 49667, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 34, "last_frame": 351, "first_seen_epoch": "1723680584.315906", "last_seen_epoch": "1723680586.232633", "packets": 13, "bytes": 6313, "initiator_bytes": 2926, "responder_bytes": 3387 }, { "flow_id": "flow-8e9ffc07a8820aa598d7e366", "transport": "udp", "stream": 7, "initiator_ip": "10.8.15.133", "initiator_port": 59556, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 41, "last_frame": 42, "first_seen_epoch": "1723680584.335737", "last_seen_epoch": "1723680584.336104", "packets": 2, "bytes": 520, "initiator_bytes": 272, "responder_bytes": 248 }, { "flow_id": "flow-c429a203211d4cecf86d1ad2", "transport": "udp", "stream": 8, "initiator_ip": "10.8.15.133", "initiator_port": 59558, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 44, "last_frame": 45, "first_seen_epoch": "1723680584.36676", "last_seen_epoch": "1723680584.367126", "packets": 2, "bytes": 520, "initiator_bytes": 272, "responder_bytes": 248 }, { "flow_id": "flow-98d77554e15266afabeb9769", "transport": "tcp", "stream": 1, "initiator_ip": "10.8.15.133", "initiator_port": 49670, "responder_ip": "10.8.15.4", "responder_port": 445, "first_frame": 46, "last_frame": 14802, "first_seen_epoch": "1723680584.585086", "last_seen_epoch": "1723681199.028013", "packets": 268, "bytes": 64658, "initiator_bytes": 34896, "responder_bytes": 29762 }, { "flow_id": "flow-28b9d4607e5e957024af1eae", "transport": "udp", "stream": 9, "initiator_ip": "10.8.15.133", "initiator_port": 53383, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 55, "last_frame": 372, "first_seen_epoch": "1723680584.978235", "last_seen_epoch": "1723680586.334885", "packets": 14, "bytes": 2180, "initiator_bytes": 827, "responder_bytes": 1353 }, { "flow_id": "flow-a10f37e8365d2549195feb68", "transport": "udp", "stream": 10, "initiator_ip": "10.8.15.133", "initiator_port": 58264, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 59, "last_frame": 62, "first_seen_epoch": "1723680584.996099", "last_seen_epoch": "1723680585.064601", "packets": 4, "bytes": 557, "initiator_bytes": 166, "responder_bytes": 391 }, { "flow_id": "flow-a2965419e521089030b016da", "transport": "tcp", "stream": 2, "initiator_ip": "10.8.15.133", "initiator_port": 49671, "responder_ip": "23.205.110.48", "responder_port": 80, "first_frame": 63, "last_frame": 71, "first_seen_epoch": "1723680585.094815", "last_seen_epoch": "1723680585.177945", "packets": 9, "bytes": 800, "initiator_bytes": 393, "responder_bytes": 407 }, { "flow_id": "flow-aeb290b639ee4c6b1d24785f", "transport": "tcp", "stream": 3, "initiator_ip": "10.8.15.133", "initiator_port": 49672, "responder_ip": "23.33.138.184", "responder_port": 443, "first_frame": 74, "last_frame": 101, "first_seen_epoch": "1723680585.375608", "last_seen_epoch": "1723680585.691609", "packets": 28, "bytes": 11129, "initiator_bytes": 2865, "responder_bytes": 8264 }, { "flow_id": "flow-f5591c1b4b2365cbcae998b4", "transport": "tcp", "stream": 4, "initiator_ip": "10.8.15.133", "initiator_port": 49673, "responder_ip": "23.33.138.184", "responder_port": 443, "first_frame": 102, "last_frame": 147, "first_seen_epoch": "1723680585.709163", "last_seen_epoch": "1723680586.094672", "packets": 19, "bytes": 4880, "initiator_bytes": 3064, "responder_bytes": 1816 }, { "flow_id": "flow-a1a86980049812e635e8f536", "transport": "udp", "stream": 11, "initiator_ip": "10.8.15.133", "initiator_port": 58266, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 122, "last_frame": 137, "first_seen_epoch": "1723680585.953668", "last_seen_epoch": "1723680586.062192", "packets": 12, "bytes": 3230, "initiator_bytes": 1725, "responder_bytes": 1505 }, { "flow_id": "flow-d918fe7f5ba6e1df2f23070e", "transport": "tcp", "stream": 5, "initiator_ip": "10.8.15.133", "initiator_port": 49676, "responder_ip": "10.8.15.4", "responder_port": 88, "first_frame": 138, "last_frame": 156, "first_seen_epoch": "1723680586.090656", "last_seen_epoch": "1723680586.10073", "packets": 8, "bytes": 948, "initiator_bytes": 480, "responder_bytes": 468 }, { "flow_id": "flow-558f5a4bfe8a8f7b6d6568b3", "transport": "tcp", "stream": 6, "initiator_ip": "10.8.15.133", "initiator_port": 49677, "responder_ip": "10.8.15.4", "responder_port": 135, "first_frame": 140, "last_frame": 3644, "first_seen_epoch": "1723680586.091531", "last_seen_epoch": "1723680643.207484", "packets": 23, "bytes": 3714, "initiator_bytes": 1768, "responder_bytes": 1946 }, { "flow_id": "flow-92425a487a6f7904782c0f6b", "transport": "tcp", "stream": 7, "initiator_ip": "10.8.15.133", "initiator_port": 49678, "responder_ip": "10.8.15.4", "responder_port": 135, "first_frame": 142, "last_frame": 1356, "first_seen_epoch": "1723680586.092048", "last_seen_epoch": "1723680613.202631", "packets": 12, "bytes": 1448, "initiator_bytes": 718, "responder_bytes": 730 }, { "flow_id": "flow-745b1b1608de54beec3f4fa3", "transport": "tcp", "stream": 8, "initiator_ip": "10.8.15.133", "initiator_port": 49679, "responder_ip": "10.8.15.4", "responder_port": 88, "first_frame": 161, "last_frame": 179, "first_seen_epoch": "1723680586.105546", "last_seen_epoch": "1723680586.112453", "packets": 7, "bytes": 894, "initiator_bytes": 426, "responder_bytes": 468 }, { "flow_id": "flow-6a64d335007eb39aedcef939", "transport": "tcp", "stream": 9, "initiator_ip": "10.8.15.133", "initiator_port": 49680, "responder_ip": "10.8.15.4", "responder_port": 88, "first_frame": 164, "last_frame": 180, "first_seen_epoch": "1723680586.109578", "last_seen_epoch": "1723680586.112546", "packets": 10, "bytes": 2739, "initiator_bytes": 614, "responder_bytes": 2125 }, { "flow_id": "flow-c82e72cbb36834d6e3504cae", "transport": "tcp", "stream": 10, "initiator_ip": "10.8.15.133", "initiator_port": 49681, "responder_ip": "10.8.15.4", "responder_port": 88, "first_frame": 181, "last_frame": 202, "first_seen_epoch": "1723680586.11939", "last_seen_epoch": "1723680586.122872", "packets": 8, "bytes": 2631, "initiator_bytes": 506, "responder_bytes": 2125 }, { "flow_id": "flow-fe3b92b95c9907b47147efd8", "transport": "tcp", "stream": 11, "initiator_ip": "10.8.15.133", "initiator_port": 49682, "responder_ip": "10.8.15.4", "responder_port": 49669, "first_frame": 183, "last_frame": 3645, "first_seen_epoch": "1723680586.119808", "last_seen_epoch": "1723680643.207551", "packets": 76, "bytes": 27058, "initiator_bytes": 19389, "responder_bytes": 7669 }, { "flow_id": "flow-38a616db822b5fd449e33d97", "transport": "tcp", "stream": 12, "initiator_ip": "10.8.15.133", "initiator_port": 49683, "responder_ip": "10.8.15.4", "responder_port": 58963, "first_frame": 185, "last_frame": 1355, "first_seen_epoch": "1723680586.119992", "last_seen_epoch": "1723680613.202562", "packets": 22, "bytes": 5124, "initiator_bytes": 3020, "responder_bytes": 2104 }, { "flow_id": "flow-5cfde6a983d39a06b321f1db", "transport": "tcp", "stream": 13, "initiator_ip": "10.8.15.133", "initiator_port": 49684, "responder_ip": "10.8.15.4", "responder_port": 88, "first_frame": 192, "last_frame": 209, "first_seen_epoch": "1723680586.121729", "last_seen_epoch": "1723680586.124451", "packets": 8, "bytes": 948, "initiator_bytes": 480, "responder_bytes": 468 }, { "flow_id": "flow-4f69efdb6d39550137dacfa8", "transport": "tcp", "stream": 14, "initiator_ip": "10.8.15.133", "initiator_port": 49685, "responder_ip": "10.8.15.4", "responder_port": 88, "first_frame": 204, "last_frame": 239, "first_seen_epoch": "1723680586.123496", "last_seen_epoch": "1723680586.137268", "packets": 12, "bytes": 4449, "initiator_bytes": 2236, "responder_bytes": 2213 }, { "flow_id": "flow-ad49fefa1d12877cfd618dae", "transport": "tcp", "stream": 15, "initiator_ip": "10.8.15.133", "initiator_port": 49686, "responder_ip": "10.8.15.4", "responder_port": 88, "first_frame": 210, "last_frame": 236, "first_seen_epoch": "1723680586.124697", "last_seen_epoch": "1723680586.137104", "packets": 10, "bytes": 4297, "initiator_bytes": 2108, "responder_bytes": 2189 }, { "flow_id": "flow-685399cf70729b335fc37c6c", "transport": "tcp", "stream": 16, "initiator_ip": "10.8.15.133", "initiator_port": 49687, "responder_ip": "10.8.15.4", "responder_port": 88, "first_frame": 213, "last_frame": 244, "first_seen_epoch": "1723680586.132718", "last_seen_epoch": "1723680586.139207", "packets": 10, "bytes": 2739, "initiator_bytes": 614, "responder_bytes": 2125 }, { "flow_id": "flow-4b5f068efa8d3c76fca06eee", "transport": "tcp", "stream": 17, "initiator_ip": "10.8.15.133", "initiator_port": 49688, "responder_ip": "10.8.15.4", "responder_port": 88, "first_frame": 240, "last_frame": 268, "first_seen_epoch": "1723680586.13884", "last_seen_epoch": "1723680586.154763", "packets": 12, "bytes": 4047, "initiator_bytes": 2009, "responder_bytes": 2038 }, { "flow_id": "flow-15258d4122c4f0d2aafcb950", "transport": "tcp", "stream": 18, "initiator_ip": "10.8.15.133", "initiator_port": 49689, "responder_ip": "10.8.15.4", "responder_port": 88, "first_frame": 247, "last_frame": 272, "first_seen_epoch": "1723680586.146245", "last_seen_epoch": "1723680586.155737", "packets": 12, "bytes": 4449, "initiator_bytes": 2236, "responder_bytes": 2213 }, { "flow_id": "flow-c14d16955a67c7892a900c0d", "transport": "tcp", "stream": 19, "initiator_ip": "10.8.15.133", "initiator_port": 49690, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 283, "last_frame": 470, "first_seen_epoch": "1723680586.163089", "last_seen_epoch": "1723680586.572504", "packets": 34, "bytes": 11034, "initiator_bytes": 5003, "responder_bytes": 6031 }, { "flow_id": "flow-7996ca3e9e1ecea981ec1d3e", "transport": "udp", "stream": 12, "initiator_ip": "10.8.15.133", "initiator_port": 58267, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 332, "last_frame": 334, "first_seen_epoch": "1723680586.223038", "last_seen_epoch": "1723680586.223398", "packets": 2, "bytes": 499, "initiator_bytes": 251, "responder_bytes": 248 }, { "flow_id": "flow-2b32a94821ca38a398403970", "transport": "tcp", "stream": 20, "initiator_ip": "10.8.15.133", "initiator_port": 49691, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 361, "last_frame": 369, "first_seen_epoch": "1723680586.326371", "last_seen_epoch": "1723680586.334093", "packets": 6, "bytes": 348, "initiator_bytes": 174, "responder_bytes": 174 }, { "flow_id": "flow-e7781a29db2b5bc1ea4eae79", "transport": "tcp", "stream": 21, "initiator_ip": "10.8.15.133", "initiator_port": 49692, "responder_ip": "10.8.15.4", "responder_port": 135, "first_frame": 363, "last_frame": 3653, "first_seen_epoch": "1723680586.333003", "last_seen_epoch": "1723680644.379653", "packets": 12, "bytes": 1376, "initiator_bytes": 718, "responder_bytes": 658 }, { "flow_id": "flow-b7d4bcc029e3320690d35d52", "transport": "udp", "stream": 13, "initiator_ip": "10.8.15.133", "initiator_port": 58268, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 376, "last_frame": 377, "first_seen_epoch": "1723680586.338521", "last_seen_epoch": "1723680586.338725", "packets": 2, "bytes": 499, "initiator_bytes": 251, "responder_bytes": 248 }, { "flow_id": "flow-c175d02a28b4fdfd9203d386", "transport": "tcp", "stream": 22, "initiator_ip": "10.8.15.133", "initiator_port": 49693, "responder_ip": "10.8.15.4", "responder_port": 49669, "first_frame": 380, "last_frame": 3649, "first_seen_epoch": "1723680586.340123", "last_seen_epoch": "1723680644.378755", "packets": 23, "bytes": 6081, "initiator_bytes": 4354, "responder_bytes": 1727 }, { "flow_id": "flow-77bdbc086c55d268e954e250", "transport": "tcp", "stream": 23, "initiator_ip": "10.8.15.133", "initiator_port": 49694, "responder_ip": "10.8.15.4", "responder_port": 88, "first_frame": 383, "last_frame": 394, "first_seen_epoch": "1723680586.342236", "last_seen_epoch": "1723680586.349086", "packets": 12, "bytes": 4405, "initiator_bytes": 2216, "responder_bytes": 2189 }, { "flow_id": "flow-a0a6d2843be69f18d4dfbf25", "transport": "tcp", "stream": 24, "initiator_ip": "10.8.15.133", "initiator_port": 49695, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 429, "last_frame": 435, "first_seen_epoch": "1723680586.453127", "last_seen_epoch": "1723680586.460028", "packets": 6, "bytes": 348, "initiator_bytes": 174, "responder_bytes": 174 }, { "flow_id": "flow-e26a1b97b446a57b9ef058c5", "transport": "udp", "stream": 14, "initiator_ip": "10.8.15.133", "initiator_port": 64949, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 437, "last_frame": 9002, "first_seen_epoch": "1723680586.460654", "last_seen_epoch": "1723680682.288508", "packets": 39, "bytes": 5482, "initiator_bytes": 1781, "responder_bytes": 3701 }, { "flow_id": "flow-5c338490047bf5a443348054", "transport": "udp", "stream": 15, "initiator_ip": "10.8.15.133", "initiator_port": 64950, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 439, "last_frame": 440, "first_seen_epoch": "1723680586.462153", "last_seen_epoch": "1723680586.462351", "packets": 2, "bytes": 520, "initiator_bytes": 272, "responder_bytes": 248 }, { "flow_id": "flow-5c6f718793cea3caf672787f", "transport": "tcp", "stream": 25, "initiator_ip": "10.8.15.133", "initiator_port": 49696, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 449, "last_frame": 455, "first_seen_epoch": "1723680586.56348", "last_seen_epoch": "1723680586.56682", "packets": 6, "bytes": 348, "initiator_bytes": 174, "responder_bytes": 174 }, { "flow_id": "flow-bee72e0555502068b37f1cd3", "transport": "tcp", "stream": 26, "initiator_ip": "10.8.15.133", "initiator_port": 49697, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 457, "last_frame": 463, "first_seen_epoch": "1723680586.569393", "last_seen_epoch": "1723680586.570936", "packets": 6, "bytes": 348, "initiator_bytes": 174, "responder_bytes": 174 }, { "flow_id": "flow-615d8299de4ee63cf287a6eb", "transport": "tcp", "stream": 27, "initiator_ip": "10.8.15.133", "initiator_port": 49699, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 474, "last_frame": 676, "first_seen_epoch": "1723680586.856912", "last_seen_epoch": "1723680587.260966", "packets": 21, "bytes": 10521, "initiator_bytes": 3912, "responder_bytes": 6609 }, { "flow_id": "flow-8ae7e406e9b093471fc3d991", "transport": "tcp", "stream": 28, "initiator_ip": "10.8.15.133", "initiator_port": 49700, "responder_ip": "10.8.15.4", "responder_port": 88, "first_frame": 486, "last_frame": 497, "first_seen_epoch": "1723680586.911435", "last_seen_epoch": "1723680586.915237", "packets": 12, "bytes": 4333, "initiator_bytes": 2192, "responder_bytes": 2141 }, { "flow_id": "flow-40b2e1e4a1cf361b24fb4251", "transport": "tcp", "stream": 29, "initiator_ip": "10.8.15.133", "initiator_port": 49701, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 500, "last_frame": 670, "first_seen_epoch": "1723680586.921081", "last_seen_epoch": "1723680587.233187", "packets": 15, "bytes": 4054, "initiator_bytes": 2986, "responder_bytes": 1068 }, { "flow_id": "flow-fab87eedd9cde6ca647b3a1a", "transport": "tcp", "stream": 30, "initiator_ip": "10.8.15.133", "initiator_port": 49702, "responder_ip": "10.8.15.4", "responder_port": 88, "first_frame": 514, "last_frame": 525, "first_seen_epoch": "1723680586.974543", "last_seen_epoch": "1723680586.978162", "packets": 12, "bytes": 4449, "initiator_bytes": 2236, "responder_bytes": 2213 }, { "flow_id": "flow-2138010f43f8b256af9cad9a", "transport": "tcp", "stream": 31, "initiator_ip": "10.8.15.133", "initiator_port": 49703, "responder_ip": "10.8.15.4", "responder_port": 88, "first_frame": 526, "last_frame": 537, "first_seen_epoch": "1723680586.978173", "last_seen_epoch": "1723680586.980814", "packets": 12, "bytes": 4047, "initiator_bytes": 2009, "responder_bytes": 2038 }, { "flow_id": "flow-6e54810be3db0dbe01ac0e86", "transport": "tcp", "stream": 32, "initiator_ip": "10.8.15.133", "initiator_port": 49704, "responder_ip": "52.109.20.38", "responder_port": 443, "first_frame": 640, "last_frame": 10268, "first_seen_epoch": "1723680587.182623", "last_seen_epoch": "1723680697.300566", "packets": 56, "bytes": 40318, "initiator_bytes": 1796, "responder_bytes": 38522 }, { "flow_id": "flow-1ed76b4644c00dce6f028a05", "transport": "tcp", "stream": 33, "initiator_ip": "10.8.15.133", "initiator_port": 49706, "responder_ip": "13.89.179.13", "responder_port": 443, "first_frame": 729, "last_frame": 10272, "first_seen_epoch": "1723680588.112268", "last_seen_epoch": "1723680698.112202", "packets": 28, "bytes": 10115, "initiator_bytes": 2332, "responder_bytes": 7783 }, { "flow_id": "flow-ed2fc0c7cb7732a399f3de96", "transport": "udp", "stream": 16, "initiator_ip": "10.8.15.133", "initiator_port": 64952, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 757, "last_frame": 758, "first_seen_epoch": "1723680588.922553", "last_seen_epoch": "1723680588.922816", "packets": 2, "bytes": 521, "initiator_bytes": 273, "responder_bytes": 248 }, { "flow_id": "flow-97c35976c46eb2214c15303d", "transport": "tcp", "stream": 34, "initiator_ip": "10.8.15.133", "initiator_port": 49707, "responder_ip": "10.8.15.4", "responder_port": 135, "first_frame": 760, "last_frame": 839, "first_seen_epoch": "1723680589.056163", "last_seen_epoch": "1723680589.355581", "packets": 15, "bytes": 2534, "initiator_bytes": 1018, "responder_bytes": 1516 }, { "flow_id": "flow-261b96354416aedd780e880d", "transport": "tcp", "stream": 35, "initiator_ip": "10.8.15.133", "initiator_port": 49708, "responder_ip": "10.8.15.4", "responder_port": 49669, "first_frame": 767, "last_frame": 840, "first_seen_epoch": "1723680589.059798", "last_seen_epoch": "1723680589.355629", "packets": 27, "bytes": 7459, "initiator_bytes": 4650, "responder_bytes": 2809 }, { "flow_id": "flow-011d0a4f9b7c6b9ceeecc749", "transport": "udp", "stream": 17, "initiator_ip": "10.8.15.133", "initiator_port": 64954, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 790, "last_frame": 791, "first_seen_epoch": "1723680589.095982", "last_seen_epoch": "1723680589.096487", "packets": 2, "bytes": 521, "initiator_bytes": 273, "responder_bytes": 248 }, { "flow_id": "flow-78cb1ea1769a476cd89d87a1", "transport": "tcp", "stream": 36, "initiator_ip": "10.8.15.133", "initiator_port": 49709, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 802, "last_frame": 838, "first_seen_epoch": "1723680589.321403", "last_seen_epoch": "1723680589.33399", "packets": 21, "bytes": 7932, "initiator_bytes": 3739, "responder_bytes": 4193 }, { "flow_id": "flow-9f7c0c3079777b4bbda90134", "transport": "tcp", "stream": 37, "initiator_ip": "10.8.15.133", "initiator_port": 49710, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 819, "last_frame": 834, "first_seen_epoch": "1723680589.329924", "last_seen_epoch": "1723680589.333248", "packets": 16, "bytes": 7168, "initiator_bytes": 3049, "responder_bytes": 4119 }, { "flow_id": "flow-0021bceffd1b7467649dc2cb", "transport": "udp", "stream": 18, "initiator_ip": "10.8.15.133", "initiator_port": 138, "responder_ip": "10.8.15.255", "responder_port": 138, "first_frame": 841, "last_frame": 17047, "first_seen_epoch": "1723680589.743833", "last_seen_epoch": "1723682026.693492", "packets": 4, "bytes": 972, "initiator_bytes": 972, "responder_bytes": 0 }, { "flow_id": "flow-21546dbe000529268f6ba9bd", "transport": "tcp", "stream": 38, "initiator_ip": "10.8.15.133", "initiator_port": 49711, "responder_ip": "13.89.179.13", "responder_port": 443, "first_frame": 844, "last_frame": 10266, "first_seen_epoch": "1723680591.536293", "last_seen_epoch": "1723680697.068511", "packets": 47, "bytes": 21525, "initiator_bytes": 13209, "responder_bytes": 8316 }, { "flow_id": "flow-167c7d26b5254c62ac610399", "transport": "udp", "stream": 19, "initiator_ip": "10.8.15.133", "initiator_port": 123, "responder_ip": "10.8.15.4", "responder_port": 123, "first_frame": 887, "last_frame": 16163, "first_seen_epoch": "1723680593.691477", "last_seen_epoch": "1723681619.607468", "packets": 6, "bytes": 972, "initiator_bytes": 486, "responder_bytes": 486 }, { "flow_id": "flow-065a9cf7bf02165a61e910f4", "transport": "tcp", "stream": 39, "initiator_ip": "10.8.15.133", "initiator_port": 49712, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 889, "last_frame": 958, "first_seen_epoch": "1723680594.909859", "last_seen_epoch": "1723680594.939276", "packets": 25, "bytes": 8543, "initiator_bytes": 4089, "responder_bytes": 4454 }, { "flow_id": "flow-6a20584eca7d86f1d49e40e2", "transport": "tcp", "stream": 40, "initiator_ip": "10.8.15.133", "initiator_port": 49713, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 910, "last_frame": 954, "first_seen_epoch": "1723680594.928341", "last_seen_epoch": "1723680594.938823", "packets": 15, "bytes": 4673, "initiator_bytes": 3799, "responder_bytes": 874 }, { "flow_id": "flow-b5328f959f03987fdb9553f6", "transport": "tcp", "stream": 41, "initiator_ip": "10.8.15.133", "initiator_port": 49714, "responder_ip": "10.8.15.4", "responder_port": 88, "first_frame": 919, "last_frame": 927, "first_seen_epoch": "1723680594.933176", "last_seen_epoch": "1723680594.934334", "packets": 8, "bytes": 949, "initiator_bytes": 481, "responder_bytes": 468 }, { "flow_id": "flow-c09e897dbe9f11860508a4ef", "transport": "tcp", "stream": 42, "initiator_ip": "10.8.15.133", "initiator_port": 49715, "responder_ip": "10.8.15.4", "responder_port": 88, "first_frame": 926, "last_frame": 936, "first_seen_epoch": "1723680594.934283", "last_seen_epoch": "1723680594.935991", "packets": 10, "bytes": 2740, "initiator_bytes": 615, "responder_bytes": 2125 }, { "flow_id": "flow-8a4889a0dc347fac3facd300", "transport": "tcp", "stream": 43, "initiator_ip": "10.8.15.133", "initiator_port": 49716, "responder_ip": "10.8.15.4", "responder_port": 88, "first_frame": 937, "last_frame": 948, "first_seen_epoch": "1723680594.936119", "last_seen_epoch": "1723680594.937318", "packets": 12, "bytes": 4271, "initiator_bytes": 2158, "responder_bytes": 2113 }, { "flow_id": "flow-23327d20c930db0e54f438a0", "transport": "udp", "stream": 20, "initiator_ip": "10.8.15.133", "initiator_port": 52477, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 963, "last_frame": 18013, "first_seen_epoch": "1723680600.043877", "last_seen_epoch": "1723682460.256763", "packets": 10, "bytes": 1235, "initiator_bytes": 415, "responder_bytes": 820 }, { "flow_id": "flow-65554537f570ca044c2189db", "transport": "udp", "stream": 21, "initiator_ip": "10.8.15.133", "initiator_port": 52478, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 970, "last_frame": 971, "first_seen_epoch": "1723680607.989771", "last_seen_epoch": "1723680607.990184", "packets": 2, "bytes": 521, "initiator_bytes": 273, "responder_bytes": 248 }, { "flow_id": "flow-39a8fa6fa90a8ab52e9403bb", "transport": "tcp", "stream": 44, "initiator_ip": "10.8.15.133", "initiator_port": 49717, "responder_ip": "10.8.15.4", "responder_port": 88, "first_frame": 972, "last_frame": 979, "first_seen_epoch": "1723680608.106215", "last_seen_epoch": "1723680608.108504", "packets": 8, "bytes": 892, "initiator_bytes": 463, "responder_bytes": 429 }, { "flow_id": "flow-a4897a914758a6711891d048", "transport": "tcp", "stream": 45, "initiator_ip": "10.8.15.133", "initiator_port": 49718, "responder_ip": "10.8.15.4", "responder_port": 88, "first_frame": 980, "last_frame": 989, "first_seen_epoch": "1723680608.115102", "last_seen_epoch": "1723680608.116908", "packets": 10, "bytes": 2625, "initiator_bytes": 597, "responder_bytes": 2028 }, { "flow_id": "flow-0871b2977abde7abb3e6becd", "transport": "tcp", "stream": 46, "initiator_ip": "10.8.15.133", "initiator_port": 49719, "responder_ip": "10.8.15.4", "responder_port": 88, "first_frame": 990, "last_frame": 1001, "first_seen_epoch": "1723680608.117323", "last_seen_epoch": "1723680608.119162", "packets": 12, "bytes": 4012, "initiator_bytes": 1995, "responder_bytes": 2017 }, { "flow_id": "flow-9ce9fd6f5eac8853e5bcd5de", "transport": "tcp", "stream": 47, "initiator_ip": "10.8.15.133", "initiator_port": 49720, "responder_ip": "10.8.15.4", "responder_port": 88, "first_frame": 1004, "last_frame": 1015, "first_seen_epoch": "1723680608.251564", "last_seen_epoch": "1723680608.253479", "packets": 12, "bytes": 4317, "initiator_bytes": 2170, "responder_bytes": 2147 }, { "flow_id": "flow-963f6afead65d1713395b123", "transport": "tcp", "stream": 48, "initiator_ip": "10.8.15.133", "initiator_port": 49721, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 1030, "last_frame": 1086, "first_seen_epoch": "1723680608.260966", "last_seen_epoch": "1723680608.290151", "packets": 13, "bytes": 4437, "initiator_bytes": 3331, "responder_bytes": 1106 }, { "flow_id": "flow-3fd20a1c5f936f6693a6dbcd", "transport": "tcp", "stream": 49, "initiator_ip": "10.8.15.133", "initiator_port": 49722, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 1039, "last_frame": 1084, "first_seen_epoch": "1723680608.267822", "last_seen_epoch": "1723680608.286921", "packets": 13, "bytes": 3738, "initiator_bytes": 2878, "responder_bytes": 860 }, { "flow_id": "flow-7f2d4cb824a7c4816a0605c4", "transport": "tcp", "stream": 50, "initiator_ip": "10.8.15.133", "initiator_port": 49723, "responder_ip": "10.8.15.4", "responder_port": 88, "first_frame": 1052, "last_frame": 1063, "first_seen_epoch": "1723680608.278592", "last_seen_epoch": "1723680608.280399", "packets": 12, "bytes": 4273, "initiator_bytes": 2150, "responder_bytes": 2123 }, { "flow_id": "flow-40dd4e5db04c71a4304065fe", "transport": "tcp", "stream": 51, "initiator_ip": "10.8.15.133", "initiator_port": 49724, "responder_ip": "10.8.15.4", "responder_port": 88, "first_frame": 1064, "last_frame": 1075, "first_seen_epoch": "1723680608.280438", "last_seen_epoch": "1723680608.281517", "packets": 12, "bytes": 3915, "initiator_bytes": 1943, "responder_bytes": 1972 }, { "flow_id": "flow-28e92ff6ce6bf293d16abfa4", "transport": "tcp", "stream": 52, "initiator_ip": "10.8.15.133", "initiator_port": 49725, "responder_ip": "10.8.15.4", "responder_port": 445, "first_frame": 1130, "last_frame": 18099, "first_seen_epoch": "1723680608.41414", "last_seen_epoch": "1723682505.432634", "packets": 101, "bytes": 16385, "initiator_bytes": 9886, "responder_bytes": 6499 }, { "flow_id": "flow-a487af734c94c135c8dd05c6", "transport": "tcp", "stream": 53, "initiator_ip": "10.8.15.133", "initiator_port": 49726, "responder_ip": "10.8.15.4", "responder_port": 88, "first_frame": 1135, "last_frame": 1146, "first_seen_epoch": "1723680608.416801", "last_seen_epoch": "1723680608.418493", "packets": 12, "bytes": 4216, "initiator_bytes": 2131, "responder_bytes": 2085 }, { "flow_id": "flow-a952386c5fd9cbd720139265", "transport": "tcp", "stream": 54, "initiator_ip": "10.8.15.133", "initiator_port": 49727, "responder_ip": "23.220.103.18", "responder_port": 443, "first_frame": 1161, "last_frame": 10605, "first_seen_epoch": "1723680609.386304", "last_seen_epoch": "1723680719.344263", "packets": 35, "bytes": 8393, "initiator_bytes": 1828, "responder_bytes": 6565 }, { "flow_id": "flow-731879d15975d9bac9cd21ef", "transport": "tcp", "stream": 55, "initiator_ip": "10.8.15.133", "initiator_port": 49728, "responder_ip": "23.33.138.184", "responder_port": 443, "first_frame": 1193, "last_frame": 1216, "first_seen_epoch": "1723680609.650178", "last_seen_epoch": "1723680609.847655", "packets": 20, "bytes": 5182, "initiator_bytes": 3312, "responder_bytes": 1870 }, { "flow_id": "flow-44e072f900650f3e3b6de639", "transport": "tcp", "stream": 56, "initiator_ip": "10.8.15.133", "initiator_port": 49729, "responder_ip": "51.116.253.170", "responder_port": 443, "first_frame": 1195, "last_frame": 1285, "first_seen_epoch": "1723680609.68842", "last_seen_epoch": "1723680610.843565", "packets": 30, "bytes": 8327, "initiator_bytes": 2781, "responder_bytes": 5546 }, { "flow_id": "flow-ba5e5196907240e004d9d08f", "transport": "udp", "stream": 22, "initiator_ip": "10.8.15.133", "initiator_port": 57585, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 1239, "last_frame": 8901, "first_seen_epoch": "1723680610.533196", "last_seen_epoch": "1723680680.283935", "packets": 20, "bytes": 2578, "initiator_bytes": 825, "responder_bytes": 1753 }, { "flow_id": "flow-9edd0b7bc56d5a3105175aba", "transport": "tcp", "stream": 57, "initiator_ip": "10.8.15.133", "initiator_port": 49730, "responder_ip": "20.96.153.111", "responder_port": 443, "first_frame": 1243, "last_frame": 10607, "first_seen_epoch": "1723680610.58835", "last_seen_epoch": "1723680719.384098", "packets": 36, "bytes": 13642, "initiator_bytes": 2985, "responder_bytes": 10657 }, { "flow_id": "flow-8dcda185642be643fae6ade9", "transport": "tcp", "stream": 58, "initiator_ip": "10.8.15.133", "initiator_port": 49731, "responder_ip": "20.10.31.115", "responder_port": 443, "first_frame": 1244, "last_frame": 18136, "first_seen_epoch": "1723680610.593951", "last_seen_epoch": "1723682520.241749", "packets": 61, "bytes": 12645, "initiator_bytes": 4830, "responder_bytes": 7815 }, { "flow_id": "flow-9b8ac91eb83681447f87fd88", "transport": "tcp", "stream": 59, "initiator_ip": "10.8.15.133", "initiator_port": 49732, "responder_ip": "23.53.13.203", "responder_port": 443, "first_frame": 1305, "last_frame": 10276, "first_seen_epoch": "1723680611.000465", "last_seen_epoch": "1723680699.196451", "packets": 30, "bytes": 12360, "initiator_bytes": 1478, "responder_bytes": 10882 }, { "flow_id": "flow-6f06fee9dddf7f091f0744d3", "transport": "tcp", "stream": 60, "initiator_ip": "10.8.15.133", "initiator_port": 49733, "responder_ip": "23.220.103.18", "responder_port": 443, "first_frame": 1330, "last_frame": 11514, "first_seen_epoch": "1723680613.053633", "last_seen_epoch": "1723680793.217713", "packets": 207, "bytes": 163401, "initiator_bytes": 21958, "responder_bytes": 141443 }, { "flow_id": "flow-88e577715a39ec36c4846d9f", "transport": "tcp", "stream": 61, "initiator_ip": "10.8.15.133", "initiator_port": 49734, "responder_ip": "52.109.20.38", "responder_port": 443, "first_frame": 1385, "last_frame": 10901, "first_seen_epoch": "1723680613.268398", "last_seen_epoch": "1723680745.494228", "packets": 36, "bytes": 10332, "initiator_bytes": 1781, "responder_bytes": 8551 }, { "flow_id": "flow-89840f10a5c83198de5c4608", "transport": "tcp", "stream": 62, "initiator_ip": "10.8.15.133", "initiator_port": 49735, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 1486, "last_frame": 10774, "first_seen_epoch": "1723680613.646007", "last_seen_epoch": "1723680723.62002", "packets": 34, "bytes": 10364, "initiator_bytes": 1907, "responder_bytes": 8457 }, { "flow_id": "flow-f186b1547c0d35ec4096d856", "transport": "tcp", "stream": 63, "initiator_ip": "10.8.15.133", "initiator_port": 49736, "responder_ip": "52.109.0.142", "responder_port": 443, "first_frame": 1541, "last_frame": 10885, "first_seen_epoch": "1723680613.869306", "last_seen_epoch": "1723680737.300856", "packets": 28, "bytes": 9136, "initiator_bytes": 1407, "responder_bytes": 7729 }, { "flow_id": "flow-4c1dfa0d905a715692b8b16c", "transport": "tcp", "stream": 64, "initiator_ip": "10.8.15.133", "initiator_port": 49737, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 1591, "last_frame": 10773, "first_seen_epoch": "1723680614.024131", "last_seen_epoch": "1723680723.619747", "packets": 41, "bytes": 18460, "initiator_bytes": 2125, "responder_bytes": 16335 }, { "flow_id": "flow-9627bdd5d47d16b9ee833bcd", "transport": "tcp", "stream": 65, "initiator_ip": "10.8.15.133", "initiator_port": 49738, "responder_ip": "23.220.103.8", "responder_port": 443, "first_frame": 1593, "last_frame": 11515, "first_seen_epoch": "1723680614.031861", "last_seen_epoch": "1723680793.217756", "packets": 268, "bytes": 175864, "initiator_bytes": 11067, "responder_bytes": 164797 }, { "flow_id": "flow-fd4a29466dae8be23149ed62", "transport": "tcp", "stream": 66, "initiator_ip": "10.8.15.133", "initiator_port": 49739, "responder_ip": "23.220.103.8", "responder_port": 443, "first_frame": 1594, "last_frame": 11523, "first_seen_epoch": "1723680614.031896", "last_seen_epoch": "1723680793.218461", "packets": 24, "bytes": 6434, "initiator_bytes": 1136, "responder_bytes": 5298 }, { "flow_id": "flow-efc7041b6541b3db5b39eec2", "transport": "tcp", "stream": 67, "initiator_ip": "10.8.15.133", "initiator_port": 49740, "responder_ip": "23.220.103.8", "responder_port": 443, "first_frame": 1595, "last_frame": 11522, "first_seen_epoch": "1723680614.031985", "last_seen_epoch": "1723680793.218414", "packets": 24, "bytes": 6432, "initiator_bytes": 1136, "responder_bytes": 5296 }, { "flow_id": "flow-c76cb6b5eafdf3843fb30e46", "transport": "tcp", "stream": 68, "initiator_ip": "10.8.15.133", "initiator_port": 49741, "responder_ip": "23.220.103.8", "responder_port": 443, "first_frame": 1596, "last_frame": 11525, "first_seen_epoch": "1723680614.032086", "last_seen_epoch": "1723680793.218867", "packets": 24, "bytes": 6448, "initiator_bytes": 1136, "responder_bytes": 5312 }, { "flow_id": "flow-6e61f702cb558f2a0c2a2477", "transport": "tcp", "stream": 69, "initiator_ip": "10.8.15.133", "initiator_port": 49742, "responder_ip": "23.220.103.8", "responder_port": 443, "first_frame": 1597, "last_frame": 11520, "first_seen_epoch": "1723680614.032157", "last_seen_epoch": "1723680793.218312", "packets": 26, "bytes": 6557, "initiator_bytes": 1190, "responder_bytes": 5367 }, { "flow_id": "flow-0afced78652b8d5732e8b2b3", "transport": "tcp", "stream": 70, "initiator_ip": "10.8.15.133", "initiator_port": 49743, "responder_ip": "23.220.103.8", "responder_port": 443, "first_frame": 1598, "last_frame": 11517, "first_seen_epoch": "1723680614.032183", "last_seen_epoch": "1723680793.217963", "packets": 24, "bytes": 6432, "initiator_bytes": 1136, "responder_bytes": 5296 }, { "flow_id": "flow-8efdf68049fab7108d18c789", "transport": "tcp", "stream": 71, "initiator_ip": "10.8.15.133", "initiator_port": 49744, "responder_ip": "23.53.13.203", "responder_port": 443, "first_frame": 2021, "last_frame": 10775, "first_seen_epoch": "1723680614.970748", "last_seen_epoch": "1723680723.62016", "packets": 87, "bytes": 73595, "initiator_bytes": 2923, "responder_bytes": 70672 }, { "flow_id": "flow-ccac5ccff1ce5c7d0e38e0d1", "transport": "udp", "stream": 23, "initiator_ip": "10.8.15.133", "initiator_port": 57586, "responder_ip": "239.255.255.250", "responder_port": 1900, "first_frame": 2104, "last_frame": 2972, "first_seen_epoch": "1723680618.769208", "last_seen_epoch": "1723680621.781943", "packets": 4, "bytes": 868, "initiator_bytes": 868, "responder_bytes": 0 }, { "flow_id": "flow-62f62eb2e7edf4a77e5ed5ff", "transport": "udp", "stream": 24, "initiator_ip": "10.8.15.133", "initiator_port": 52062, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 2107, "last_frame": 2115, "first_seen_epoch": "1723680618.962098", "last_seen_epoch": "1723680619.000623", "packets": 2, "bytes": 259, "initiator_bytes": 78, "responder_bytes": 181 }, { "flow_id": "flow-298337b061a48b487fbb1293", "transport": "udp", "stream": 25, "initiator_ip": "10.8.15.133", "initiator_port": 54218, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 2108, "last_frame": 2109, "first_seen_epoch": "1723680618.962307", "last_seen_epoch": "1723680618.962508", "packets": 2, "bytes": 260, "initiator_bytes": 78, "responder_bytes": 182 }, { "flow_id": "flow-530b30a58680fe345770a707", "transport": "udp", "stream": 26, "initiator_ip": "10.8.15.133", "initiator_port": 51572, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 2110, "last_frame": 2112, "first_seen_epoch": "1723680618.96773", "last_seen_epoch": "1723680618.96804", "packets": 2, "bytes": 297, "initiator_bytes": 72, "responder_bytes": 225 }, { "flow_id": "flow-9b2d3ad8916fbf46818aa844", "transport": "udp", "stream": 27, "initiator_ip": "10.8.15.133", "initiator_port": 59615, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 2111, "last_frame": 2114, "first_seen_epoch": "1723680618.967976", "last_seen_epoch": "1723680619.000574", "packets": 2, "bytes": 265, "initiator_bytes": 72, "responder_bytes": 193 }, { "flow_id": "flow-a4fc27c99905b7f8a2523fc9", "transport": "tcp", "stream": 72, "initiator_ip": "10.8.15.133", "initiator_port": 49745, "responder_ip": "23.220.103.18", "responder_port": 443, "first_frame": 2113, "last_frame": 6196, "first_seen_epoch": "1723680618.983095", "last_seen_epoch": "1723680654.1345", "packets": 33, "bytes": 10281, "initiator_bytes": 3501, "responder_bytes": 6780 }, { "flow_id": "flow-9b5faf7e244e7b0d9cc4bc07", "transport": "udp", "stream": 27, "initiator_ip": "10.8.15.133", "initiator_port": 53, "responder_ip": "10.8.15.4", "responder_port": 59615, "first_frame": 2116, "last_frame": 2116, "first_seen_epoch": "1723680619.000733", "last_seen_epoch": "1723680619.000733", "packets": 1, "bytes": 221, "initiator_bytes": 221, "responder_bytes": 0 }, { "flow_id": "flow-4f93a7f6e726e558c5aa691b", "transport": "tcp", "stream": 73, "initiator_ip": "10.8.15.133", "initiator_port": 49746, "responder_ip": "13.107.21.239", "responder_port": 443, "first_frame": 2117, "last_frame": 6193, "first_seen_epoch": "1723680619.001936", "last_seen_epoch": "1723680654.119986", "packets": 34, "bytes": 12571, "initiator_bytes": 4033, "responder_bytes": 8538 }, { "flow_id": "flow-46062712684de7c7d95ce6ea", "transport": "tcp", "stream": 74, "initiator_ip": "10.8.15.133", "initiator_port": 49747, "responder_ip": "10.8.15.4", "responder_port": 135, "first_frame": 2150, "last_frame": 2302, "first_seen_epoch": "1723680619.132581", "last_seen_epoch": "1723680619.598249", "packets": 11, "bytes": 1758, "initiator_bytes": 886, "responder_bytes": 872 }, { "flow_id": "flow-e0c44cd16158a942b9640c56", "transport": "tcp", "stream": 75, "initiator_ip": "10.8.15.133", "initiator_port": 49748, "responder_ip": "10.8.15.4", "responder_port": 49669, "first_frame": 2161, "last_frame": 2303, "first_seen_epoch": "1723680619.137301", "last_seen_epoch": "1723680619.59853", "packets": 23, "bytes": 6873, "initiator_bytes": 4452, "responder_bytes": 2421 }, { "flow_id": "flow-56b890679297d92576a60961", "transport": "tcp", "stream": 76, "initiator_ip": "10.8.15.133", "initiator_port": 49749, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 2190, "last_frame": 2226, "first_seen_epoch": "1723680619.149344", "last_seen_epoch": "1723680619.160496", "packets": 19, "bytes": 7758, "initiator_bytes": 3619, "responder_bytes": 4139 }, { "flow_id": "flow-f5691424c5a67dcbbcb5c14b", "transport": "tcp", "stream": 77, "initiator_ip": "10.8.15.133", "initiator_port": 49750, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 2207, "last_frame": 2225, "first_seen_epoch": "1723680619.156187", "last_seen_epoch": "1723680619.160344", "packets": 18, "bytes": 7210, "initiator_bytes": 3037, "responder_bytes": 4173 }, { "flow_id": "flow-59e59d3df05e11d61ce9ae06", "transport": "tcp", "stream": 78, "initiator_ip": "10.8.15.133", "initiator_port": 49751, "responder_ip": "40.126.29.13", "responder_port": 443, "first_frame": 2246, "last_frame": 2304, "first_seen_epoch": "1723680619.208704", "last_seen_epoch": "1723680619.59908", "packets": 24, "bytes": 8176, "initiator_bytes": 2001, "responder_bytes": 6175 }, { "flow_id": "flow-ccb8fa259268b4727ca117f0", "transport": "udp", "stream": 28, "initiator_ip": "10.8.15.133", "initiator_port": 59189, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 2280, "last_frame": 2282, "first_seen_epoch": "1723680619.360469", "last_seen_epoch": "1723680619.360829", "packets": 2, "bytes": 259, "initiator_bytes": 78, "responder_bytes": 181 }, { "flow_id": "flow-a064230338c714d8257742a5", "transport": "udp", "stream": 29, "initiator_ip": "10.8.15.133", "initiator_port": 54422, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 2281, "last_frame": 2286, "first_seen_epoch": "1723680619.360576", "last_seen_epoch": "1723680619.392816", "packets": 2, "bytes": 227, "initiator_bytes": 78, "responder_bytes": 149 }, { "flow_id": "flow-78c11231d86aaafe04e8adb2", "transport": "tcp", "stream": 79, "initiator_ip": "10.8.15.133", "initiator_port": 49752, "responder_ip": "204.79.197.239", "responder_port": 443, "first_frame": 2283, "last_frame": 6194, "first_seen_epoch": "1723680619.373571", "last_seen_epoch": "1723680654.120026", "packets": 29, "bytes": 10734, "initiator_bytes": 3212, "responder_bytes": 7522 }, { "flow_id": "flow-07b56ec16f14c9d4c8991bda", "transport": "udp", "stream": 30, "initiator_ip": "10.8.15.133", "initiator_port": 54773, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 2314, "last_frame": 2316, "first_seen_epoch": "1723680619.724662", "last_seen_epoch": "1723680619.725181", "packets": 2, "bytes": 333, "initiator_bytes": 81, "responder_bytes": 252 }, { "flow_id": "flow-9cb3957c7670b9c1c7ccc368", "transport": "udp", "stream": 31, "initiator_ip": "10.8.15.133", "initiator_port": 56117, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 2315, "last_frame": 2317, "first_seen_epoch": "1723680619.724901", "last_seen_epoch": "1723680619.725298", "packets": 2, "bytes": 362, "initiator_bytes": 81, "responder_bytes": 281 }, { "flow_id": "flow-795961aba0685dfb89e9a7ea", "transport": "tcp", "stream": 80, "initiator_ip": "10.8.15.133", "initiator_port": 49753, "responder_ip": "23.220.103.8", "responder_port": 443, "first_frame": 2318, "last_frame": 3661, "first_seen_epoch": "1723680619.725975", "last_seen_epoch": "1723680646.094182", "packets": 19, "bytes": 7462, "initiator_bytes": 2309, "responder_bytes": 5153 }, { "flow_id": "flow-b75c9cd26a8c18f239ae63f5", "transport": "udp", "stream": 32, "initiator_ip": "10.8.15.133", "initiator_port": 54323, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 2329, "last_frame": 2330, "first_seen_epoch": "1723680619.794845", "last_seen_epoch": "1723680619.795182", "packets": 2, "bytes": 333, "initiator_bytes": 81, "responder_bytes": 252 }, { "flow_id": "flow-15d1129ef103633a1e6f0de0", "transport": "udp", "stream": 33, "initiator_ip": "10.8.15.133", "initiator_port": 54613, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 2331, "last_frame": 2332, "first_seen_epoch": "1723680619.795686", "last_seen_epoch": "1723680619.795941", "packets": 2, "bytes": 362, "initiator_bytes": 81, "responder_bytes": 281 }, { "flow_id": "flow-00b1f7cbef095c78f74432f6", "transport": "udp", "stream": 34, "initiator_ip": "10.8.15.133", "initiator_port": 65378, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 2334, "last_frame": 2335, "first_seen_epoch": "1723680619.796643", "last_seen_epoch": "1723680619.796873", "packets": 2, "bytes": 333, "initiator_bytes": 81, "responder_bytes": 252 }, { "flow_id": "flow-2b3816a71d410c14c5c04b55", "transport": "tcp", "stream": 81, "initiator_ip": "10.8.15.133", "initiator_port": 49754, "responder_ip": "23.220.103.18", "responder_port": 443, "first_frame": 2336, "last_frame": 6167, "first_seen_epoch": "1723680619.798854", "last_seen_epoch": "1723680653.979754", "packets": 706, "bytes": 701923, "initiator_bytes": 47918, "responder_bytes": 654005 }, { "flow_id": "flow-187581e07eb09f7c25924a29", "transport": "udp", "stream": 35, "initiator_ip": "10.8.15.133", "initiator_port": 53929, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 2398, "last_frame": 2400, "first_seen_epoch": "1723680620.446606", "last_seen_epoch": "1723680620.447044", "packets": 2, "bytes": 333, "initiator_bytes": 81, "responder_bytes": 252 }, { "flow_id": "flow-8403dbf319be79dd19e2713f", "transport": "udp", "stream": 36, "initiator_ip": "10.8.15.133", "initiator_port": 57298, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 2399, "last_frame": 2401, "first_seen_epoch": "1723680620.44677", "last_seen_epoch": "1723680620.447047", "packets": 2, "bytes": 333, "initiator_bytes": 81, "responder_bytes": 252 }, { "flow_id": "flow-e5c928b8b7ce78291e6a5e64", "transport": "udp", "stream": 37, "initiator_ip": "10.8.15.133", "initiator_port": 57486, "responder_ip": "23.220.103.18", "responder_port": 443, "first_frame": 2511, "last_frame": 5531, "first_seen_epoch": "1723680620.721571", "last_seen_epoch": "1723680650.815017", "packets": 30, "bytes": 11905, "initiator_bytes": 4812, "responder_bytes": 7093 }, { "flow_id": "flow-a2be97c451c4ad8fe3d8e1fd", "transport": "udp", "stream": 38, "initiator_ip": "10.8.15.133", "initiator_port": 58818, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 2998, "last_frame": 11866, "first_seen_epoch": "1723680622.306637", "last_seen_epoch": "1723680800.899368", "packets": 31, "bytes": 4684, "initiator_bytes": 1600, "responder_bytes": 3084 }, { "flow_id": "flow-de1bf499ed9d08a493565824", "transport": "tcp", "stream": 82, "initiator_ip": "10.8.15.133", "initiator_port": 49756, "responder_ip": "52.113.194.132", "responder_port": 443, "first_frame": 3002, "last_frame": 10206, "first_seen_epoch": "1723680622.361245", "last_seen_epoch": "1723680686.919864", "packets": 24, "bytes": 10156, "initiator_bytes": 1540, "responder_bytes": 8616 }, { "flow_id": "flow-fc2d25cf10ffd5fa47367995", "transport": "tcp", "stream": 83, "initiator_ip": "10.8.15.133", "initiator_port": 49755, "responder_ip": "52.109.0.142", "responder_port": 443, "first_frame": 3003, "last_frame": 10882, "first_seen_epoch": "1723680622.36133", "last_seen_epoch": "1723680732.31359", "packets": 35, "bytes": 14321, "initiator_bytes": 2981, "responder_bytes": 11340 }, { "flow_id": "flow-002ef72783cbf5b1c61031f1", "transport": "tcp", "stream": 84, "initiator_ip": "10.8.15.133", "initiator_port": 49757, "responder_ip": "20.241.44.114", "responder_port": 443, "first_frame": 3004, "last_frame": 6283, "first_seen_epoch": "1723680622.361519", "last_seen_epoch": "1723680656.084994", "packets": 21, "bytes": 8507, "initiator_bytes": 1227, "responder_bytes": 7280 }, { "flow_id": "flow-1a75c20b15cf2faee4566c08", "transport": "tcp", "stream": 85, "initiator_ip": "10.8.15.133", "initiator_port": 49758, "responder_ip": "23.63.205.134", "responder_port": 443, "first_frame": 3070, "last_frame": 10880, "first_seen_epoch": "1723680622.993053", "last_seen_epoch": "1723680732.294822", "packets": 31, "bytes": 12402, "initiator_bytes": 1558, "responder_bytes": 10844 }, { "flow_id": "flow-bbd23be8a86b155ff40d4af4", "transport": "udp", "stream": 39, "initiator_ip": "10.8.15.133", "initiator_port": 51383, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 3146, "last_frame": 3148, "first_seen_epoch": "1723680623.819087", "last_seen_epoch": "1723680623.819458", "packets": 2, "bytes": 291, "initiator_bytes": 71, "responder_bytes": 220 }, { "flow_id": "flow-9229d312fbad541a2358b90c", "transport": "udp", "stream": 40, "initiator_ip": "10.8.15.133", "initiator_port": 60588, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 3147, "last_frame": 3149, "first_seen_epoch": "1723680623.819219", "last_seen_epoch": "1723680623.81951", "packets": 2, "bytes": 320, "initiator_bytes": 71, "responder_bytes": 249 }, { "flow_id": "flow-60d0a905ff61e886f5e83638", "transport": "udp", "stream": 41, "initiator_ip": "10.8.15.133", "initiator_port": 59301, "responder_ip": "23.220.103.18", "responder_port": 443, "first_frame": 3150, "last_frame": 3506, "first_seen_epoch": "1723680623.820472", "last_seen_epoch": "1723680624.242521", "packets": 357, "bytes": 347296, "initiator_bytes": 13780, "responder_bytes": 333516 }, { "flow_id": "flow-0e3c5f94ec8fb60df92b056c", "transport": "tcp", "stream": 86, "initiator_ip": "10.8.15.133", "initiator_port": 49759, "responder_ip": "13.107.5.93", "responder_port": 443, "first_frame": 3543, "last_frame": 10234, "first_seen_epoch": "1723680626.089946", "last_seen_epoch": "1723680693.67379", "packets": 29, "bytes": 17218, "initiator_bytes": 1817, "responder_bytes": 15401 }, { "flow_id": "flow-83f8271bd5a37203012b39b6", "transport": "udp", "stream": 42, "initiator_ip": "10.8.15.133", "initiator_port": 58475, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 3654, "last_frame": 3656, "first_seen_epoch": "1723680646.086019", "last_seen_epoch": "1723680646.086404", "packets": 2, "bytes": 217, "initiator_bytes": 71, "responder_bytes": 146 }, { "flow_id": "flow-2b6330121fd27bcf556cb4cd", "transport": "udp", "stream": 43, "initiator_ip": "10.8.15.133", "initiator_port": 57244, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 3655, "last_frame": 5162, "first_seen_epoch": "1723680646.086144", "last_seen_epoch": "1723680650.180461", "packets": 2, "bytes": 201, "initiator_bytes": 71, "responder_bytes": 130 }, { "flow_id": "flow-0842d0a57e5c4911de8081a6", "transport": "udp", "stream": 44, "initiator_ip": "10.8.15.133", "initiator_port": 58157, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 3657, "last_frame": 3658, "first_seen_epoch": "1723680646.093113", "last_seen_epoch": "1723680646.093457", "packets": 2, "bytes": 217, "initiator_bytes": 71, "responder_bytes": 146 }, { "flow_id": "flow-c0a652956911e89b852ea67f", "transport": "tcp", "stream": 87, "initiator_ip": "10.8.15.133", "initiator_port": 49760, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 3660, "last_frame": 6157, "first_seen_epoch": "1723680646.094177", "last_seen_epoch": "1723680653.836367", "packets": 259, "bytes": 257540, "initiator_bytes": 17041, "responder_bytes": 240499 }, { "flow_id": "flow-5801f7b2a038c1c7a4f9f428", "transport": "udp", "stream": 45, "initiator_ip": "10.8.15.133", "initiator_port": 56503, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 3662, "last_frame": 3664, "first_seen_epoch": "1723680646.15544", "last_seen_epoch": "1723680646.404859", "packets": 2, "bytes": 235, "initiator_bytes": 77, "responder_bytes": 158 }, { "flow_id": "flow-e536e6227cb3d20b03afdc88", "transport": "udp", "stream": 46, "initiator_ip": "10.8.15.133", "initiator_port": 51850, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 3663, "last_frame": 5368, "first_seen_epoch": "1723680646.155667", "last_seen_epoch": "1723680650.245055", "packets": 2, "bytes": 219, "initiator_bytes": 77, "responder_bytes": 142 }, { "flow_id": "flow-b5fc469d33a5b5afb6a43903", "transport": "tcp", "stream": 88, "initiator_ip": "10.8.15.133", "initiator_port": 49761, "responder_ip": "13.107.6.158", "responder_port": 443, "first_frame": 3665, "last_frame": 6185, "first_seen_epoch": "1723680646.466976", "last_seen_epoch": "1723680654.080948", "packets": 42, "bytes": 14810, "initiator_bytes": 4312, "responder_bytes": 10498 }, { "flow_id": "flow-5a486cc446251ef35c1b9f15", "transport": "tcp", "stream": 89, "initiator_ip": "10.8.15.133", "initiator_port": 49762, "responder_ip": "13.107.6.158", "responder_port": 443, "first_frame": 3666, "last_frame": 3717, "first_seen_epoch": "1723680646.467134", "last_seen_epoch": "1723680646.781795", "packets": 25, "bytes": 11721, "initiator_bytes": 3108, "responder_bytes": 8613 }, { "flow_id": "flow-905a81beee4e852ebe394798", "transport": "udp", "stream": 47, "initiator_ip": "10.8.15.133", "initiator_port": 61665, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 3797, "last_frame": 3816, "first_seen_epoch": "1723680647.61721", "last_seen_epoch": "1723680647.655918", "packets": 2, "bytes": 239, "initiator_bytes": 87, "responder_bytes": 152 }, { "flow_id": "flow-0f63af81dc901642aca2dd35", "transport": "udp", "stream": 48, "initiator_ip": "10.8.15.133", "initiator_port": 60813, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 3798, "last_frame": 3828, "first_seen_epoch": "1723680647.617356", "last_seen_epoch": "1723680647.681941", "packets": 2, "bytes": 207, "initiator_bytes": 87, "responder_bytes": 120 }, { "flow_id": "flow-b40b40272bb9b568ea6cb781", "transport": "udp", "stream": 49, "initiator_ip": "10.8.15.133", "initiator_port": 60586, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 3799, "last_frame": 3822, "first_seen_epoch": "1723680647.617991", "last_seen_epoch": "1723680647.678854", "packets": 2, "bytes": 232, "initiator_bytes": 84, "responder_bytes": 148 }, { "flow_id": "flow-7e546ad902ff1b670faacf19", "transport": "udp", "stream": 50, "initiator_ip": "10.8.15.133", "initiator_port": 53282, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 3800, "last_frame": 3815, "first_seen_epoch": "1723680647.618121", "last_seen_epoch": "1723680647.65229", "packets": 2, "bytes": 249, "initiator_bytes": 84, "responder_bytes": 165 }, { "flow_id": "flow-f169d815160f54416bacdd36", "transport": "udp", "stream": 51, "initiator_ip": "10.8.15.133", "initiator_port": 57917, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 3801, "last_frame": 3821, "first_seen_epoch": "1723680647.618882", "last_seen_epoch": "1723680647.67884", "packets": 2, "bytes": 291, "initiator_bytes": 71, "responder_bytes": 220 }, { "flow_id": "flow-1e8d381b199875badceff4c8", "transport": "udp", "stream": 52, "initiator_ip": "10.8.15.133", "initiator_port": 58089, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 3802, "last_frame": 3817, "first_seen_epoch": "1723680647.618976", "last_seen_epoch": "1723680647.663999", "packets": 2, "bytes": 320, "initiator_bytes": 71, "responder_bytes": 249 }, { "flow_id": "flow-f2f8cf8750e2488944aa2da0", "transport": "udp", "stream": 53, "initiator_ip": "10.8.15.133", "initiator_port": 56208, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 3803, "last_frame": 3823, "first_seen_epoch": "1723680647.633735", "last_seen_epoch": "1723680647.679002", "packets": 2, "bytes": 301, "initiator_bytes": 87, "responder_bytes": 214 }, { "flow_id": "flow-12d41e1b4da95cbf08fc6e8a", "transport": "udp", "stream": 54, "initiator_ip": "10.8.15.133", "initiator_port": 57821, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 3804, "last_frame": 3835, "first_seen_epoch": "1723680647.633897", "last_seen_epoch": "1723680647.712629", "packets": 2, "bytes": 285, "initiator_bytes": 87, "responder_bytes": 198 }, { "flow_id": "flow-7cb4b4f5d5e1e9688fff6fce", "transport": "udp", "stream": 55, "initiator_ip": "10.8.15.133", "initiator_port": 50688, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 3818, "last_frame": 3831, "first_seen_epoch": "1723680647.664993", "last_seen_epoch": "1723680647.704145", "packets": 2, "bytes": 297, "initiator_bytes": 72, "responder_bytes": 225 }, { "flow_id": "flow-fa41838e229f8ac22ade9cfe", "transport": "udp", "stream": 56, "initiator_ip": "10.8.15.133", "initiator_port": 64317, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 3819, "last_frame": 3820, "first_seen_epoch": "1723680647.665107", "last_seen_epoch": "1723680647.665273", "packets": 2, "bytes": 326, "initiator_bytes": 72, "responder_bytes": 254 }, { "flow_id": "flow-0c4a0b53e28bd9abc056d2c1", "transport": "udp", "stream": 57, "initiator_ip": "10.8.15.133", "initiator_port": 65056, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 3824, "last_frame": 3838, "first_seen_epoch": "1723680647.679975", "last_seen_epoch": "1723680647.730583", "packets": 2, "bytes": 202, "initiator_bytes": 69, "responder_bytes": 133 }, { "flow_id": "flow-63265ca8205c31e4ed4e7cd5", "transport": "udp", "stream": 58, "initiator_ip": "10.8.15.133", "initiator_port": 59582, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 3825, "last_frame": 3839, "first_seen_epoch": "1723680647.680212", "last_seen_epoch": "1723680647.730733", "packets": 2, "bytes": 186, "initiator_bytes": 69, "responder_bytes": 117 }, { "flow_id": "flow-b2741938b33f3d2421cef670", "transport": "udp", "stream": 59, "initiator_ip": "10.8.15.133", "initiator_port": 60393, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 3826, "last_frame": 3836, "first_seen_epoch": "1723680647.680678", "last_seen_epoch": "1723680647.71266", "packets": 2, "bytes": 235, "initiator_bytes": 70, "responder_bytes": 165 }, { "flow_id": "flow-59a4cc88a5007d27dba9c1bd", "transport": "udp", "stream": 60, "initiator_ip": "10.8.15.133", "initiator_port": 61703, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 3827, "last_frame": 3850, "first_seen_epoch": "1723680647.680817", "last_seen_epoch": "1723680647.745289", "packets": 2, "bytes": 203, "initiator_bytes": 70, "responder_bytes": 133 }, { "flow_id": "flow-96e4bce95c637a5d08bcdf94", "transport": "udp", "stream": 48, "initiator_ip": "10.8.15.133", "initiator_port": 53, "responder_ip": "10.8.15.4", "responder_port": 60813, "first_frame": 3829, "last_frame": 3829, "first_seen_epoch": "1723680647.682049", "last_seen_epoch": "1723680647.682049", "packets": 1, "bytes": 148, "initiator_bytes": 148, "responder_bytes": 0 }, { "flow_id": "flow-7edc85b73800ea09659d673b", "transport": "tcp", "stream": 90, "initiator_ip": "10.8.15.133", "initiator_port": 49763, "responder_ip": "20.42.72.131", "responder_port": 443, "first_frame": 3830, "last_frame": 6198, "first_seen_epoch": "1723680647.69599", "last_seen_epoch": "1723680654.177828", "packets": 219, "bytes": 135640, "initiator_bytes": 120772, "responder_bytes": 14868 }, { "flow_id": "flow-5e21e97ca114237e0dd0eaed", "transport": "tcp", "stream": 91, "initiator_ip": "10.8.15.133", "initiator_port": 49764, "responder_ip": "23.220.103.18", "responder_port": 443, "first_frame": 3832, "last_frame": 6171, "first_seen_epoch": "1723680647.706445", "last_seen_epoch": "1723680653.984273", "packets": 49, "bytes": 31866, "initiator_bytes": 3990, "responder_bytes": 27876 }, { "flow_id": "flow-3d576d513e843a7df86cb8a1", "transport": "udp", "stream": 61, "initiator_ip": "10.8.15.133", "initiator_port": 59403, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 3833, "last_frame": 3853, "first_seen_epoch": "1723680647.707158", "last_seen_epoch": "1723680647.756613", "packets": 2, "bytes": 334, "initiator_bytes": 74, "responder_bytes": 260 }, { "flow_id": "flow-a284fc013a5a00380ae6d4bf", "transport": "udp", "stream": 62, "initiator_ip": "10.8.15.133", "initiator_port": 59155, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 3834, "last_frame": 3845, "first_seen_epoch": "1723680647.70725", "last_seen_epoch": "1723680647.738191", "packets": 2, "bytes": 222, "initiator_bytes": 74, "responder_bytes": 148 }, { "flow_id": "flow-4b11ed28b2a8177392fbfbcf", "transport": "tcp", "stream": 92, "initiator_ip": "10.8.15.133", "initiator_port": 49765, "responder_ip": "13.107.21.237", "responder_port": 443, "first_frame": 3837, "last_frame": 6181, "first_seen_epoch": "1723680647.723675", "last_seen_epoch": "1723680654.077979", "packets": 24, "bytes": 11525, "initiator_bytes": 2858, "responder_bytes": 8667 }, { "flow_id": "flow-0b62b9c239ea64b2d73b742d", "transport": "tcp", "stream": 93, "initiator_ip": "10.8.15.133", "initiator_port": 49766, "responder_ip": "20.125.209.212", "responder_port": 443, "first_frame": 3840, "last_frame": 6163, "first_seen_epoch": "1723680647.731613", "last_seen_epoch": "1723680653.862234", "packets": 20, "bytes": 9329, "initiator_bytes": 2256, "responder_bytes": 7073 }, { "flow_id": "flow-34399062d7acc9d14762f45d", "transport": "udp", "stream": 63, "initiator_ip": "10.8.15.133", "initiator_port": 62921, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 3841, "last_frame": 3864, "first_seen_epoch": "1723680647.732029", "last_seen_epoch": "1723680647.770709", "packets": 2, "bytes": 217, "initiator_bytes": 71, "responder_bytes": 146 }, { "flow_id": "flow-c03d3278d0351a6b6bef58f3", "transport": "udp", "stream": 64, "initiator_ip": "10.8.15.133", "initiator_port": 57734, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 3842, "last_frame": 3884, "first_seen_epoch": "1723680647.732238", "last_seen_epoch": "1723680647.809673", "packets": 2, "bytes": 201, "initiator_bytes": 71, "responder_bytes": 130 }, { "flow_id": "flow-f7d3c4bc58cfad4edf1d7a39", "transport": "tcp", "stream": 94, "initiator_ip": "10.8.15.133", "initiator_port": 49767, "responder_ip": "23.53.13.203", "responder_port": 443, "first_frame": 3858, "last_frame": 6190, "first_seen_epoch": "1723680647.759137", "last_seen_epoch": "1723680654.099866", "packets": 34, "bytes": 13474, "initiator_bytes": 4060, "responder_bytes": 9414 }, { "flow_id": "flow-538a1a0636be2395386f5e11", "transport": "tcp", "stream": 95, "initiator_ip": "10.8.15.133", "initiator_port": 49768, "responder_ip": "23.53.13.203", "responder_port": 443, "first_frame": 3859, "last_frame": 6159, "first_seen_epoch": "1723680647.759562", "last_seen_epoch": "1723680653.849945", "packets": 174, "bytes": 160522, "initiator_bytes": 9072, "responder_bytes": 151450 }, { "flow_id": "flow-3b6ff4b886c80cbe5c35f875", "transport": "udp", "stream": 65, "initiator_ip": "10.8.15.133", "initiator_port": 63563, "responder_ip": "23.220.103.8", "responder_port": 443, "first_frame": 3860, "last_frame": 6059, "first_seen_epoch": "1723680647.761648", "last_seen_epoch": "1723680651.337606", "packets": 1082, "bytes": 952730, "initiator_bytes": 27185, "responder_bytes": 925545 }, { "flow_id": "flow-cc6f48e3822d5d8189065fa6", "transport": "tcp", "stream": 96, "initiator_ip": "10.8.15.133", "initiator_port": 49769, "responder_ip": "18.160.156.115", "responder_port": 443, "first_frame": 3862, "last_frame": 6152, "first_seen_epoch": "1723680647.762487", "last_seen_epoch": "1723680653.664093", "packets": 22, "bytes": 8987, "initiator_bytes": 2350, "responder_bytes": 6637 }, { "flow_id": "flow-abc119bfa40c4145e2195910", "transport": "tcp", "stream": 97, "initiator_ip": "10.8.15.133", "initiator_port": 49770, "responder_ip": "23.205.110.12", "responder_port": 443, "first_frame": 3863, "last_frame": 6179, "first_seen_epoch": "1723680647.76304", "last_seen_epoch": "1723680654.05312", "packets": 121, "bytes": 55535, "initiator_bytes": 7018, "responder_bytes": 48517 }, { "flow_id": "flow-c98b23b6f0d11a937a0eae0d", "transport": "tcp", "stream": 98, "initiator_ip": "10.8.15.133", "initiator_port": 49771, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 3871, "last_frame": 6180, "first_seen_epoch": "1723680647.786276", "last_seen_epoch": "1723680654.066373", "packets": 24, "bytes": 10340, "initiator_bytes": 2978, "responder_bytes": 7362 }, { "flow_id": "flow-720f41f9381f2a501ae42e47", "transport": "udp", "stream": 66, "initiator_ip": "10.8.15.133", "initiator_port": 62319, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 4384, "last_frame": 4386, "first_seen_epoch": "1723680648.357201", "last_seen_epoch": "1723680648.357602", "packets": 2, "bytes": 237, "initiator_bytes": 72, "responder_bytes": 165 }, { "flow_id": "flow-d6b3ba4000cb3907933a5a75", "transport": "udp", "stream": 67, "initiator_ip": "10.8.15.133", "initiator_port": 54071, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 4385, "last_frame": 4387, "first_seen_epoch": "1723680648.357394", "last_seen_epoch": "1723680648.357606", "packets": 2, "bytes": 278, "initiator_bytes": 72, "responder_bytes": 206 }, { "flow_id": "flow-5a65af3d65a89919db6c9a16", "transport": "udp", "stream": 68, "initiator_ip": "10.8.15.133", "initiator_port": 50336, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 4395, "last_frame": 4404, "first_seen_epoch": "1723680648.389188", "last_seen_epoch": "1723680648.443397", "packets": 2, "bytes": 359, "initiator_bytes": 94, "responder_bytes": 265 }, { "flow_id": "flow-1e7c4f64bc41511f8922810d", "transport": "udp", "stream": 69, "initiator_ip": "10.8.15.133", "initiator_port": 58981, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 4396, "last_frame": 4413, "first_seen_epoch": "1723680648.389385", "last_seen_epoch": "1723680648.484064", "packets": 2, "bytes": 343, "initiator_bytes": 94, "responder_bytes": 249 }, { "flow_id": "flow-2eb0e495fca8e019d1f8556b", "transport": "tcp", "stream": 99, "initiator_ip": "10.8.15.133", "initiator_port": 49772, "responder_ip": "13.107.246.57", "responder_port": 443, "first_frame": 4407, "last_frame": 6174, "first_seen_epoch": "1723680648.461041", "last_seen_epoch": "1723680654.036574", "packets": 33, "bytes": 12478, "initiator_bytes": 3598, "responder_bytes": 8880 }, { "flow_id": "flow-a68604de35a4421b974eefc6", "transport": "udp", "stream": 69, "initiator_ip": "10.8.15.133", "initiator_port": 53, "responder_ip": "10.8.15.4", "responder_port": 58981, "first_frame": 4414, "last_frame": 4414, "first_seen_epoch": "1723680648.484222", "last_seen_epoch": "1723680648.484222", "packets": 1, "bytes": 277, "initiator_bytes": 277, "responder_bytes": 0 }, { "flow_id": "flow-18d0d64bec05c06937a724c5", "transport": "tcp", "stream": 100, "initiator_ip": "10.8.15.133", "initiator_port": 49773, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 4475, "last_frame": 6184, "first_seen_epoch": "1723680649.008899", "last_seen_epoch": "1723680654.080762", "packets": 34, "bytes": 11898, "initiator_bytes": 3718, "responder_bytes": 8180 }, { "flow_id": "flow-65ab6b33b76aeee231b11a4b", "transport": "udp", "stream": 70, "initiator_ip": "10.8.15.133", "initiator_port": 62440, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 4684, "last_frame": 4774, "first_seen_epoch": "1723680649.628039", "last_seen_epoch": "1723680649.671886", "packets": 2, "bytes": 288, "initiator_bytes": 70, "responder_bytes": 218 }, { "flow_id": "flow-38753dc6ed1cb46e45183aaa", "transport": "udp", "stream": 71, "initiator_ip": "10.8.15.133", "initiator_port": 58878, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 4685, "last_frame": 4778, "first_seen_epoch": "1723680649.628122", "last_seen_epoch": "1723680649.68208", "packets": 2, "bytes": 317, "initiator_bytes": 70, "responder_bytes": 247 }, { "flow_id": "flow-53e166dc2ce85ac14875f986", "transport": "udp", "stream": 72, "initiator_ip": "10.8.15.133", "initiator_port": 53169, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 4686, "last_frame": 4773, "first_seen_epoch": "1723680649.628579", "last_seen_epoch": "1723680649.669936", "packets": 2, "bytes": 232, "initiator_bytes": 76, "responder_bytes": 156 }, { "flow_id": "flow-6c901541f6df49490327a24f", "transport": "udp", "stream": 73, "initiator_ip": "10.8.15.133", "initiator_port": 65521, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 4687, "last_frame": 4772, "first_seen_epoch": "1723680649.628681", "last_seen_epoch": "1723680649.669924", "packets": 2, "bytes": 202, "initiator_bytes": 76, "responder_bytes": 126 }, { "flow_id": "flow-1098b162099067b6af8fbed0", "transport": "udp", "stream": 74, "initiator_ip": "10.8.15.133", "initiator_port": 61578, "responder_ip": "23.220.103.18", "responder_port": 443, "first_frame": 4724, "last_frame": 5417, "first_seen_epoch": "1723680649.653639", "last_seen_epoch": "1723680650.403589", "packets": 43, "bytes": 18708, "initiator_bytes": 8047, "responder_bytes": 10661 }, { "flow_id": "flow-0c4e52422a598b0806199b28", "transport": "tcp", "stream": 101, "initiator_ip": "10.8.15.133", "initiator_port": 49774, "responder_ip": "204.79.197.219", "responder_port": 443, "first_frame": 4808, "last_frame": 6160, "first_seen_epoch": "1723680649.702119", "last_seen_epoch": "1723680653.850795", "packets": 23, "bytes": 10235, "initiator_bytes": 2870, "responder_bytes": 7365 }, { "flow_id": "flow-1f63171f3666eec505465f43", "transport": "tcp", "stream": 102, "initiator_ip": "10.8.15.133", "initiator_port": 49775, "responder_ip": "23.220.103.8", "responder_port": 443, "first_frame": 4811, "last_frame": 6177, "first_seen_epoch": "1723680649.709456", "last_seen_epoch": "1723680654.036907", "packets": 21, "bytes": 7519, "initiator_bytes": 2384, "responder_bytes": 5135 }, { "flow_id": "flow-b012032637ea9aa9d87d1666", "transport": "tcp", "stream": 103, "initiator_ip": "10.8.15.133", "initiator_port": 49776, "responder_ip": "23.220.103.8", "responder_port": 443, "first_frame": 4836, "last_frame": 6162, "first_seen_epoch": "1723680649.710332", "last_seen_epoch": "1723680653.851501", "packets": 19, "bytes": 7379, "initiator_bytes": 2298, "responder_bytes": 5081 }, { "flow_id": "flow-3bf111782cfad83737f226fe", "transport": "tcp", "stream": 104, "initiator_ip": "10.8.15.133", "initiator_port": 49777, "responder_ip": "204.79.197.219", "responder_port": 443, "first_frame": 4845, "last_frame": 6156, "first_seen_epoch": "1723680649.711399", "last_seen_epoch": "1723680653.836153", "packets": 24, "bytes": 10289, "initiator_bytes": 2924, "responder_bytes": 7365 }, { "flow_id": "flow-29200f5e3fcdcff494db6ab0", "transport": "udp", "stream": 43, "initiator_ip": "10.8.15.133", "initiator_port": 53, "responder_ip": "10.8.15.4", "responder_port": 57244, "first_frame": 5164, "last_frame": 5164, "first_seen_epoch": "1723680650.180626", "last_seen_epoch": "1723680650.180626", "packets": 1, "bytes": 158, "initiator_bytes": 158, "responder_bytes": 0 }, { "flow_id": "flow-928feea383fe4bf80ad56e1e", "transport": "udp", "stream": 75, "initiator_ip": "10.8.15.133", "initiator_port": 51888, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 5420, "last_frame": 5450, "first_seen_epoch": "1723680650.426947", "last_seen_epoch": "1723680650.492145", "packets": 2, "bytes": 276, "initiator_bytes": 87, "responder_bytes": 189 }, { "flow_id": "flow-dbefeaf5fc7687dcad3ae5e9", "transport": "udp", "stream": 76, "initiator_ip": "10.8.15.133", "initiator_port": 63681, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 5421, "last_frame": 5423, "first_seen_epoch": "1723680650.427087", "last_seen_epoch": "1723680650.427346", "packets": 2, "bytes": 324, "initiator_bytes": 87, "responder_bytes": 237 }, { "flow_id": "flow-aa6e60fdefb5cc91b49dcdf0", "transport": "tcp", "stream": 105, "initiator_ip": "10.8.15.133", "initiator_port": 49778, "responder_ip": "23.43.244.167", "responder_port": 443, "first_frame": 5451, "last_frame": 6154, "first_seen_epoch": "1723680650.494501", "last_seen_epoch": "1723680653.83592", "packets": 160, "bytes": 152645, "initiator_bytes": 5035, "responder_bytes": 147610 }, { "flow_id": "flow-ffcfcc913406a27f01126533", "transport": "udp", "stream": 77, "initiator_ip": "10.8.15.133", "initiator_port": 64767, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 6200, "last_frame": 6408, "first_seen_epoch": "1723680655.252841", "last_seen_epoch": "1723680658.486173", "packets": 2, "bytes": 198, "initiator_bytes": 83, "responder_bytes": 115 }, { "flow_id": "flow-55f376d5e4f5a4d62c7b0a73", "transport": "udp", "stream": 78, "initiator_ip": "10.8.15.133", "initiator_port": 52997, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 6201, "last_frame": 6413, "first_seen_epoch": "1723680655.253474", "last_seen_epoch": "1723680658.527356", "packets": 2, "bytes": 239, "initiator_bytes": 83, "responder_bytes": 156 }, { "flow_id": "flow-9abc14a7b3f6d4a9632964ba", "transport": "udp", "stream": 79, "initiator_ip": "10.8.15.133", "initiator_port": 60250, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 6202, "last_frame": 6404, "first_seen_epoch": "1723680655.259919", "last_seen_epoch": "1723680658.485902", "packets": 2, "bytes": 198, "initiator_bytes": 83, "responder_bytes": 115 }, { "flow_id": "flow-c1d8175f32954b71874aefa4", "transport": "tcp", "stream": 106, "initiator_ip": "10.8.15.133", "initiator_port": 49779, "responder_ip": "20.42.72.131", "responder_port": 443, "first_frame": 6203, "last_frame": 6354, "first_seen_epoch": "1723680655.346771", "last_seen_epoch": "1723680656.417288", "packets": 3, "bytes": 178, "initiator_bytes": 120, "responder_bytes": 58 }, { "flow_id": "flow-3012018ca1a8046f181d76fe", "transport": "tcp", "stream": 107, "initiator_ip": "10.8.15.133", "initiator_port": 49780, "responder_ip": "20.42.72.131", "responder_port": 443, "first_frame": 6204, "last_frame": 6370, "first_seen_epoch": "1723680655.607868", "last_seen_epoch": "1723680656.684103", "packets": 3, "bytes": 178, "initiator_bytes": 120, "responder_bytes": 58 }, { "flow_id": "flow-a018f8505ab9ddc95af2e6c7", "transport": "tcp", "stream": 108, "initiator_ip": "10.8.15.133", "initiator_port": 49781, "responder_ip": "20.42.72.131", "responder_port": 443, "first_frame": 6207, "last_frame": 11899, "first_seen_epoch": "1723680655.6541", "last_seen_epoch": "1723680802.427005", "packets": 181, "bytes": 100628, "initiator_bytes": 85581, "responder_bytes": 15047 }, { "flow_id": "flow-482c70c53890add153a189b1", "transport": "tcp", "stream": 109, "initiator_ip": "10.8.15.133", "initiator_port": 49782, "responder_ip": "20.42.72.131", "responder_port": 443, "first_frame": 6224, "last_frame": 11024, "first_seen_epoch": "1723680655.982306", "last_seen_epoch": "1723680777.543586", "packets": 25, "bytes": 10549, "initiator_bytes": 3138, "responder_bytes": 7411 }, { "flow_id": "flow-145231a3a9d442980da90ca8", "transport": "udp", "stream": 80, "initiator_ip": "10.8.15.133", "initiator_port": 64608, "responder_ip": "23.220.103.18", "responder_port": 443, "first_frame": 6286, "last_frame": 8700, "first_seen_epoch": "1723680656.179263", "last_seen_epoch": "1723680665.44441", "packets": 49, "bytes": 16588, "initiator_bytes": 7095, "responder_bytes": 9493 }, { "flow_id": "flow-51a1edf8b78a87c20067571e", "transport": "tcp", "stream": 110, "initiator_ip": "10.8.15.133", "initiator_port": 49783, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 6288, "last_frame": 11511, "first_seen_epoch": "1723680656.179592", "last_seen_epoch": "1723680790.958033", "packets": 36, "bytes": 13123, "initiator_bytes": 4813, "responder_bytes": 8310 }, { "flow_id": "flow-fd98858cadca090aa302c2ac", "transport": "udp", "stream": 81, "initiator_ip": "10.8.15.133", "initiator_port": 54240, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 6317, "last_frame": 6405, "first_seen_epoch": "1723680656.2642", "last_seen_epoch": "1723680658.485954", "packets": 2, "bytes": 198, "initiator_bytes": 83, "responder_bytes": 115 }, { "flow_id": "flow-86db30777594d9b64714502e", "transport": "udp", "stream": 82, "initiator_ip": "10.8.15.133", "initiator_port": 56993, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 6318, "last_frame": 6412, "first_seen_epoch": "1723680656.264628", "last_seen_epoch": "1723680658.527301", "packets": 2, "bytes": 239, "initiator_bytes": 83, "responder_bytes": 156 }, { "flow_id": "flow-ae312d5b0a231f8b1e5257e9", "transport": "udp", "stream": 83, "initiator_ip": "10.8.15.133", "initiator_port": 65030, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 6319, "last_frame": 6406, "first_seen_epoch": "1723680656.280145", "last_seen_epoch": "1723680658.486039", "packets": 2, "bytes": 198, "initiator_bytes": 83, "responder_bytes": 115 }, { "flow_id": "flow-179b4843f6ea5ae991f99185", "transport": "udp", "stream": 84, "initiator_ip": "10.8.15.133", "initiator_port": 62933, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 6371, "last_frame": 6373, "first_seen_epoch": "1723680657.268388", "last_seen_epoch": "1723680657.315924", "packets": 2, "bytes": 314, "initiator_bytes": 94, "responder_bytes": 220 }, { "flow_id": "flow-e93e50c3ed652ec6e87780f2", "transport": "udp", "stream": 85, "initiator_ip": "10.8.15.133", "initiator_port": 58166, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 6372, "last_frame": 6374, "first_seen_epoch": "1723680657.268615", "last_seen_epoch": "1723680657.315929", "packets": 2, "bytes": 298, "initiator_bytes": 94, "responder_bytes": 204 }, { "flow_id": "flow-04ba0e07fb5adb5ad4a3c1d9", "transport": "tcp", "stream": 111, "initiator_ip": "10.8.15.133", "initiator_port": 49784, "responder_ip": "20.25.227.174", "responder_port": 443, "first_frame": 6375, "last_frame": 12056, "first_seen_epoch": "1723680657.317044", "last_seen_epoch": "1723680843.262272", "packets": 51, "bytes": 18908, "initiator_bytes": 7475, "responder_bytes": 11433 }, { "flow_id": "flow-a5f528bd50b0f47d585772e2", "transport": "udp", "stream": 79, "initiator_ip": "10.8.15.133", "initiator_port": 53, "responder_ip": "10.8.15.4", "responder_port": 60250, "first_frame": 6409, "last_frame": 6409, "first_seen_epoch": "1723680658.486185", "last_seen_epoch": "1723680658.486185", "packets": 1, "bytes": 143, "initiator_bytes": 143, "responder_bytes": 0 }, { "flow_id": "flow-37e49ca06c9ebdcd4fc369e5", "transport": "tcp", "stream": 112, "initiator_ip": "10.8.15.133", "initiator_port": 49785, "responder_ip": "104.21.55.70", "responder_port": 80, "first_frame": 6410, "last_frame": 18110, "first_seen_epoch": "1723680658.488114", "last_seen_epoch": "1723682509.723977", "packets": 2268, "bytes": 2892579, "initiator_bytes": 14594, "responder_bytes": 2877985 }, { "flow_id": "flow-d02b882db12baf7916e04389", "transport": "tcp", "stream": 113, "initiator_ip": "10.8.15.133", "initiator_port": 49786, "responder_ip": "104.21.55.70", "responder_port": 80, "first_frame": 6411, "last_frame": 8917, "first_seen_epoch": "1723680658.488764", "last_seen_epoch": "1723680681.045487", "packets": 7, "bytes": 394, "initiator_bytes": 228, "responder_bytes": 166 }, { "flow_id": "flow-efcbdc6cb91f09536bc0a298", "transport": "udp", "stream": 86, "initiator_ip": "10.8.15.133", "initiator_port": 51132, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 6474, "last_frame": 6476, "first_seen_epoch": "1723680663.071843", "last_seen_epoch": "1723680663.104422", "packets": 2, "bytes": 312, "initiator_bytes": 93, "responder_bytes": 219 }, { "flow_id": "flow-c48b21309230ab27f02b3e79", "transport": "udp", "stream": 87, "initiator_ip": "10.8.15.133", "initiator_port": 55308, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 6475, "last_frame": 6477, "first_seen_epoch": "1723680663.072024", "last_seen_epoch": "1723680663.113141", "packets": 2, "bytes": 356, "initiator_bytes": 93, "responder_bytes": 263 }, { "flow_id": "flow-84a3852339fbc3f65ec747f4", "transport": "udp", "stream": 88, "initiator_ip": "10.8.15.133", "initiator_port": 54413, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 8661, "last_frame": 8902, "first_seen_epoch": "1723680664.215425", "last_seen_epoch": "1723680680.283981", "packets": 2, "bytes": 188, "initiator_bytes": 94, "responder_bytes": 94 }, { "flow_id": "flow-d245b02b04c1d96f14d471a9", "transport": "udp", "stream": 89, "initiator_ip": "10.8.15.133", "initiator_port": 58784, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 8662, "last_frame": 8898, "first_seen_epoch": "1723680664.215734", "last_seen_epoch": "1723680680.276879", "packets": 2, "bytes": 188, "initiator_bytes": 94, "responder_bytes": 94 }, { "flow_id": "flow-e1773cffa1688c6a4943b54f", "transport": "udp", "stream": 90, "initiator_ip": "10.8.15.133", "initiator_port": 59180, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 8682, "last_frame": 8900, "first_seen_epoch": "1723680665.231999", "last_seen_epoch": "1723680680.283851", "packets": 2, "bytes": 188, "initiator_bytes": 94, "responder_bytes": 94 }, { "flow_id": "flow-ca00838ac8509021b04d34d5", "transport": "udp", "stream": 91, "initiator_ip": "10.8.15.133", "initiator_port": 55746, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 8683, "last_frame": 8897, "first_seen_epoch": "1723680665.233026", "last_seen_epoch": "1723680680.276752", "packets": 2, "bytes": 188, "initiator_bytes": 94, "responder_bytes": 94 }, { "flow_id": "flow-010ac6bcafde4d410746cec0", "transport": "tcp", "stream": 114, "initiator_ip": "10.8.15.133", "initiator_port": 49787, "responder_ip": "104.40.82.182", "responder_port": 443, "first_frame": 8720, "last_frame": 12083, "first_seen_epoch": "1723680668.317351", "last_seen_epoch": "1723680848.840504", "packets": 40, "bytes": 14582, "initiator_bytes": 5161, "responder_bytes": 9421 }, { "flow_id": "flow-98a7e64f17c644aacccf87d4", "transport": "udp", "stream": 92, "initiator_ip": "10.8.15.133", "initiator_port": 50199, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 8753, "last_frame": 8754, "first_seen_epoch": "1723680669.03881", "last_seen_epoch": "1723680669.039135", "packets": 2, "bytes": 521, "initiator_bytes": 273, "responder_bytes": 248 }, { "flow_id": "flow-8a04368a3e907255ff3f0b84", "transport": "tcp", "stream": 115, "initiator_ip": "10.8.15.133", "initiator_port": 49788, "responder_ip": "10.8.15.4", "responder_port": 135, "first_frame": 8755, "last_frame": 8824, "first_seen_epoch": "1723680669.16177", "last_seen_epoch": "1723680669.188646", "packets": 10, "bytes": 1704, "initiator_bytes": 832, "responder_bytes": 872 }, { "flow_id": "flow-e7a24bfcbf4fd1b407e9d641", "transport": "tcp", "stream": 116, "initiator_ip": "10.8.15.133", "initiator_port": 49789, "responder_ip": "10.8.15.4", "responder_port": 49669, "first_frame": 8762, "last_frame": 8825, "first_seen_epoch": "1723680669.165795", "last_seen_epoch": "1723680669.188801", "packets": 22, "bytes": 6885, "initiator_bytes": 4464, "responder_bytes": 2421 }, { "flow_id": "flow-53045d5e3a03ebb85a2c5d38", "transport": "tcp", "stream": 117, "initiator_ip": "10.8.15.133", "initiator_port": 49790, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 8785, "last_frame": 8823, "first_seen_epoch": "1723680669.176317", "last_seen_epoch": "1723680669.186286", "packets": 21, "bytes": 7932, "initiator_bytes": 3739, "responder_bytes": 4193 }, { "flow_id": "flow-d3f013afdf14382942e0676f", "transport": "tcp", "stream": 118, "initiator_ip": "10.8.15.133", "initiator_port": 49791, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 8802, "last_frame": 8819, "first_seen_epoch": "1723680669.181954", "last_seen_epoch": "1723680669.185749", "packets": 18, "bytes": 7276, "initiator_bytes": 3103, "responder_bytes": 4173 }, { "flow_id": "flow-3bd4cdcafc091a566f371fb6", "transport": "tcp", "stream": 119, "initiator_ip": "10.8.15.133", "initiator_port": 49792, "responder_ip": "20.10.31.115", "responder_port": 443, "first_frame": 8826, "last_frame": 17606, "first_seen_epoch": "1723680670.245038", "last_seen_epoch": "1723682302.751991", "packets": 46, "bytes": 9484, "initiator_bytes": 3382, "responder_bytes": 6102 }, { "flow_id": "flow-016804b377aaa35b7e0390e8", "transport": "tcp", "stream": 120, "initiator_ip": "10.8.15.133", "initiator_port": 49793, "responder_ip": "204.79.197.239", "responder_port": 443, "first_frame": 8892, "last_frame": 11970, "first_seen_epoch": "1723680678.690237", "last_seen_epoch": "1723680804.838212", "packets": 24, "bytes": 9872, "initiator_bytes": 2912, "responder_bytes": 6960 }, { "flow_id": "flow-e14285385f1e90ac331c7e26", "transport": "tcp", "stream": 121, "initiator_ip": "10.8.15.133", "initiator_port": 49794, "responder_ip": "204.79.197.239", "responder_port": 443, "first_frame": 8893, "last_frame": 12068, "first_seen_epoch": "1723680678.951859", "last_seen_epoch": "1723680844.202403", "packets": 75, "bytes": 33362, "initiator_bytes": 21670, "responder_bytes": 11692 }, { "flow_id": "flow-3f6c512da2ae3971cbb5ebcc", "transport": "udp", "stream": 91, "initiator_ip": "10.8.15.133", "initiator_port": 53, "responder_ip": "10.8.15.4", "responder_port": 55746, "first_frame": 8899, "last_frame": 8899, "first_seen_epoch": "1723680680.276913", "last_seen_epoch": "1723680680.276913", "packets": 1, "bytes": 122, "initiator_bytes": 122, "responder_bytes": 0 }, { "flow_id": "flow-46ab9303de86da029b1f741d", "transport": "udp", "stream": 93, "initiator_ip": "10.8.15.133", "initiator_port": 58984, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 8906, "last_frame": 8910, "first_seen_epoch": "1723680680.969233", "last_seen_epoch": "1723680681.044086", "packets": 2, "bytes": 265, "initiator_bytes": 79, "responder_bytes": 186 }, { "flow_id": "flow-4d731baab0828f6d4c440136", "transport": "udp", "stream": 94, "initiator_ip": "10.8.15.133", "initiator_port": 64584, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 8907, "last_frame": 8908, "first_seen_epoch": "1723680680.969419", "last_seen_epoch": "1723680681.020509", "packets": 2, "bytes": 233, "initiator_bytes": 79, "responder_bytes": 154 }, { "flow_id": "flow-9a266620d6aa6ea0eea9057f", "transport": "tcp", "stream": 122, "initiator_ip": "10.8.15.133", "initiator_port": 49795, "responder_ip": "23.215.55.139", "responder_port": 443, "first_frame": 8918, "last_frame": 18157, "first_seen_epoch": "1723680681.045759", "last_seen_epoch": "1723682532.036668", "packets": 105, "bytes": 14478, "initiator_bytes": 6436, "responder_bytes": 8042 }, { "flow_id": "flow-9e96737f08add65c6823063e", "transport": "udp", "stream": 95, "initiator_ip": "10.8.15.133", "initiator_port": 64586, "responder_ip": "239.255.255.250", "responder_port": 1900, "first_frame": 8977, "last_frame": 15244, "first_seen_epoch": "1723680681.507171", "last_seen_epoch": "1723681302.037079", "packets": 14, "bytes": 2506, "initiator_bytes": 2506, "responder_bytes": 0 }, { "flow_id": "flow-3bafb030c062f95a4540291e", "transport": "tcp", "stream": 123, "initiator_ip": "10.8.15.133", "initiator_port": 49798, "responder_ip": "23.53.13.196", "responder_port": 443, "first_frame": 9003, "last_frame": 12022, "first_seen_epoch": "1723680682.290124", "last_seen_epoch": "1723680829.361426", "packets": 27, "bytes": 12940, "initiator_bytes": 1329, "responder_bytes": 11611 }, { "flow_id": "flow-cd7cb61cd2050a64723d440c", "transport": "tcp", "stream": 124, "initiator_ip": "10.8.15.133", "initiator_port": 49800, "responder_ip": "172.67.170.159", "responder_port": 443, "first_frame": 9028, "last_frame": 10583, "first_seen_epoch": "1723680684.029806", "last_seen_epoch": "1723680712.474421", "packets": 1143, "bytes": 1479592, "initiator_bytes": 7250, "responder_bytes": 1472342 }, { "flow_id": "flow-9ce959cc823a78957955869e", "transport": "tcp", "stream": 125, "initiator_ip": "10.8.15.133", "initiator_port": 49801, "responder_ip": "10.8.15.4", "responder_port": 135, "first_frame": 10173, "last_frame": 10260, "first_seen_epoch": "1723680685.647949", "last_seen_epoch": "1723680696.284096", "packets": 12, "bytes": 1376, "initiator_bytes": 718, "responder_bytes": 658 }, { "flow_id": "flow-cd0c0eb77c57e3a4a636bc0b", "transport": "tcp", "stream": 126, "initiator_ip": "10.8.15.133", "initiator_port": 49802, "responder_ip": "10.8.15.4", "responder_port": 49669, "first_frame": 10180, "last_frame": 10259, "first_seen_epoch": "1723680685.650047", "last_seen_epoch": "1723680696.284064", "packets": 16, "bytes": 2404, "initiator_bytes": 1442, "responder_bytes": 962 }, { "flow_id": "flow-7737af59366dda0ecf2cf18f", "transport": "tcp", "stream": 127, "initiator_ip": "10.8.15.133", "initiator_port": 49803, "responder_ip": "199.232.210.172", "responder_port": 80, "first_frame": 10195, "last_frame": 11681, "first_seen_epoch": "1723680685.765693", "last_seen_epoch": "1723680795.76507", "packets": 210, "bytes": 208191, "initiator_bytes": 6963, "responder_bytes": 201228 }, { "flow_id": "flow-88fcc3ab8a06087dd00d1424", "transport": "udp", "stream": 96, "initiator_ip": "10.8.15.133", "initiator_port": 62859, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 10235, "last_frame": 10245, "first_seen_epoch": "1723680693.779007", "last_seen_epoch": "1723680693.831947", "packets": 2, "bytes": 259, "initiator_bytes": 78, "responder_bytes": 181 }, { "flow_id": "flow-427d152d67ed75dd1949dc19", "transport": "udp", "stream": 97, "initiator_ip": "10.8.15.133", "initiator_port": 58738, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 10236, "last_frame": 10247, "first_seen_epoch": "1723680693.779153", "last_seen_epoch": "1723680693.864576", "packets": 2, "bytes": 227, "initiator_bytes": 78, "responder_bytes": 149 }, { "flow_id": "flow-aed4c84f92cdb47162ed429e", "transport": "udp", "stream": 97, "initiator_ip": "10.8.15.133", "initiator_port": 53, "responder_ip": "10.8.15.4", "responder_port": 58738, "first_frame": 10248, "last_frame": 10248, "first_seen_epoch": "1723680693.864899", "last_seen_epoch": "1723680693.864899", "packets": 1, "bytes": 177, "initiator_bytes": 177, "responder_bytes": 0 }, { "flow_id": "flow-e39c29ee4194bd84a4f15d40", "transport": "tcp", "stream": 128, "initiator_ip": "10.8.15.133", "initiator_port": 49804, "responder_ip": "10.8.15.4", "responder_port": 135, "first_frame": 10308, "last_frame": 10403, "first_seen_epoch": "1723680707.864685", "last_seen_epoch": "1723680708.610313", "packets": 11, "bytes": 1758, "initiator_bytes": 886, "responder_bytes": 872 }, { "flow_id": "flow-91479094b5971c1476dcde3d", "transport": "tcp", "stream": 129, "initiator_ip": "10.8.15.133", "initiator_port": 49805, "responder_ip": "10.8.15.4", "responder_port": 49669, "first_frame": 10315, "last_frame": 10404, "first_seen_epoch": "1723680707.868095", "last_seen_epoch": "1723680708.610524", "packets": 23, "bytes": 6873, "initiator_bytes": 4452, "responder_bytes": 2421 }, { "flow_id": "flow-44d7ee5b1a32d1c9fde5011f", "transport": "tcp", "stream": 130, "initiator_ip": "10.8.15.133", "initiator_port": 49806, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 10338, "last_frame": 10376, "first_seen_epoch": "1723680707.877542", "last_seen_epoch": "1723680707.887175", "packets": 21, "bytes": 7866, "initiator_bytes": 3673, "responder_bytes": 4193 }, { "flow_id": "flow-01e318bf6c97e563ef41514c", "transport": "tcp", "stream": 131, "initiator_ip": "10.8.15.133", "initiator_port": 49807, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 10355, "last_frame": 10372, "first_seen_epoch": "1723680707.883342", "last_seen_epoch": "1723680707.886801", "packets": 18, "bytes": 7210, "initiator_bytes": 3037, "responder_bytes": 4173 }, { "flow_id": "flow-4457b4bc76864edf9d36bffd", "transport": "tcp", "stream": 132, "initiator_ip": "10.8.15.133", "initiator_port": 49808, "responder_ip": "40.126.29.5", "responder_port": 443, "first_frame": 10381, "last_frame": 10405, "first_seen_epoch": "1723680708.002964", "last_seen_epoch": "1723680708.64483", "packets": 22, "bytes": 8068, "initiator_bytes": 1947, "responder_bytes": 6121 }, { "flow_id": "flow-ce996abf22fed7b2587821b5", "transport": "tcp", "stream": 133, "initiator_ip": "10.8.15.133", "initiator_port": 49809, "responder_ip": "52.137.106.217", "responder_port": 443, "first_frame": 10410, "last_frame": 10453, "first_seen_epoch": "1723680708.901467", "last_seen_epoch": "1723680709.400049", "packets": 27, "bytes": 7017, "initiator_bytes": 1889, "responder_bytes": 5128 }, { "flow_id": "flow-f892d0a2e64d4944eb892ed8", "transport": "tcp", "stream": 134, "initiator_ip": "10.8.15.133", "initiator_port": 49810, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 10598, "last_frame": 11683, "first_seen_epoch": "1723680718.562192", "last_seen_epoch": "1723680795.91331", "packets": 161, "bytes": 168498, "initiator_bytes": 2415, "responder_bytes": 166083 }, { "flow_id": "flow-6ea169045fadcd4cb0c9ac12", "transport": "tcp", "stream": 135, "initiator_ip": "10.8.15.133", "initiator_port": 49811, "responder_ip": "10.8.15.4", "responder_port": 135, "first_frame": 10776, "last_frame": 10871, "first_seen_epoch": "1723680726.264525", "last_seen_epoch": "1723680726.772649", "packets": 11, "bytes": 1758, "initiator_bytes": 886, "responder_bytes": 872 }, { "flow_id": "flow-d0d3daa34b0f5fd3f1d7d275", "transport": "tcp", "stream": 136, "initiator_ip": "10.8.15.133", "initiator_port": 49812, "responder_ip": "10.8.15.4", "responder_port": 49669, "first_frame": 10783, "last_frame": 10872, "first_seen_epoch": "1723680726.267923", "last_seen_epoch": "1723680726.77281", "packets": 23, "bytes": 6873, "initiator_bytes": 4452, "responder_bytes": 2421 }, { "flow_id": "flow-679956152db70f74ecbef6f1", "transport": "tcp", "stream": 137, "initiator_ip": "10.8.15.133", "initiator_port": 49813, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 10806, "last_frame": 10844, "first_seen_epoch": "1723680726.277506", "last_seen_epoch": "1723680726.287549", "packets": 21, "bytes": 7866, "initiator_bytes": 3673, "responder_bytes": 4193 }, { "flow_id": "flow-5689c3b070608c98ea7bb51f", "transport": "tcp", "stream": 138, "initiator_ip": "10.8.15.133", "initiator_port": 49814, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 10823, "last_frame": 10840, "first_seen_epoch": "1723680726.283314", "last_seen_epoch": "1723680726.287113", "packets": 18, "bytes": 7210, "initiator_bytes": 3037, "responder_bytes": 4173 }, { "flow_id": "flow-2d71ca4d7a0c84a766c98846", "transport": "tcp", "stream": 139, "initiator_ip": "10.8.15.133", "initiator_port": 49815, "responder_ip": "40.126.29.5", "responder_port": 443, "first_frame": 10845, "last_frame": 10873, "first_seen_epoch": "1723680726.314684", "last_seen_epoch": "1723680726.773281", "packets": 24, "bytes": 8176, "initiator_bytes": 2001, "responder_bytes": 6175 }, { "flow_id": "flow-6d248f0e477581379e3d1da1", "transport": "udp", "stream": 98, "initiator_ip": "10.8.15.133", "initiator_port": 53567, "responder_ip": "239.255.255.250", "responder_port": 1900, "first_frame": 10886, "last_frame": 10893, "first_seen_epoch": "1723680738.774571", "last_seen_epoch": "1723680741.801367", "packets": 4, "bytes": 868, "initiator_bytes": 868, "responder_bytes": 0 }, { "flow_id": "flow-b2617731868cc7a5a2cd317b", "transport": "tcp", "stream": 140, "initiator_ip": "10.8.15.133", "initiator_port": 49816, "responder_ip": "52.182.143.215", "responder_port": 443, "first_frame": 10906, "last_frame": 11006, "first_seen_epoch": "1723680753.043817", "last_seen_epoch": "1723680754.598896", "packets": 62, "bytes": 24427, "initiator_bytes": 17491, "responder_bytes": 6936 }, { "flow_id": "flow-c24d481dcfbd5d4b335f595d", "transport": "tcp", "stream": 141, "initiator_ip": "10.8.15.133", "initiator_port": 49817, "responder_ip": "52.182.143.215", "responder_port": 443, "first_frame": 10940, "last_frame": 11008, "first_seen_epoch": "1723680753.426173", "last_seen_epoch": "1723680754.609827", "packets": 35, "bytes": 11460, "initiator_bytes": 5750, "responder_bytes": 5710 }, { "flow_id": "flow-77f643bdcd4fe4cbf734d4b9", "transport": "tcp", "stream": 142, "initiator_ip": "10.8.15.133", "initiator_port": 49818, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 11025, "last_frame": 11037, "first_seen_epoch": "1723680780.479931", "last_seen_epoch": "1723680781.054397", "packets": 13, "bytes": 2138, "initiator_bytes": 1434, "responder_bytes": 704 }, { "flow_id": "flow-a062792283a27d7872b25997", "transport": "tcp", "stream": 143, "initiator_ip": "10.8.15.133", "initiator_port": 49819, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 11038, "last_frame": 11490, "first_seen_epoch": "1723680781.14969", "last_seen_epoch": "1723680782.678259", "packets": 453, "bytes": 330323, "initiator_bytes": 317298, "responder_bytes": 13025 }, { "flow_id": "flow-3c66561c9692f93180363a65", "transport": "tcp", "stream": 144, "initiator_ip": "10.8.15.133", "initiator_port": 49820, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 11491, "last_frame": 11501, "first_seen_epoch": "1723680782.67949", "last_seen_epoch": "1723680783.234556", "packets": 11, "bytes": 2036, "initiator_bytes": 1539, "responder_bytes": 497 }, { "flow_id": "flow-27c88302da4f213f4d53336d", "transport": "tcp", "stream": 145, "initiator_ip": "10.8.15.133", "initiator_port": 49821, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 11502, "last_frame": 11510, "first_seen_epoch": "1723680787.803718", "last_seen_epoch": "1723680788.20387", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-89e01460cf6be96e3628064a", "transport": "tcp", "stream": 146, "initiator_ip": "10.8.15.133", "initiator_port": 49822, "responder_ip": "10.8.15.4", "responder_port": 135, "first_frame": 11526, "last_frame": 11627, "first_seen_epoch": "1723680793.565777", "last_seen_epoch": "1723680794.18532", "packets": 11, "bytes": 1758, "initiator_bytes": 886, "responder_bytes": 872 }, { "flow_id": "flow-4c16e17858e5c6bd0bde53cf", "transport": "tcp", "stream": 147, "initiator_ip": "10.8.15.133", "initiator_port": 49823, "responder_ip": "10.8.15.4", "responder_port": 49669, "first_frame": 11533, "last_frame": 11628, "first_seen_epoch": "1723680793.571456", "last_seen_epoch": "1723680794.185604", "packets": 23, "bytes": 6873, "initiator_bytes": 4452, "responder_bytes": 2421 }, { "flow_id": "flow-009b4477ae13cae947e72daf", "transport": "tcp", "stream": 148, "initiator_ip": "10.8.15.133", "initiator_port": 49824, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 11556, "last_frame": 11592, "first_seen_epoch": "1723680793.581393", "last_seen_epoch": "1723680793.592223", "packets": 19, "bytes": 7758, "initiator_bytes": 3619, "responder_bytes": 4139 }, { "flow_id": "flow-a2107fb3bb52ab07895026c4", "transport": "tcp", "stream": 149, "initiator_ip": "10.8.15.133", "initiator_port": 49825, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 11573, "last_frame": 11590, "first_seen_epoch": "1723680793.588299", "last_seen_epoch": "1723680793.59206", "packets": 18, "bytes": 7210, "initiator_bytes": 3037, "responder_bytes": 4173 }, { "flow_id": "flow-99d16d0c6a14d2cf10c3c4c8", "transport": "tcp", "stream": 150, "initiator_ip": "10.8.15.133", "initiator_port": 49826, "responder_ip": "40.126.29.5", "responder_port": 443, "first_frame": 11593, "last_frame": 11629, "first_seen_epoch": "1723680793.6291", "last_seen_epoch": "1723680794.186598", "packets": 24, "bytes": 8176, "initiator_bytes": 2001, "responder_bytes": 6175 }, { "flow_id": "flow-88a7fe935a2f46d04475f440", "transport": "tcp", "stream": 151, "initiator_ip": "10.8.15.133", "initiator_port": 49827, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 11596, "last_frame": 11624, "first_seen_epoch": "1723680793.646964", "last_seen_epoch": "1723680794.044371", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-de14ecfdc168af96fc83e5e6", "transport": "tcp", "stream": 152, "initiator_ip": "10.8.15.133", "initiator_port": 49828, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 11634, "last_frame": 11662, "first_seen_epoch": "1723680795.691749", "last_seen_epoch": "1723680795.706546", "packets": 17, "bytes": 6751, "initiator_bytes": 3074, "responder_bytes": 3677 }, { "flow_id": "flow-1b5dc517cd2882be82984345", "transport": "tcp", "stream": 153, "initiator_ip": "10.8.15.133", "initiator_port": 49829, "responder_ip": "10.8.15.4", "responder_port": 88, "first_frame": 11641, "last_frame": 11652, "first_seen_epoch": "1723680795.694434", "last_seen_epoch": "1723680795.696245", "packets": 12, "bytes": 4273, "initiator_bytes": 2150, "responder_bytes": 2123 }, { "flow_id": "flow-adc2af05772089960bbcee33", "transport": "tcp", "stream": 154, "initiator_ip": "10.8.15.133", "initiator_port": 49830, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 11667, "last_frame": 11679, "first_seen_epoch": "1723680795.727414", "last_seen_epoch": "1723680795.730522", "packets": 13, "bytes": 3343, "initiator_bytes": 2615, "responder_bytes": 728 }, { "flow_id": "flow-9e48902f3a6cdda83059aaeb", "transport": "tcp", "stream": 155, "initiator_ip": "10.8.15.133", "initiator_port": 49831, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 11685, "last_frame": 11695, "first_seen_epoch": "1723680797.131139", "last_seen_epoch": "1723680797.504003", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-eea66f25e27fee3a90053b3a", "transport": "udp", "stream": 99, "initiator_ip": "10.8.15.133", "initiator_port": 56929, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 11691, "last_frame": 12261, "first_seen_epoch": "1723680797.495755", "last_seen_epoch": "1723680909.294038", "packets": 15, "bytes": 1887, "initiator_bytes": 671, "responder_bytes": 1216 }, { "flow_id": "flow-d63cf1a5db7f5d656d2ff962", "transport": "tcp", "stream": 156, "initiator_ip": "10.8.15.133", "initiator_port": 49832, "responder_ip": "52.123.128.254", "responder_port": 443, "first_frame": 11697, "last_frame": 13605, "first_seen_epoch": "1723680797.540735", "last_seen_epoch": "1723680922.543015", "packets": 35, "bytes": 10828, "initiator_bytes": 2101, "responder_bytes": 8727 }, { "flow_id": "flow-3c324c31c611f14ab6db023f", "transport": "tcp", "stream": 157, "initiator_ip": "10.8.15.133", "initiator_port": 49833, "responder_ip": "23.53.13.205", "responder_port": 443, "first_frame": 11733, "last_frame": 13596, "first_seen_epoch": "1723680797.802049", "last_seen_epoch": "1723680918.235287", "packets": 32, "bytes": 9877, "initiator_bytes": 1741, "responder_bytes": 8136 }, { "flow_id": "flow-8b7990860f8407559f8cbd57", "transport": "tcp", "stream": 158, "initiator_ip": "10.8.15.133", "initiator_port": 49834, "responder_ip": "13.107.4.254", "responder_port": 443, "first_frame": 11767, "last_frame": 13611, "first_seen_epoch": "1723680798.272128", "last_seen_epoch": "1723680925.819115", "packets": 34, "bytes": 10480, "initiator_bytes": 2087, "responder_bytes": 8393 }, { "flow_id": "flow-2f8836c6335914648a0b6e5e", "transport": "tcp", "stream": 159, "initiator_ip": "10.8.15.133", "initiator_port": 49835, "responder_ip": "204.79.197.222", "responder_port": 443, "first_frame": 11803, "last_frame": 13612, "first_seen_epoch": "1723680798.728173", "last_seen_epoch": "1723680927.150563", "packets": 36, "bytes": 10796, "initiator_bytes": 2618, "responder_bytes": 8178 }, { "flow_id": "flow-c0fb2681a85fdefe2c5bd01f", "transport": "tcp", "stream": 160, "initiator_ip": "10.8.15.133", "initiator_port": 49836, "responder_ip": "23.220.103.18", "responder_port": 443, "first_frame": 11841, "last_frame": 13616, "first_seen_epoch": "1723680800.465147", "last_seen_epoch": "1723680934.623789", "packets": 35, "bytes": 8940, "initiator_bytes": 6610, "responder_bytes": 2330 }, { "flow_id": "flow-997775cb94cb4a71435ea074", "transport": "tcp", "stream": 161, "initiator_ip": "10.8.15.133", "initiator_port": 49837, "responder_ip": "23.96.180.189", "responder_port": 443, "first_frame": 11867, "last_frame": 12008, "first_seen_epoch": "1723680800.900999", "last_seen_epoch": "1723680824.296041", "packets": 29, "bytes": 10565, "initiator_bytes": 2876, "responder_bytes": 7689 }, { "flow_id": "flow-c96d84feff609f4797f54742", "transport": "udp", "stream": 100, "initiator_ip": "10.8.15.133", "initiator_port": 51799, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 11901, "last_frame": 13850, "first_seen_epoch": "1723680802.768051", "last_seen_epoch": "1723680988.363063", "packets": 23, "bytes": 3375, "initiator_bytes": 1117, "responder_bytes": 2258 }, { "flow_id": "flow-468f622d3ae752979d174856", "transport": "tcp", "stream": 162, "initiator_ip": "10.8.15.133", "initiator_port": 49838, "responder_ip": "23.195.200.230", "responder_port": 443, "first_frame": 11903, "last_frame": 12006, "first_seen_epoch": "1723680802.829361", "last_seen_epoch": "1723680824.294857", "packets": 27, "bytes": 8858, "initiator_bytes": 1309, "responder_bytes": 7549 }, { "flow_id": "flow-e7b535bca94c1978c3d4cfbd", "transport": "tcp", "stream": 163, "initiator_ip": "10.8.15.133", "initiator_port": 49839, "responder_ip": "23.220.103.72", "responder_port": 443, "first_frame": 11905, "last_frame": 12007, "first_seen_epoch": "1723680802.830484", "last_seen_epoch": "1723680824.295377", "packets": 28, "bytes": 8305, "initiator_bytes": 2215, "responder_bytes": 6090 }, { "flow_id": "flow-b4984c71edcd70d6a2fb992e", "transport": "tcp", "stream": 164, "initiator_ip": "10.8.15.133", "initiator_port": 49840, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 11959, "last_frame": 11967, "first_seen_epoch": "1723680804.05353", "last_seen_epoch": "1723680804.444179", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-f26dfbbfc18eeca892d1c498", "transport": "tcp", "stream": 165, "initiator_ip": "10.8.15.133", "initiator_port": 49841, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 11971, "last_frame": 11979, "first_seen_epoch": "1723680809.757748", "last_seen_epoch": "1723680810.132298", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-456158ecb779501233fa9117", "transport": "tcp", "stream": 166, "initiator_ip": "10.8.15.133", "initiator_port": 49842, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 11990, "last_frame": 12000, "first_seen_epoch": "1723680817.02206", "last_seen_epoch": "1723680817.37528", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-28838f215e5864575674dda4", "transport": "tcp", "stream": 167, "initiator_ip": "10.8.15.133", "initiator_port": 49843, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 12001, "last_frame": 12012, "first_seen_epoch": "1723680823.320346", "last_seen_epoch": "1723680824.316156", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-98a9f2a8fe38e68122526dd7", "transport": "tcp", "stream": 168, "initiator_ip": "10.8.15.133", "initiator_port": 49844, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 12014, "last_frame": 12026, "first_seen_epoch": "1723680829.005989", "last_seen_epoch": "1723680829.379701", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-5e5da78e0954bd84c9430c6e", "transport": "tcp", "stream": 169, "initiator_ip": "10.8.15.133", "initiator_port": 49845, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 12029, "last_frame": 12039, "first_seen_epoch": "1723680835.037997", "last_seen_epoch": "1723680835.403771", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-7aae2007f04493e0754235fb", "transport": "tcp", "stream": 170, "initiator_ip": "10.8.15.133", "initiator_port": 49846, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 12042, "last_frame": 12050, "first_seen_epoch": "1723680838.898474", "last_seen_epoch": "1723680839.279567", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-58bba75202a10192fce4fc96", "transport": "tcp", "stream": 171, "initiator_ip": "10.8.15.133", "initiator_port": 49847, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 12051, "last_frame": 12065, "first_seen_epoch": "1723680842.552863", "last_seen_epoch": "1723680843.963391", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-0b97e05054dc82d1411314d0", "transport": "tcp", "stream": 172, "initiator_ip": "10.8.15.133", "initiator_port": 49848, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 12069, "last_frame": 12077, "first_seen_epoch": "1723680847.818665", "last_seen_epoch": "1723680848.18406", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-15c42fd9cd013267886c0813", "transport": "tcp", "stream": 173, "initiator_ip": "10.8.15.133", "initiator_port": 49849, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 12084, "last_frame": 12092, "first_seen_epoch": "1723680852.162484", "last_seen_epoch": "1723680852.559089", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-294bb4b7bcfdf54c137ff54a", "transport": "tcp", "stream": 174, "initiator_ip": "10.8.15.133", "initiator_port": 49850, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 12093, "last_frame": 12101, "first_seen_epoch": "1723680856.818715", "last_seen_epoch": "1723680857.197817", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-db34be56f4b9ac5f16f1700e", "transport": "tcp", "stream": 175, "initiator_ip": "10.8.15.133", "initiator_port": 49851, "responder_ip": "20.60.228.1", "responder_port": 443, "first_frame": 12104, "last_frame": 13631, "first_seen_epoch": "1723680857.765188", "last_seen_epoch": "1723680969.356211", "packets": 32, "bytes": 13142, "initiator_bytes": 1909, "responder_bytes": 11233 }, { "flow_id": "flow-4210241df1267ff209aefd3b", "transport": "udp", "stream": 101, "initiator_ip": "10.8.15.133", "initiator_port": 51800, "responder_ip": "239.255.255.250", "responder_port": 1900, "first_frame": 12132, "last_frame": 12137, "first_seen_epoch": "1723680858.790096", "last_seen_epoch": "1723680861.818104", "packets": 4, "bytes": 868, "initiator_bytes": 868, "responder_bytes": 0 }, { "flow_id": "flow-31251be56263e17eff9da1d9", "transport": "tcp", "stream": 176, "initiator_ip": "10.8.15.133", "initiator_port": 49852, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 12138, "last_frame": 12150, "first_seen_epoch": "1723680862.005714", "last_seen_epoch": "1723680862.384737", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-c8a2fbade62830d77cbc983d", "transport": "tcp", "stream": 177, "initiator_ip": "10.8.15.133", "initiator_port": 49853, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 12151, "last_frame": 12159, "first_seen_epoch": "1723680868.287593", "last_seen_epoch": "1723680868.674803", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-7b2fc3f06e042607923063f4", "transport": "tcp", "stream": 178, "initiator_ip": "10.8.15.133", "initiator_port": 49854, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 12161, "last_frame": 12169, "first_seen_epoch": "1723680872.662651", "last_seen_epoch": "1723680873.596291", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-60793c4d8d31571a6b1f9138", "transport": "tcp", "stream": 179, "initiator_ip": "10.8.15.133", "initiator_port": 49855, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 12172, "last_frame": 12180, "first_seen_epoch": "1723680878.412747", "last_seen_epoch": "1723680879.330708", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-859d239394ba4da9d6273429", "transport": "tcp", "stream": 180, "initiator_ip": "10.8.15.133", "initiator_port": 49856, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 12181, "last_frame": 12191, "first_seen_epoch": "1723680885.787882", "last_seen_epoch": "1723680886.773701", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-2a704dd02acf5de7edce8958", "transport": "tcp", "stream": 181, "initiator_ip": "10.8.15.133", "initiator_port": 49857, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 12196, "last_frame": 12205, "first_seen_epoch": "1723680892.490997", "last_seen_epoch": "1723680894.536934", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-a976ba050ee0b2205d257b2c", "transport": "udp", "stream": 102, "initiator_ip": "10.8.15.133", "initiator_port": 59670, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 12206, "last_frame": 12210, "first_seen_epoch": "1723680895.679744", "last_seen_epoch": "1723680895.742669", "packets": 2, "bytes": 259, "initiator_bytes": 78, "responder_bytes": 181 }, { "flow_id": "flow-14debe83301cf8dae29b149c", "transport": "udp", "stream": 103, "initiator_ip": "10.8.15.133", "initiator_port": 57799, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 12207, "last_frame": 12212, "first_seen_epoch": "1723680895.680047", "last_seen_epoch": "1723680895.806474", "packets": 2, "bytes": 227, "initiator_bytes": 78, "responder_bytes": 149 }, { "flow_id": "flow-bcc5357468eafe31b136a931", "transport": "tcp", "stream": 182, "initiator_ip": "10.8.15.133", "initiator_port": 49858, "responder_ip": "13.107.21.239", "responder_port": 443, "first_frame": 12211, "last_frame": 14195, "first_seen_epoch": "1723680895.772177", "last_seen_epoch": "1723681019.72073", "packets": 28, "bytes": 11147, "initiator_bytes": 3626, "responder_bytes": 7521 }, { "flow_id": "flow-7316c218c95d57470a882747", "transport": "udp", "stream": 103, "initiator_ip": "10.8.15.133", "initiator_port": 53, "responder_ip": "10.8.15.4", "responder_port": 57799, "first_frame": 12213, "last_frame": 12213, "first_seen_epoch": "1723680895.806761", "last_seen_epoch": "1723680895.806761", "packets": 1, "bytes": 177, "initiator_bytes": 177, "responder_bytes": 0 }, { "flow_id": "flow-7ef9f7b55bbe28a89ddeeace", "transport": "tcp", "stream": 183, "initiator_ip": "10.8.15.133", "initiator_port": 49859, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 12239, "last_frame": 12247, "first_seen_epoch": "1723680899.818587", "last_seen_epoch": "1723680900.204905", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-79ccb66aad3c1ef5ec2fa042", "transport": "tcp", "stream": 184, "initiator_ip": "10.8.15.133", "initiator_port": 49860, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 12250, "last_frame": 12258, "first_seen_epoch": "1723680907.054202", "last_seen_epoch": "1723680907.451584", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-e4dfc643833bc42556c97630", "transport": "tcp", "stream": 185, "initiator_ip": "10.8.15.133", "initiator_port": 49861, "responder_ip": "52.109.0.136", "responder_port": 443, "first_frame": 12262, "last_frame": 12288, "first_seen_epoch": "1723680909.294716", "last_seen_epoch": "1723680909.743689", "packets": 27, "bytes": 9118, "initiator_bytes": 1762, "responder_bytes": 7356 }, { "flow_id": "flow-089c95b6660c9bd09f98a184", "transport": "tcp", "stream": 186, "initiator_ip": "10.8.15.133", "initiator_port": 49862, "responder_ip": "23.33.138.184", "responder_port": 443, "first_frame": 12289, "last_frame": 12306, "first_seen_epoch": "1723680909.872043", "last_seen_epoch": "1723680910.061921", "packets": 18, "bytes": 4826, "initiator_bytes": 3010, "responder_bytes": 1816 }, { "flow_id": "flow-2a943722771346aa0dd434bf", "transport": "tcp", "stream": 187, "initiator_ip": "10.8.15.133", "initiator_port": 49863, "responder_ip": "23.33.138.184", "responder_port": 443, "first_frame": 12307, "last_frame": 12326, "first_seen_epoch": "1723680910.068259", "last_seen_epoch": "1723680910.246183", "packets": 20, "bytes": 5050, "initiator_bytes": 3180, "responder_bytes": 1870 }, { "flow_id": "flow-19b7a98d7e86250990365e0f", "transport": "tcp", "stream": 188, "initiator_ip": "10.8.15.133", "initiator_port": 49864, "responder_ip": "23.33.138.184", "responder_port": 443, "first_frame": 12327, "last_frame": 12347, "first_seen_epoch": "1723680910.249376", "last_seen_epoch": "1723680910.424465", "packets": 21, "bytes": 5104, "initiator_bytes": 3180, "responder_bytes": 1924 }, { "flow_id": "flow-ed2996a657003f7c6241d35a", "transport": "tcp", "stream": 189, "initiator_ip": "10.8.15.133", "initiator_port": 49865, "responder_ip": "23.33.138.184", "responder_port": 443, "first_frame": 12348, "last_frame": 12370, "first_seen_epoch": "1723680910.428064", "last_seen_epoch": "1723680910.603316", "packets": 23, "bytes": 6486, "initiator_bytes": 4508, "responder_bytes": 1978 }, { "flow_id": "flow-8249357aba17dd45fd372ac2", "transport": "tcp", "stream": 190, "initiator_ip": "10.8.15.133", "initiator_port": 49866, "responder_ip": "23.33.138.184", "responder_port": 443, "first_frame": 12371, "last_frame": 12391, "first_seen_epoch": "1723680910.610985", "last_seen_epoch": "1723680910.78513", "packets": 21, "bytes": 6378, "initiator_bytes": 4454, "responder_bytes": 1924 }, { "flow_id": "flow-67e1a568ea4de0fbcfae9f45", "transport": "tcp", "stream": 191, "initiator_ip": "10.8.15.133", "initiator_port": 49867, "responder_ip": "23.33.138.184", "responder_port": 443, "first_frame": 12392, "last_frame": 12415, "first_seen_epoch": "1723680910.8046", "last_seen_epoch": "1723680911.071179", "packets": 21, "bytes": 5404, "initiator_bytes": 3534, "responder_bytes": 1870 }, { "flow_id": "flow-20cce6e49ab12b4b0d311b63", "transport": "udp", "stream": 104, "initiator_ip": "10.8.15.133", "initiator_port": 62937, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 12416, "last_frame": 12419, "first_seen_epoch": "1723680911.073896", "last_seen_epoch": "1723680911.10284", "packets": 2, "bytes": 225, "initiator_bytes": 75, "responder_bytes": 150 }, { "flow_id": "flow-4ed545012be99e7f2539df09", "transport": "udp", "stream": 105, "initiator_ip": "10.8.15.133", "initiator_port": 59823, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 12417, "last_frame": 12427, "first_seen_epoch": "1723680911.074019", "last_seen_epoch": "1723680911.152944", "packets": 2, "bytes": 209, "initiator_bytes": 75, "responder_bytes": 134 }, { "flow_id": "flow-1639c6360771f8f14b5c486d", "transport": "tcp", "stream": 192, "initiator_ip": "10.8.15.133", "initiator_port": 49868, "responder_ip": "23.33.138.184", "responder_port": 443, "first_frame": 12418, "last_frame": 12457, "first_seen_epoch": "1723680911.07591", "last_seen_epoch": "1723680911.313671", "packets": 22, "bytes": 5678, "initiator_bytes": 3754, "responder_bytes": 1924 }, { "flow_id": "flow-72b821f3d911802a191045c6", "transport": "tcp", "stream": 193, "initiator_ip": "10.8.15.133", "initiator_port": 49869, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 12421, "last_frame": 13579, "first_seen_epoch": "1723680911.123411", "last_seen_epoch": "1723680915.542852", "packets": 23, "bytes": 10294, "initiator_bytes": 2932, "responder_bytes": 7362 }, { "flow_id": "flow-5d57c57dd08bb14f0f881224", "transport": "tcp", "stream": 194, "initiator_ip": "10.8.15.133", "initiator_port": 49870, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 12422, "last_frame": 13580, "first_seen_epoch": "1723680911.123671", "last_seen_epoch": "1723680915.545564", "packets": 23, "bytes": 10422, "initiator_bytes": 3060, "responder_bytes": 7362 }, { "flow_id": "flow-71bcf86f3337d50fa9d43799", "transport": "udp", "stream": 105, "initiator_ip": "10.8.15.133", "initiator_port": 53, "responder_ip": "10.8.15.4", "responder_port": 59823, "first_frame": 12428, "last_frame": 12428, "first_seen_epoch": "1723680911.153097", "last_seen_epoch": "1723680911.153097", "packets": 1, "bytes": 162, "initiator_bytes": 162, "responder_bytes": 0 }, { "flow_id": "flow-aea9f4e5d1cb3856139d9248", "transport": "tcp", "stream": 195, "initiator_ip": "10.8.15.133", "initiator_port": 49871, "responder_ip": "23.33.138.184", "responder_port": 443, "first_frame": 12458, "last_frame": 12501, "first_seen_epoch": "1723680911.317572", "last_seen_epoch": "1723680911.484591", "packets": 20, "bytes": 5662, "initiator_bytes": 3792, "responder_bytes": 1870 }, { "flow_id": "flow-0b77aaa7c5ee632991138e0a", "transport": "tcp", "stream": 196, "initiator_ip": "10.8.15.133", "initiator_port": 49872, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 12508, "last_frame": 12522, "first_seen_epoch": "1723680911.760487", "last_seen_epoch": "1723680911.765553", "packets": 15, "bytes": 6643, "initiator_bytes": 3020, "responder_bytes": 3623 }, { "flow_id": "flow-c381aae0a7e6216ed11bb374", "transport": "tcp", "stream": 197, "initiator_ip": "10.8.15.133", "initiator_port": 49873, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 12523, "last_frame": 12533, "first_seen_epoch": "1723680911.771921", "last_seen_epoch": "1723680911.784697", "packets": 11, "bytes": 3236, "initiator_bytes": 2562, "responder_bytes": 674 }, { "flow_id": "flow-f37ad52f4d8f54ba00d0bca9", "transport": "udp", "stream": 106, "initiator_ip": "10.8.15.133", "initiator_port": 58263, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 12534, "last_frame": 12536, "first_seen_epoch": "1723680911.786577", "last_seen_epoch": "1723680911.786884", "packets": 2, "bytes": 217, "initiator_bytes": 71, "responder_bytes": 146 }, { "flow_id": "flow-f0e426163738fbfbaea69f55", "transport": "udp", "stream": 107, "initiator_ip": "10.8.15.133", "initiator_port": 60775, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 12535, "last_frame": 12537, "first_seen_epoch": "1723680911.786702", "last_seen_epoch": "1723680911.786888", "packets": 2, "bytes": 258, "initiator_bytes": 71, "responder_bytes": 187 }, { "flow_id": "flow-4472770897a80c3c05e9681a", "transport": "tcp", "stream": 198, "initiator_ip": "10.8.15.133", "initiator_port": 49874, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 12538, "last_frame": 13583, "first_seen_epoch": "1723680911.787584", "last_seen_epoch": "1723680915.545883", "packets": 49, "bytes": 24556, "initiator_bytes": 4851, "responder_bytes": 19705 }, { "flow_id": "flow-1fe2defbd75bdbb8fe3c2734", "transport": "udp", "stream": 108, "initiator_ip": "10.8.15.133", "initiator_port": 54553, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 12574, "last_frame": 12577, "first_seen_epoch": "1723680912.166445", "last_seen_epoch": "1723680912.207185", "packets": 2, "bytes": 366, "initiator_bytes": 74, "responder_bytes": 292 }, { "flow_id": "flow-5afe03fbd961f84c0ff82467", "transport": "udp", "stream": 109, "initiator_ip": "10.8.15.133", "initiator_port": 64957, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 12575, "last_frame": 12576, "first_seen_epoch": "1723680912.166716", "last_seen_epoch": "1723680912.167089", "packets": 2, "bytes": 280, "initiator_bytes": 74, "responder_bytes": 206 }, { "flow_id": "flow-8c1383d0b01126ee0b392f30", "transport": "tcp", "stream": 199, "initiator_ip": "10.8.15.133", "initiator_port": 49875, "responder_ip": "23.223.31.34", "responder_port": 443, "first_frame": 12578, "last_frame": 13576, "first_seen_epoch": "1723680912.210962", "last_seen_epoch": "1723680915.539145", "packets": 138, "bytes": 111676, "initiator_bytes": 8601, "responder_bytes": 103075 }, { "flow_id": "flow-9ca81fda30c8cd50a258260d", "transport": "udp", "stream": 110, "initiator_ip": "10.8.15.133", "initiator_port": 65271, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 12585, "last_frame": 12588, "first_seen_epoch": "1723680912.259888", "last_seen_epoch": "1723680912.303775", "packets": 2, "bytes": 217, "initiator_bytes": 71, "responder_bytes": 146 }, { "flow_id": "flow-9529f150f5618e22e2bcddb1", "transport": "udp", "stream": 111, "initiator_ip": "10.8.15.133", "initiator_port": 60084, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 12586, "last_frame": 12587, "first_seen_epoch": "1723680912.26005", "last_seen_epoch": "1723680912.303311", "packets": 2, "bytes": 258, "initiator_bytes": 71, "responder_bytes": 187 }, { "flow_id": "flow-4dfddb41adf88269afe0abd2", "transport": "tcp", "stream": 200, "initiator_ip": "10.8.15.133", "initiator_port": 49876, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 12589, "last_frame": 13584, "first_seen_epoch": "1723680912.304814", "last_seen_epoch": "1723680915.545909", "packets": 37, "bytes": 14145, "initiator_bytes": 3945, "responder_bytes": 10200 }, { "flow_id": "flow-dbc6451a0611f3dfc8c442cd", "transport": "udp", "stream": 112, "initiator_ip": "10.8.15.133", "initiator_port": 62901, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 12713, "last_frame": 12715, "first_seen_epoch": "1723680912.90037", "last_seen_epoch": "1723680912.900953", "packets": 2, "bytes": 237, "initiator_bytes": 72, "responder_bytes": 165 }, { "flow_id": "flow-c0906fbf275b60ea5047cb94", "transport": "udp", "stream": 113, "initiator_ip": "10.8.15.133", "initiator_port": 60564, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 12714, "last_frame": 12716, "first_seen_epoch": "1723680912.900658", "last_seen_epoch": "1723680912.900993", "packets": 2, "bytes": 278, "initiator_bytes": 72, "responder_bytes": 206 }, { "flow_id": "flow-990170b457573b2cb9f47e61", "transport": "tcp", "stream": 201, "initiator_ip": "10.8.15.133", "initiator_port": 49877, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 12717, "last_frame": 13574, "first_seen_epoch": "1723680912.901714", "last_seen_epoch": "1723680915.530083", "packets": 23, "bytes": 10416, "initiator_bytes": 3054, "responder_bytes": 7362 }, { "flow_id": "flow-d9f9b3ec4eeaad2422021309", "transport": "tcp", "stream": 202, "initiator_ip": "10.8.15.133", "initiator_port": 49878, "responder_ip": "23.223.31.34", "responder_port": 443, "first_frame": 12725, "last_frame": 13578, "first_seen_epoch": "1723680913.008582", "last_seen_epoch": "1723680915.541867", "packets": 60, "bytes": 22595, "initiator_bytes": 4689, "responder_bytes": 17906 }, { "flow_id": "flow-e288d006df20477821537160", "transport": "udp", "stream": 114, "initiator_ip": "10.8.15.133", "initiator_port": 59977, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 12735, "last_frame": 12745, "first_seen_epoch": "1723680913.097542", "last_seen_epoch": "1723680913.14289", "packets": 2, "bytes": 291, "initiator_bytes": 71, "responder_bytes": 220 }, { "flow_id": "flow-b2137d37871414e09a3f1050", "transport": "udp", "stream": 115, "initiator_ip": "10.8.15.133", "initiator_port": 65219, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 12736, "last_frame": 12749, "first_seen_epoch": "1723680913.097679", "last_seen_epoch": "1723680913.162609", "packets": 2, "bytes": 320, "initiator_bytes": 71, "responder_bytes": 249 }, { "flow_id": "flow-6396afa4df027ae2c2701972", "transport": "udp", "stream": 116, "initiator_ip": "10.8.15.133", "initiator_port": 56803, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 12737, "last_frame": 12747, "first_seen_epoch": "1723680913.098044", "last_seen_epoch": "1723680913.153633", "packets": 2, "bytes": 239, "initiator_bytes": 87, "responder_bytes": 152 }, { "flow_id": "flow-cd79860678d3ef4516c54d44", "transport": "udp", "stream": 117, "initiator_ip": "10.8.15.133", "initiator_port": 51724, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 12738, "last_frame": 12746, "first_seen_epoch": "1723680913.098252", "last_seen_epoch": "1723680913.142907", "packets": 2, "bytes": 272, "initiator_bytes": 87, "responder_bytes": 185 }, { "flow_id": "flow-275d529f2401639fa77b75d9", "transport": "tcp", "stream": 203, "initiator_ip": "10.8.15.133", "initiator_port": 49879, "responder_ip": "23.205.110.12", "responder_port": 443, "first_frame": 12748, "last_frame": 13573, "first_seen_epoch": "1723680913.161971", "last_seen_epoch": "1723680915.525227", "packets": 60, "bytes": 24039, "initiator_bytes": 4823, "responder_bytes": 19216 }, { "flow_id": "flow-a6af96588a3c39afe7dc6f8b", "transport": "udp", "stream": 118, "initiator_ip": "10.8.15.133", "initiator_port": 61658, "responder_ip": "23.220.103.72", "responder_port": 443, "first_frame": 12764, "last_frame": 13545, "first_seen_epoch": "1723680913.205", "last_seen_epoch": "1723680914.5818", "packets": 590, "bytes": 578979, "initiator_bytes": 21446, "responder_bytes": 557533 }, { "flow_id": "flow-f7fd4227f38b1bfd622d53da", "transport": "tcp", "stream": 204, "initiator_ip": "10.8.15.133", "initiator_port": 49880, "responder_ip": "23.220.103.72", "responder_port": 443, "first_frame": 12766, "last_frame": 13572, "first_seen_epoch": "1723680913.209192", "last_seen_epoch": "1723680915.525142", "packets": 19, "bytes": 7476, "initiator_bytes": 2363, "responder_bytes": 5113 }, { "flow_id": "flow-5e474e0715be06380e68644c", "transport": "udp", "stream": 119, "initiator_ip": "10.8.15.133", "initiator_port": 53643, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 12769, "last_frame": 12808, "first_seen_epoch": "1723680913.219315", "last_seen_epoch": "1723680913.262783", "packets": 2, "bytes": 239, "initiator_bytes": 73, "responder_bytes": 166 }, { "flow_id": "flow-851786e4f397ac66127bb12d", "transport": "udp", "stream": 120, "initiator_ip": "10.8.15.133", "initiator_port": 51544, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 12770, "last_frame": 12878, "first_seen_epoch": "1723680913.234543", "last_seen_epoch": "1723680913.301703", "packets": 2, "bytes": 223, "initiator_bytes": 73, "responder_bytes": 150 }, { "flow_id": "flow-fadcdb121edee98eb6441471", "transport": "tcp", "stream": 205, "initiator_ip": "10.8.15.133", "initiator_port": 49881, "responder_ip": "23.60.57.94", "responder_port": 443, "first_frame": 12822, "last_frame": 13569, "first_seen_epoch": "1723680913.278733", "last_seen_epoch": "1723680915.503366", "packets": 27, "bytes": 10376, "initiator_bytes": 3175, "responder_bytes": 7201 }, { "flow_id": "flow-1eb4544e34d31aaeaf384759", "transport": "udp", "stream": 120, "initiator_ip": "10.8.15.133", "initiator_port": 53, "responder_ip": "10.8.15.4", "responder_port": 51544, "first_frame": 12880, "last_frame": 12880, "first_seen_epoch": "1723680913.301933", "last_seen_epoch": "1723680913.301933", "packets": 1, "bytes": 178, "initiator_bytes": 178, "responder_bytes": 0 }, { "flow_id": "flow-37d0ae1a7f32dd1fea4b3232", "transport": "tcp", "stream": 206, "initiator_ip": "10.8.15.133", "initiator_port": 49882, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 13085, "last_frame": 13436, "first_seen_epoch": "1723680913.371578", "last_seen_epoch": "1723680913.767224", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-1f38fef63d51a2b6d1275f82", "transport": "udp", "stream": 121, "initiator_ip": "10.8.15.133", "initiator_port": 65099, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 13245, "last_frame": 13256, "first_seen_epoch": "1723680913.479286", "last_seen_epoch": "1723680913.536517", "packets": 2, "bytes": 297, "initiator_bytes": 72, "responder_bytes": 225 }, { "flow_id": "flow-aeaf512a365be0ecf39ed7fd", "transport": "udp", "stream": 122, "initiator_ip": "10.8.15.133", "initiator_port": 61445, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 13246, "last_frame": 13255, "first_seen_epoch": "1723680913.47944", "last_seen_epoch": "1723680913.536302", "packets": 2, "bytes": 326, "initiator_bytes": 72, "responder_bytes": 254 }, { "flow_id": "flow-e8cb95cba25bfccdb0bf4ae6", "transport": "tcp", "stream": 207, "initiator_ip": "10.8.15.133", "initiator_port": 49883, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 13586, "last_frame": 13594, "first_seen_epoch": "1723680917.792884", "last_seen_epoch": "1723680918.18338", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-533e08223e7639f295adcd5c", "transport": "tcp", "stream": 208, "initiator_ip": "10.8.15.133", "initiator_port": 49884, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 13606, "last_frame": 13629, "first_seen_epoch": "1723680922.543131", "last_seen_epoch": "1723680969.309629", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-c298536133bb4fa5ff12f362", "transport": "tcp", "stream": 209, "initiator_ip": "10.8.15.133", "initiator_port": 49885, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 13632, "last_frame": 13640, "first_seen_epoch": "1723680975.638036", "last_seen_epoch": "1723680976.003131", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-795c27cd7b29722478cd2529", "transport": "udp", "stream": 123, "initiator_ip": "10.8.15.133", "initiator_port": 64758, "responder_ip": "239.255.255.250", "responder_port": 1900, "first_frame": 13641, "last_frame": 13647, "first_seen_epoch": "1723680978.797257", "last_seen_epoch": "1723680981.824794", "packets": 4, "bytes": 868, "initiator_bytes": 868, "responder_bytes": 0 }, { "flow_id": "flow-6f11259955828af64c4b427b", "transport": "tcp", "stream": 210, "initiator_ip": "10.8.15.133", "initiator_port": 49886, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 13646, "last_frame": 13660, "first_seen_epoch": "1723680980.825228", "last_seen_epoch": "1723680982.855417", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-1695dd4a8eb936f258d3c157", "transport": "udp", "stream": 124, "initiator_ip": "10.8.15.133", "initiator_port": 64759, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 13663, "last_frame": 13664, "first_seen_epoch": "1723680984.80488", "last_seen_epoch": "1723680984.805236", "packets": 2, "bytes": 521, "initiator_bytes": 273, "responder_bytes": 248 }, { "flow_id": "flow-c2229bb4899c5df4c8f3755c", "transport": "tcp", "stream": 211, "initiator_ip": "10.8.15.133", "initiator_port": 49887, "responder_ip": "10.8.15.4", "responder_port": 135, "first_frame": 13665, "last_frame": 13732, "first_seen_epoch": "1723680984.929942", "last_seen_epoch": "1723680984.954655", "packets": 10, "bytes": 1704, "initiator_bytes": 832, "responder_bytes": 872 }, { "flow_id": "flow-c9b4ec97f28de0e2e1042be7", "transport": "tcp", "stream": 212, "initiator_ip": "10.8.15.133", "initiator_port": 49888, "responder_ip": "10.8.15.4", "responder_port": 49669, "first_frame": 13672, "last_frame": 13733, "first_seen_epoch": "1723680984.934008", "last_seen_epoch": "1723680984.954881", "packets": 22, "bytes": 6885, "initiator_bytes": 4464, "responder_bytes": 2421 }, { "flow_id": "flow-572ab36f8ba64ad6f1dab567", "transport": "tcp", "stream": 213, "initiator_ip": "10.8.15.133", "initiator_port": 49889, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 13695, "last_frame": 13731, "first_seen_epoch": "1723680984.943326", "last_seen_epoch": "1723680984.951948", "packets": 19, "bytes": 7824, "initiator_bytes": 3685, "responder_bytes": 4139 }, { "flow_id": "flow-fbdce66b1c1b9c8ac473e14e", "transport": "tcp", "stream": 214, "initiator_ip": "10.8.15.133", "initiator_port": 49890, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 13712, "last_frame": 13729, "first_seen_epoch": "1723680984.948472", "last_seen_epoch": "1723680984.95177", "packets": 18, "bytes": 7276, "initiator_bytes": 3103, "responder_bytes": 4173 }, { "flow_id": "flow-00295658f26af8379ed69be1", "transport": "tcp", "stream": 215, "initiator_ip": "10.8.15.133", "initiator_port": 49891, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 13736, "last_frame": 13744, "first_seen_epoch": "1723680986.325396", "last_seen_epoch": "1723680986.714255", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-fe48afec3bef62d5d29e03f4", "transport": "tcp", "stream": 216, "initiator_ip": "10.8.15.133", "initiator_port": 49892, "responder_ip": "10.8.15.4", "responder_port": 135, "first_frame": 13750, "last_frame": 13880, "first_seen_epoch": "1723680987.852522", "last_seen_epoch": "1723680989.134055", "packets": 11, "bytes": 1758, "initiator_bytes": 886, "responder_bytes": 872 }, { "flow_id": "flow-6c6f6f9d705977fe89bab19b", "transport": "tcp", "stream": 217, "initiator_ip": "10.8.15.133", "initiator_port": 49893, "responder_ip": "10.8.15.4", "responder_port": 49669, "first_frame": 13757, "last_frame": 13881, "first_seen_epoch": "1723680987.856405", "last_seen_epoch": "1723680989.13412", "packets": 25, "bytes": 7133, "initiator_bytes": 4518, "responder_bytes": 2615 }, { "flow_id": "flow-dfa7e51d8fa7251de0e5373e", "transport": "tcp", "stream": 218, "initiator_ip": "10.8.15.133", "initiator_port": 49894, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 13780, "last_frame": 13818, "first_seen_epoch": "1723680987.866519", "last_seen_epoch": "1723680987.878107", "packets": 21, "bytes": 7866, "initiator_bytes": 3673, "responder_bytes": 4193 }, { "flow_id": "flow-f1a5ac0038afd7a4f0a339d0", "transport": "tcp", "stream": 219, "initiator_ip": "10.8.15.133", "initiator_port": 49895, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 13797, "last_frame": 13814, "first_seen_epoch": "1723680987.872549", "last_seen_epoch": "1723680987.8772", "packets": 18, "bytes": 7210, "initiator_bytes": 3037, "responder_bytes": 4173 }, { "flow_id": "flow-e6407fe11e2bebb670a67510", "transport": "tcp", "stream": 220, "initiator_ip": "10.8.15.133", "initiator_port": 49896, "responder_ip": "40.126.29.10", "responder_port": 443, "first_frame": 13827, "last_frame": 13882, "first_seen_epoch": "1723680987.962869", "last_seen_epoch": "1723680989.134692", "packets": 22, "bytes": 8067, "initiator_bytes": 1947, "responder_bytes": 6120 }, { "flow_id": "flow-fd37d391c8500cf6a061a0b8", "transport": "tcp", "stream": 221, "initiator_ip": "10.8.15.133", "initiator_port": 49897, "responder_ip": "20.99.184.37", "responder_port": 443, "first_frame": 13851, "last_frame": 13877, "first_seen_epoch": "1723680988.367546", "last_seen_epoch": "1723680988.91108", "packets": 27, "bytes": 9995, "initiator_bytes": 2687, "responder_bytes": 7308 }, { "flow_id": "flow-9f315ca2742c4e4ee21df194", "transport": "tcp", "stream": 222, "initiator_ip": "10.8.15.133", "initiator_port": 49898, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 13883, "last_frame": 14055, "first_seen_epoch": "1723680989.943781", "last_seen_epoch": "1723680990.585074", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-73ba2d036a3253ad810c9a1c", "transport": "udp", "stream": 125, "initiator_ip": "10.8.15.133", "initiator_port": 56698, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 13884, "last_frame": 13886, "first_seen_epoch": "1723680989.98923", "last_seen_epoch": "1723680990.182754", "packets": 3, "bytes": 404, "initiator_bytes": 182, "responder_bytes": 222 }, { "flow_id": "flow-671079a8511e26487e80f685", "transport": "tcp", "stream": 223, "initiator_ip": "10.8.15.133", "initiator_port": 49899, "responder_ip": "52.137.106.217", "responder_port": 443, "first_frame": 13887, "last_frame": 14064, "first_seen_epoch": "1723680990.184633", "last_seen_epoch": "1723680990.750976", "packets": 25, "bytes": 6374, "initiator_bytes": 1343, "responder_bytes": 5031 }, { "flow_id": "flow-7860e3c0e4833663c3668f58", "transport": "udp", "stream": 126, "initiator_ip": "10.8.15.133", "initiator_port": 65010, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 13888, "last_frame": 13892, "first_seen_epoch": "1723680990.209907", "last_seen_epoch": "1723680990.28432", "packets": 3, "bytes": 361, "initiator_bytes": 182, "responder_bytes": 179 }, { "flow_id": "flow-7fa91821dbc2a2c1a75203b6", "transport": "tcp", "stream": 224, "initiator_ip": "10.8.15.133", "initiator_port": 49900, "responder_ip": "13.85.23.206", "responder_port": 443, "first_frame": 13895, "last_frame": 14083, "first_seen_epoch": "1723680990.28839", "last_seen_epoch": "1723680998.017753", "packets": 147, "bytes": 99351, "initiator_bytes": 91329, "responder_bytes": 8022 }, { "flow_id": "flow-5c13cdbdc1cfcb3ac4e89023", "transport": "tcp", "stream": 225, "initiator_ip": "10.8.15.133", "initiator_port": 49901, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14066, "last_frame": 14077, "first_seen_epoch": "1723680993.617796", "last_seen_epoch": "1723680995.032586", "packets": 12, "bytes": 1348, "initiator_bytes": 851, "responder_bytes": 497 }, { "flow_id": "flow-905b90a5cd9c8d89c7deeb1e", "transport": "tcp", "stream": 226, "initiator_ip": "10.8.15.133", "initiator_port": 49902, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14084, "last_frame": 14096, "first_seen_epoch": "1723680998.39781", "last_seen_epoch": "1723681000.887751", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-ba9a70794d5aa81910796032", "transport": "udp", "stream": 127, "initiator_ip": "10.8.15.133", "initiator_port": 59783, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 14085, "last_frame": 14098, "first_seen_epoch": "1723680998.875866", "last_seen_epoch": "1723681003.136912", "packets": 5, "bytes": 582, "initiator_bytes": 356, "responder_bytes": 226 }, { "flow_id": "flow-baf0829cbd99a643c046f76e", "transport": "tcp", "stream": 227, "initiator_ip": "10.8.15.133", "initiator_port": 49903, "responder_ip": "20.42.65.94", "responder_port": 443, "first_frame": 14099, "last_frame": 14134, "first_seen_epoch": "1723681003.137486", "last_seen_epoch": "1723681003.875509", "packets": 36, "bytes": 12131, "initiator_bytes": 6263, "responder_bytes": 5868 }, { "flow_id": "flow-bcc4b9d8bca07c54cca80169", "transport": "tcp", "stream": 228, "initiator_ip": "10.8.15.133", "initiator_port": 49904, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14135, "last_frame": 14143, "first_seen_epoch": "1723681006.023954", "last_seen_epoch": "1723681006.418735", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-4a05ff9505497f662209a9ed", "transport": "udp", "stream": 128, "initiator_ip": "10.8.15.133", "initiator_port": 58863, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 14144, "last_frame": 14499, "first_seen_epoch": "1723681007.156999", "last_seen_epoch": "1723681154.477536", "packets": 5, "bytes": 609, "initiator_bytes": 229, "responder_bytes": 380 }, { "flow_id": "flow-0b4d9eed35346a6f4047252d", "transport": "tcp", "stream": 229, "initiator_ip": "10.8.15.133", "initiator_port": 49905, "responder_ip": "20.42.65.94", "responder_port": 443, "first_frame": 14146, "last_frame": 14172, "first_seen_epoch": "1723681007.204689", "last_seen_epoch": "1723681007.654135", "packets": 27, "bytes": 8760, "initiator_bytes": 3268, "responder_bytes": 5492 }, { "flow_id": "flow-d5308ad55c38802f5a350131", "transport": "tcp", "stream": 230, "initiator_ip": "10.8.15.133", "initiator_port": 49906, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14175, "last_frame": 14183, "first_seen_epoch": "1723681012.992815", "last_seen_epoch": "1723681013.383583", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-8c3877560e183220ba9e3a95", "transport": "tcp", "stream": 231, "initiator_ip": "10.8.15.133", "initiator_port": 49907, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14186, "last_frame": 14194, "first_seen_epoch": "1723681018.727005", "last_seen_epoch": "1723681019.10543", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-ff44e1cad74b46a6bcb25baf", "transport": "tcp", "stream": 232, "initiator_ip": "10.8.15.133", "initiator_port": 49908, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14198, "last_frame": 14206, "first_seen_epoch": "1723681026.071069", "last_seen_epoch": "1723681026.461956", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-e6e28d2fc2f11baf1cae53af", "transport": "tcp", "stream": 233, "initiator_ip": "10.8.15.133", "initiator_port": 49909, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14207, "last_frame": 14217, "first_seen_epoch": "1723681032.602625", "last_seen_epoch": "1723681032.983108", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-d7514aed6043351582157376", "transport": "tcp", "stream": 234, "initiator_ip": "10.8.15.133", "initiator_port": 49910, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14218, "last_frame": 14231, "first_seen_epoch": "1723681037.44625", "last_seen_epoch": "1723681037.821377", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-c4f5b6046cf0b3e10f94670b", "transport": "tcp", "stream": 235, "initiator_ip": "10.8.15.133", "initiator_port": 49911, "responder_ip": "23.53.13.196", "responder_port": 443, "first_frame": 14223, "last_frame": 14747, "first_seen_epoch": "1723681037.711061", "last_seen_epoch": "1723681188.221648", "packets": 22, "bytes": 7902, "initiator_bytes": 1560, "responder_bytes": 6342 }, { "flow_id": "flow-74a9ef08cd899ef38a5b14a1", "transport": "tcp", "stream": 236, "initiator_ip": "10.8.15.133", "initiator_port": 49912, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14251, "last_frame": 14259, "first_seen_epoch": "1723681043.024361", "last_seen_epoch": "1723681043.419576", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-a137ca3c1437e48d90cb0e3f", "transport": "tcp", "stream": 237, "initiator_ip": "10.8.15.133", "initiator_port": 49913, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14260, "last_frame": 14268, "first_seen_epoch": "1723681050.134021", "last_seen_epoch": "1723681050.520786", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-c01dfd228ec13de8b444c2a4", "transport": "tcp", "stream": 238, "initiator_ip": "10.8.15.133", "initiator_port": 49914, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14269, "last_frame": 14277, "first_seen_epoch": "1723681056.133642", "last_seen_epoch": "1723681056.503633", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-0ad8ef599bc3da4521dc48c5", "transport": "tcp", "stream": 239, "initiator_ip": "10.8.15.133", "initiator_port": 49915, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14278, "last_frame": 14286, "first_seen_epoch": "1723681059.899614", "last_seen_epoch": "1723681060.292816", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-17886be0b488c726c6ba9ec8", "transport": "tcp", "stream": 240, "initiator_ip": "10.8.15.133", "initiator_port": 49916, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14287, "last_frame": 14295, "first_seen_epoch": "1723681063.399542", "last_seen_epoch": "1723681063.782517", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-7784da5d51f651a2c5cdff58", "transport": "tcp", "stream": 241, "initiator_ip": "10.8.15.133", "initiator_port": 49917, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14298, "last_frame": 14306, "first_seen_epoch": "1723681070.368467", "last_seen_epoch": "1723681070.760054", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-0e5d0d26572fb41445dec14d", "transport": "tcp", "stream": 242, "initiator_ip": "10.8.15.133", "initiator_port": 49918, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14309, "last_frame": 14318, "first_seen_epoch": "1723681076.134108", "last_seen_epoch": "1723681076.520938", "packets": 10, "bytes": 1228, "initiator_bytes": 731, "responder_bytes": 497 }, { "flow_id": "flow-787cb744c5779fc2091a2eee", "transport": "tcp", "stream": 243, "initiator_ip": "10.8.15.133", "initiator_port": 49919, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14321, "last_frame": 14329, "first_seen_epoch": "1723681083.556067", "last_seen_epoch": "1723681083.944698", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-7b3261f1d9aa142c2db4c905", "transport": "tcp", "stream": 244, "initiator_ip": "10.8.15.133", "initiator_port": 49920, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14332, "last_frame": 14340, "first_seen_epoch": "1723681090.212364", "last_seen_epoch": "1723681090.58337", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-070ce745d9ef494f80f47062", "transport": "tcp", "stream": 245, "initiator_ip": "10.8.15.133", "initiator_port": 49921, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14341, "last_frame": 14351, "first_seen_epoch": "1723681095.290599", "last_seen_epoch": "1723681095.671131", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-e344db2cfdbb8975aebc70b1", "transport": "udp", "stream": 129, "initiator_ip": "10.8.15.133", "initiator_port": 58864, "responder_ip": "239.255.255.250", "responder_port": 1900, "first_frame": 14352, "last_frame": 14365, "first_seen_epoch": "1723681098.811138", "last_seen_epoch": "1723681101.836854", "packets": 4, "bytes": 868, "initiator_bytes": 868, "responder_bytes": 0 }, { "flow_id": "flow-9d732a23bfdd9ddc7f4fe1b7", "transport": "tcp", "stream": 246, "initiator_ip": "10.8.15.133", "initiator_port": 49922, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14355, "last_frame": 14364, "first_seen_epoch": "1723681101.353184", "last_seen_epoch": "1723681101.734619", "packets": 10, "bytes": 1228, "initiator_bytes": 731, "responder_bytes": 497 }, { "flow_id": "flow-4357f1899ac52d780e1044a6", "transport": "tcp", "stream": 247, "initiator_ip": "10.8.15.133", "initiator_port": 49923, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14370, "last_frame": 14379, "first_seen_epoch": "1723681105.322089", "last_seen_epoch": "1723681105.693067", "packets": 10, "bytes": 1228, "initiator_bytes": 731, "responder_bytes": 497 }, { "flow_id": "flow-c32c4b8d65b2cd95c953b800", "transport": "tcp", "stream": 248, "initiator_ip": "10.8.15.133", "initiator_port": 49924, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14380, "last_frame": 14390, "first_seen_epoch": "1723681109.134462", "last_seen_epoch": "1723681109.522868", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-55a12ed8250d5c1fe9a12b40", "transport": "tcp", "stream": 249, "initiator_ip": "10.8.15.133", "initiator_port": 49925, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14391, "last_frame": 14400, "first_seen_epoch": "1723681112.697058", "last_seen_epoch": "1723681113.072661", "packets": 10, "bytes": 1228, "initiator_bytes": 731, "responder_bytes": 497 }, { "flow_id": "flow-80384e37907b9ef9091f6b0f", "transport": "tcp", "stream": 250, "initiator_ip": "10.8.15.133", "initiator_port": 49926, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14403, "last_frame": 14411, "first_seen_epoch": "1723681119.806701", "last_seen_epoch": "1723681120.18356", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-7e7338fe935c7c726a47704a", "transport": "tcp", "stream": 251, "initiator_ip": "10.8.15.133", "initiator_port": 49927, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14412, "last_frame": 14420, "first_seen_epoch": "1723681125.837289", "last_seen_epoch": "1723681126.211008", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-c8dc4c8046a8c59d9d1ea26e", "transport": "tcp", "stream": 252, "initiator_ip": "10.8.15.133", "initiator_port": 49928, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14421, "last_frame": 14429, "first_seen_epoch": "1723681129.681598", "last_seen_epoch": "1723681130.051344", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-7adb9ece92cc4b7d07e7df2b", "transport": "tcp", "stream": 253, "initiator_ip": "10.8.15.133", "initiator_port": 49929, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14434, "last_frame": 14444, "first_seen_epoch": "1723681133.275415", "last_seen_epoch": "1723681133.643212", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-0ea5e4a7c570f810024b5dfc", "transport": "tcp", "stream": 254, "initiator_ip": "10.8.15.133", "initiator_port": 49930, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14447, "last_frame": 14455, "first_seen_epoch": "1723681140.462822", "last_seen_epoch": "1723681140.855712", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-df42d5c00b6f343c772cb4a6", "transport": "tcp", "stream": 255, "initiator_ip": "10.8.15.133", "initiator_port": 49931, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14456, "last_frame": 14465, "first_seen_epoch": "1723681146.697334", "last_seen_epoch": "1723681147.088312", "packets": 10, "bytes": 1228, "initiator_bytes": 731, "responder_bytes": 497 }, { "flow_id": "flow-41feb540de8cdd8b02831c11", "transport": "tcp", "stream": 256, "initiator_ip": "10.8.15.133", "initiator_port": 49934, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14467, "last_frame": 14475, "first_seen_epoch": "1723681150.978162", "last_seen_epoch": "1723681151.343098", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-6e748bbffd55bc01c77d6c21", "transport": "tcp", "stream": 257, "initiator_ip": "10.8.15.133", "initiator_port": 49936, "responder_ip": "10.8.15.4", "responder_port": 135, "first_frame": 14477, "last_frame": 14693, "first_seen_epoch": "1723681154.345107", "last_seen_epoch": "1723681165.119954", "packets": 12, "bytes": 1376, "initiator_bytes": 718, "responder_bytes": 658 }, { "flow_id": "flow-aa23f566829a155be712da7c", "transport": "tcp", "stream": 258, "initiator_ip": "10.8.15.133", "initiator_port": 49937, "responder_ip": "10.8.15.4", "responder_port": 49669, "first_frame": 14484, "last_frame": 14694, "first_seen_epoch": "1723681154.347474", "last_seen_epoch": "1723681165.120001", "packets": 16, "bytes": 2404, "initiator_bytes": 1442, "responder_bytes": 962 }, { "flow_id": "flow-92854d80d35344706b5b6962", "transport": "tcp", "stream": 259, "initiator_ip": "10.8.15.133", "initiator_port": 49938, "responder_ip": "20.241.44.114", "responder_port": 443, "first_frame": 14500, "last_frame": 15073, "first_seen_epoch": "1723681154.478559", "last_seen_epoch": "1723681264.819012", "packets": 33, "bytes": 9337, "initiator_bytes": 1532, "responder_bytes": 7805 }, { "flow_id": "flow-4066f4bf5be0807be4f39633", "transport": "udp", "stream": 130, "initiator_ip": "10.8.15.133", "initiator_port": 64180, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 14524, "last_frame": 14527, "first_seen_epoch": "1723681154.855956", "last_seen_epoch": "1723681154.917557", "packets": 3, "bytes": 322, "initiator_bytes": 152, "responder_bytes": 170 }, { "flow_id": "flow-a9516eab7551e25f296e07f1", "transport": "tcp", "stream": 260, "initiator_ip": "10.8.15.133", "initiator_port": 49939, "responder_ip": "23.56.233.15", "responder_port": 443, "first_frame": 14528, "last_frame": 15071, "first_seen_epoch": "1723681154.918858", "last_seen_epoch": "1723681264.521612", "packets": 106, "bytes": 97101, "initiator_bytes": 2577, "responder_bytes": 94524 }, { "flow_id": "flow-df2bd55012917cd619dc66ab", "transport": "udp", "stream": 131, "initiator_ip": "10.8.15.133", "initiator_port": 49872, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 14634, "last_frame": 14927, "first_seen_epoch": "1723681155.362065", "last_seen_epoch": "1723681209.83203", "packets": 8, "bytes": 1057, "initiator_bytes": 427, "responder_bytes": 630 }, { "flow_id": "flow-d6a883241f23ddfe3205c788", "transport": "tcp", "stream": 261, "initiator_ip": "10.8.15.133", "initiator_port": 49940, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14635, "last_frame": 14666, "first_seen_epoch": "1723681155.385051", "last_seen_epoch": "1723681155.751922", "packets": 10, "bytes": 1228, "initiator_bytes": 731, "responder_bytes": 497 }, { "flow_id": "flow-c50bc8094a8a20559306efa8", "transport": "tcp", "stream": 262, "initiator_ip": "10.8.15.133", "initiator_port": 49941, "responder_ip": "52.113.194.132", "responder_port": 443, "first_frame": 14637, "last_frame": 14971, "first_seen_epoch": "1723681155.403541", "last_seen_epoch": "1723681215.847474", "packets": 27, "bytes": 10155, "initiator_bytes": 1605, "responder_bytes": 8550 }, { "flow_id": "flow-831389aa53c08ff4112b3e86", "transport": "tcp", "stream": 263, "initiator_ip": "10.8.15.133", "initiator_port": 49942, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14672, "last_frame": 14680, "first_seen_epoch": "1723681160.103815", "last_seen_epoch": "1723681160.486134", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-98d3eff8df11fe64d9d37541", "transport": "tcp", "stream": 264, "initiator_ip": "10.8.15.133", "initiator_port": 49943, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14695, "last_frame": 14703, "first_seen_epoch": "1723681165.478899", "last_seen_epoch": "1723681166.102983", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-1c61a564fed51f68c3951c66", "transport": "tcp", "stream": 265, "initiator_ip": "10.8.15.133", "initiator_port": 49944, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14704, "last_frame": 14712, "first_seen_epoch": "1723681172.619647", "last_seen_epoch": "1723681172.984836", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-ff4b44576d238bcf79961fa7", "transport": "tcp", "stream": 266, "initiator_ip": "10.8.15.133", "initiator_port": 49945, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14715, "last_frame": 14724, "first_seen_epoch": "1723681178.182146", "last_seen_epoch": "1723681180.072999", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-8c4a46b9f5b8a622f0876583", "transport": "tcp", "stream": 267, "initiator_ip": "10.8.15.133", "initiator_port": 49946, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14727, "last_frame": 14741, "first_seen_epoch": "1723681184.166552", "last_seen_epoch": "1723681185.059423", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-79678e281ad06bd08f4a3ebf", "transport": "tcp", "stream": 268, "initiator_ip": "10.8.15.133", "initiator_port": 49947, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14757, "last_frame": 14765, "first_seen_epoch": "1723681190.041562", "last_seen_epoch": "1723681190.402089", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-ea327985675871859968d752", "transport": "tcp", "stream": 269, "initiator_ip": "10.8.15.133", "initiator_port": 49948, "responder_ip": "52.152.180.153", "responder_port": 443, "first_frame": 14768, "last_frame": 14913, "first_seen_epoch": "1723681192.121207", "last_seen_epoch": "1723681205.433107", "packets": 121, "bytes": 80446, "initiator_bytes": 44446, "responder_bytes": 36000 }, { "flow_id": "flow-e8d4d6e341898e2cdc41e3ac", "transport": "tcp", "stream": 270, "initiator_ip": "10.8.15.133", "initiator_port": 49949, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14789, "last_frame": 14797, "first_seen_epoch": "1723681196.635249", "last_seen_epoch": "1723681197.02146", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-876df22d7be5e077ccdd8069", "transport": "tcp", "stream": 271, "initiator_ip": "10.8.15.133", "initiator_port": 49950, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14803, "last_frame": 14811, "first_seen_epoch": "1723681201.667259", "last_seen_epoch": "1723681202.097591", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-9e6867f750c68db81b5fc7ff", "transport": "tcp", "stream": 272, "initiator_ip": "10.8.15.133", "initiator_port": 49951, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14916, "last_frame": 14926, "first_seen_epoch": "1723681207.729868", "last_seen_epoch": "1723681209.770358", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-3ff1e89ce7c40b88ac115065", "transport": "tcp", "stream": 273, "initiator_ip": "10.8.15.133", "initiator_port": 49952, "responder_ip": "20.44.10.122", "responder_port": 443, "first_frame": 14928, "last_frame": 14956, "first_seen_epoch": "1723681209.83342", "last_seen_epoch": "1723681214.119305", "packets": 29, "bytes": 8829, "initiator_bytes": 3241, "responder_bytes": 5588 }, { "flow_id": "flow-61f42571f90e5a2fc0a3a949", "transport": "tcp", "stream": 274, "initiator_ip": "10.8.15.133", "initiator_port": 49953, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14959, "last_frame": 14967, "first_seen_epoch": "1723681214.886189", "last_seen_epoch": "1723681215.262504", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-6dc30d640fb9edd0c6f1dcb7", "transport": "udp", "stream": 132, "initiator_ip": "10.8.15.133", "initiator_port": 49873, "responder_ip": "239.255.255.250", "responder_port": 1900, "first_frame": 14972, "last_frame": 14976, "first_seen_epoch": "1723681218.812495", "last_seen_epoch": "1723681221.854128", "packets": 4, "bytes": 868, "initiator_bytes": 868, "responder_bytes": 0 }, { "flow_id": "flow-22ef2dd8262e52bd890cfef2", "transport": "tcp", "stream": 275, "initiator_ip": "10.8.15.133", "initiator_port": 49954, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14975, "last_frame": 14984, "first_seen_epoch": "1723681221.776876", "last_seen_epoch": "1723681222.151761", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-0220309bdd488c966a85eabe", "transport": "tcp", "stream": 276, "initiator_ip": "10.8.15.133", "initiator_port": 49955, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14986, "last_frame": 14994, "first_seen_epoch": "1723681227.370764", "last_seen_epoch": "1723681227.764986", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-d7723ebe84788c90a7049858", "transport": "tcp", "stream": 277, "initiator_ip": "10.8.15.133", "initiator_port": 49956, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 14996, "last_frame": 15004, "first_seen_epoch": "1723681234.495807", "last_seen_epoch": "1723681234.9023", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-94b9ea5c01f0040c66033d8a", "transport": "tcp", "stream": 278, "initiator_ip": "10.8.15.133", "initiator_port": 49957, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15007, "last_frame": 15015, "first_seen_epoch": "1723681240.574711", "last_seen_epoch": "1723681240.95633", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-0f7e0a3c54af0081987bdd31", "transport": "tcp", "stream": 279, "initiator_ip": "10.8.15.133", "initiator_port": 49958, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15016, "last_frame": 15028, "first_seen_epoch": "1723681244.496634", "last_seen_epoch": "1723681244.871634", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-9544f9d8e1c075f1550c2b67", "transport": "tcp", "stream": 280, "initiator_ip": "10.8.15.133", "initiator_port": 49959, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15029, "last_frame": 15043, "first_seen_epoch": "1723681248.222272", "last_seen_epoch": "1723681250.642846", "packets": 11, "bytes": 1294, "initiator_bytes": 797, "responder_bytes": 497 }, { "flow_id": "flow-c14af2ee16b099ddc5300eb8", "transport": "tcp", "stream": 281, "initiator_ip": "10.8.15.133", "initiator_port": 49960, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15044, "last_frame": 15052, "first_seen_epoch": "1723681255.670826", "last_seen_epoch": "1723681256.031691", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-765a948bcb9649244b8113fa", "transport": "udp", "stream": 133, "initiator_ip": "10.8.15.133", "initiator_port": 63673, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 15053, "last_frame": 15107, "first_seen_epoch": "1723681260.039225", "last_seen_epoch": "1723681282.519199", "packets": 5, "bytes": 703, "initiator_bytes": 255, "responder_bytes": 448 }, { "flow_id": "flow-bda51b15eceb0c6b91fc8f09", "transport": "tcp", "stream": 282, "initiator_ip": "10.8.15.133", "initiator_port": 49961, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15057, "last_frame": 15065, "first_seen_epoch": "1723681262.344184", "last_seen_epoch": "1723681262.980397", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-814037fa0432627f28b8c58f", "transport": "tcp", "stream": 283, "initiator_ip": "10.8.15.133", "initiator_port": 49962, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15074, "last_frame": 15083, "first_seen_epoch": "1723681268.04008", "last_seen_epoch": "1723681269.841582", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-a3f8544773140da81a3459c4", "transport": "tcp", "stream": 284, "initiator_ip": "10.8.15.133", "initiator_port": 49963, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15086, "last_frame": 15094, "first_seen_epoch": "1723681273.572947", "last_seen_epoch": "1723681274.070912", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-9e0b737c6548c3bf8a69e4ba", "transport": "tcp", "stream": 285, "initiator_ip": "10.8.15.133", "initiator_port": 49964, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15095, "last_frame": 15103, "first_seen_epoch": "1723681277.917594", "last_seen_epoch": "1723681278.302543", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-374d704093da3543443f718b", "transport": "tcp", "stream": 286, "initiator_ip": "10.8.15.133", "initiator_port": 49965, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15104, "last_frame": 15145, "first_seen_epoch": "1723681282.280133", "last_seen_epoch": "1723681282.913803", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-5a55a56cf5c07f4f7f6d9ebe", "transport": "tcp", "stream": 287, "initiator_ip": "10.8.15.133", "initiator_port": 49966, "responder_ip": "20.3.0.251", "responder_port": 443, "first_frame": 15108, "last_frame": 15159, "first_seen_epoch": "1723681282.525073", "last_seen_epoch": "1723681283.088725", "packets": 42, "bytes": 22751, "initiator_bytes": 7253, "responder_bytes": 15498 }, { "flow_id": "flow-02028e7ad9d65264b9ab9691", "transport": "udp", "stream": 134, "initiator_ip": "10.8.15.133", "initiator_port": 53628, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 15160, "last_frame": 15177, "first_seen_epoch": "1723681286.063208", "last_seen_epoch": "1723681289.634667", "packets": 5, "bytes": 670, "initiator_bytes": 436, "responder_bytes": 234 }, { "flow_id": "flow-4547dd5b5e7588d2f73c14f3", "transport": "tcp", "stream": 288, "initiator_ip": "10.8.15.133", "initiator_port": 49967, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15167, "last_frame": 15175, "first_seen_epoch": "1723681287.416913", "last_seen_epoch": "1723681287.814047", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-00815f0e6ca57d4c8a138f04", "transport": "tcp", "stream": 289, "initiator_ip": "10.8.15.133", "initiator_port": 49968, "responder_ip": "23.194.68.140", "responder_port": 443, "first_frame": 15178, "last_frame": 15199, "first_seen_epoch": "1723681289.635564", "last_seen_epoch": "1723681289.830999", "packets": 22, "bytes": 8350, "initiator_bytes": 1167, "responder_bytes": 7183 }, { "flow_id": "flow-29a42ffb421cb531f0bce8b0", "transport": "tcp", "stream": 290, "initiator_ip": "10.8.15.133", "initiator_port": 49969, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15200, "last_frame": 15211, "first_seen_epoch": "1723681293.121792", "last_seen_epoch": "1723681295.066992", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-54acfb3987163e7c460db9e9", "transport": "tcp", "stream": 291, "initiator_ip": "10.8.15.133", "initiator_port": 49973, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15214, "last_frame": 15222, "first_seen_epoch": "1723681299.433708", "last_seen_epoch": "1723681299.82989", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-66ccf03ac4475876f81abea2", "transport": "tcp", "stream": 292, "initiator_ip": "10.8.15.133", "initiator_port": 49974, "responder_ip": "10.8.15.4", "responder_port": 135, "first_frame": 15223, "last_frame": 15273, "first_seen_epoch": "1723681300.755749", "last_seen_epoch": "1723681312.085483", "packets": 12, "bytes": 1376, "initiator_bytes": 718, "responder_bytes": 658 }, { "flow_id": "flow-b3c14d86c330dad67f7a81e6", "transport": "tcp", "stream": 293, "initiator_ip": "10.8.15.133", "initiator_port": 49975, "responder_ip": "10.8.15.4", "responder_port": 49669, "first_frame": 15230, "last_frame": 15272, "first_seen_epoch": "1723681300.75821", "last_seen_epoch": "1723681312.085418", "packets": 17, "bytes": 2654, "initiator_bytes": 1454, "responder_bytes": 1200 }, { "flow_id": "flow-8ba3ced998442afb36b5303c", "transport": "tcp", "stream": 294, "initiator_ip": "10.8.15.133", "initiator_port": 49976, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15247, "last_frame": 15255, "first_seen_epoch": "1723681304.868221", "last_seen_epoch": "1723681305.235358", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-9121281b8c247d8caed99b59", "transport": "tcp", "stream": 295, "initiator_ip": "10.8.15.133", "initiator_port": 49977, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15257, "last_frame": 15265, "first_seen_epoch": "1723681311.584506", "last_seen_epoch": "1723681311.972046", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-578e5b68e9e36b6924571627", "transport": "udp", "stream": 135, "initiator_ip": "10.8.15.133", "initiator_port": 62238, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 15274, "last_frame": 15341, "first_seen_epoch": "1723681312.74843", "last_seen_epoch": "1723681329.746343", "packets": 6, "bytes": 845, "initiator_bytes": 245, "responder_bytes": 600 }, { "flow_id": "flow-d0ddceab36c49b68ccf963a3", "transport": "tcp", "stream": 296, "initiator_ip": "10.8.15.133", "initiator_port": 49978, "responder_ip": "20.42.65.88", "responder_port": 443, "first_frame": 15276, "last_frame": 15304, "first_seen_epoch": "1723681312.791867", "last_seen_epoch": "1723681313.267763", "packets": 29, "bytes": 8897, "initiator_bytes": 3351, "responder_bytes": 5546 }, { "flow_id": "flow-3fc2fb7b1148e1a16ccc1e8c", "transport": "tcp", "stream": 297, "initiator_ip": "10.8.15.133", "initiator_port": 49979, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15307, "last_frame": 15316, "first_seen_epoch": "1723681316.846284", "last_seen_epoch": "1723681318.729221", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-787695c6c4afa0d268c283fb", "transport": "tcp", "stream": 298, "initiator_ip": "10.8.15.133", "initiator_port": 49980, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15317, "last_frame": 15327, "first_seen_epoch": "1723681322.171679", "last_seen_epoch": "1723681323.082552", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-e0d0df5bb02c5a923fc98c87", "transport": "tcp", "stream": 299, "initiator_ip": "10.8.15.133", "initiator_port": 49981, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15328, "last_frame": 15337, "first_seen_epoch": "1723681326.786037", "last_seen_epoch": "1723681328.787841", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-c2b7d1cb0fab5b7d007c3a52", "transport": "tcp", "stream": 300, "initiator_ip": "10.8.15.133", "initiator_port": 49982, "responder_ip": "23.220.251.208", "responder_port": 80, "first_frame": 15342, "last_frame": 15362, "first_seen_epoch": "1723681329.828919", "last_seen_epoch": "1723681330.151278", "packets": 8, "bytes": 992, "initiator_bytes": 530, "responder_bytes": 462 }, { "flow_id": "flow-b884031fd1028bbbeb13256f", "transport": "udp", "stream": 136, "initiator_ip": "10.8.15.133", "initiator_port": 62388, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 15349, "last_frame": 15761, "first_seen_epoch": "1723681330.002305", "last_seen_epoch": "1723681510.197245", "packets": 12, "bytes": 1611, "initiator_bytes": 463, "responder_bytes": 1148 }, { "flow_id": "flow-208735fea407fc04b936c5e3", "transport": "tcp", "stream": 301, "initiator_ip": "10.8.15.133", "initiator_port": 49983, "responder_ip": "23.221.36.164", "responder_port": 443, "first_frame": 15351, "last_frame": 15371, "first_seen_epoch": "1723681330.037825", "last_seen_epoch": "1723681330.395465", "packets": 18, "bytes": 6107, "initiator_bytes": 1224, "responder_bytes": 4883 }, { "flow_id": "flow-ba4af181bfbc349d67a643bb", "transport": "tcp", "stream": 302, "initiator_ip": "10.8.15.133", "initiator_port": 49984, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15372, "last_frame": 15380, "first_seen_epoch": "1723681334.091777", "last_seen_epoch": "1723681334.469933", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-44ebed32763344786a66cc72", "transport": "udp", "stream": 137, "initiator_ip": "10.8.15.133", "initiator_port": 56532, "responder_ip": "239.255.255.250", "responder_port": 1900, "first_frame": 15383, "last_frame": 15397, "first_seen_epoch": "1723681338.859354", "last_seen_epoch": "1723681341.895357", "packets": 4, "bytes": 868, "initiator_bytes": 868, "responder_bytes": 0 }, { "flow_id": "flow-c8c5e1c54e4ccdb412f310db", "transport": "tcp", "stream": 303, "initiator_ip": "10.8.15.133", "initiator_port": 49985, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15388, "last_frame": 15396, "first_seen_epoch": "1723681341.385537", "last_seen_epoch": "1723681341.762726", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-9b44cdd0d5bd71168f8b31ad", "transport": "tcp", "stream": 304, "initiator_ip": "10.8.15.133", "initiator_port": 49986, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15402, "last_frame": 15410, "first_seen_epoch": "1723681347.763689", "last_seen_epoch": "1723681348.136627", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-efa7c60c644201e383c91a2b", "transport": "tcp", "stream": 305, "initiator_ip": "10.8.15.133", "initiator_port": 49987, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15411, "last_frame": 15419, "first_seen_epoch": "1723681352.314877", "last_seen_epoch": "1723681352.678025", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-e8667eb1c248787ec3234b20", "transport": "tcp", "stream": 306, "initiator_ip": "10.8.15.133", "initiator_port": 49988, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15420, "last_frame": 15428, "first_seen_epoch": "1723681357.309448", "last_seen_epoch": "1723681357.7044", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-8edd96aeb863571428afdf94", "transport": "tcp", "stream": 307, "initiator_ip": "10.8.15.133", "initiator_port": 49989, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15431, "last_frame": 15439, "first_seen_epoch": "1723681363.26062", "last_seen_epoch": "1723681363.617796", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-2ffd282b00a4b04d4a799fbf", "transport": "tcp", "stream": 308, "initiator_ip": "10.8.15.133", "initiator_port": 49990, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15440, "last_frame": 15449, "first_seen_epoch": "1723681366.899424", "last_seen_epoch": "1723681367.808639", "packets": 10, "bytes": 1228, "initiator_bytes": 731, "responder_bytes": 497 }, { "flow_id": "flow-3693ebef9d5e47e170795500", "transport": "tcp", "stream": 309, "initiator_ip": "10.8.15.133", "initiator_port": 49991, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15450, "last_frame": 15459, "first_seen_epoch": "1723681371.178102", "last_seen_epoch": "1723681373.026333", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-c66660746fe5f2c1f93e47a5", "transport": "tcp", "stream": 310, "initiator_ip": "10.8.15.133", "initiator_port": 49992, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15460, "last_frame": 15468, "first_seen_epoch": "1723681377.523462", "last_seen_epoch": "1723681377.922762", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-09d57d4fff0f3e914080103c", "transport": "tcp", "stream": 311, "initiator_ip": "10.8.15.133", "initiator_port": 49993, "responder_ip": "23.53.13.197", "responder_port": 443, "first_frame": 15471, "last_frame": 15604, "first_seen_epoch": "1723681381.439492", "last_seen_epoch": "1723681441.729978", "packets": 22, "bytes": 8861, "initiator_bytes": 1109, "responder_bytes": 7752 }, { "flow_id": "flow-c49f695c9f74a7c2df78d96f", "transport": "tcp", "stream": 312, "initiator_ip": "10.8.15.133", "initiator_port": 49994, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15489, "last_frame": 15498, "first_seen_epoch": "1723681383.211205", "last_seen_epoch": "1723681383.576762", "packets": 10, "bytes": 1228, "initiator_bytes": 731, "responder_bytes": 497 }, { "flow_id": "flow-f7e5d2eed173e5e25b569f72", "transport": "tcp", "stream": 313, "initiator_ip": "10.8.15.133", "initiator_port": 49995, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15505, "last_frame": 15513, "first_seen_epoch": "1723681390.429985", "last_seen_epoch": "1723681390.812066", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-90c2b99423bc247d7893213b", "transport": "tcp", "stream": 314, "initiator_ip": "10.8.15.133", "initiator_port": 49996, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15514, "last_frame": 15522, "first_seen_epoch": "1723681396.695953", "last_seen_epoch": "1723681397.056481", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-20ee799cf2a7d8bf6120dfd5", "transport": "tcp", "stream": 315, "initiator_ip": "10.8.15.133", "initiator_port": 49997, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15523, "last_frame": 15532, "first_seen_epoch": "1723681401.008243", "last_seen_epoch": "1723681401.405651", "packets": 10, "bytes": 1228, "initiator_bytes": 731, "responder_bytes": 497 }, { "flow_id": "flow-2792efb16d3fa000405dcc53", "transport": "tcp", "stream": 316, "initiator_ip": "10.8.15.133", "initiator_port": 49998, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15533, "last_frame": 15541, "first_seen_epoch": "1723681405.602298", "last_seen_epoch": "1723681405.954434", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-efbd0d34338fbc42c471ac96", "transport": "tcp", "stream": 317, "initiator_ip": "10.8.15.133", "initiator_port": 49999, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15546, "last_frame": 15554, "first_seen_epoch": "1723681410.602402", "last_seen_epoch": "1723681410.967718", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-1950aba863d66c3651bfe286", "transport": "tcp", "stream": 318, "initiator_ip": "10.8.15.133", "initiator_port": 50000, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15555, "last_frame": 15565, "first_seen_epoch": "1723681416.53991", "last_seen_epoch": "1723681416.9166", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-c07a60810b9cace3a74461eb", "transport": "tcp", "stream": 319, "initiator_ip": "10.8.15.133", "initiator_port": 50001, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15566, "last_frame": 15574, "first_seen_epoch": "1723681420.243296", "last_seen_epoch": "1723681420.623141", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-cf6817c6d9b9df435eee86a3", "transport": "tcp", "stream": 320, "initiator_ip": "10.8.15.133", "initiator_port": 50002, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15577, "last_frame": 15585, "first_seen_epoch": "1723681427.649672", "last_seen_epoch": "1723681428.642316", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-e4c58589521bbf92c67a61fe", "transport": "tcp", "stream": 321, "initiator_ip": "10.8.15.133", "initiator_port": 50003, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15590, "last_frame": 15600, "first_seen_epoch": "1723681435.49645", "last_seen_epoch": "1723681435.869863", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-44a4d5bcb8ec4c61f3ae75a6", "transport": "tcp", "stream": 322, "initiator_ip": "10.8.15.133", "initiator_port": 50004, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15605, "last_frame": 15613, "first_seen_epoch": "1723681441.774357", "last_seen_epoch": "1723681442.147623", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-1f467b19d94c8a805b4ea7ff", "transport": "tcp", "stream": 323, "initiator_ip": "10.8.15.133", "initiator_port": 50005, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15614, "last_frame": 15624, "first_seen_epoch": "1723681446.123997", "last_seen_epoch": "1723681446.505565", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-7eb0156647c82e40668dd6e8", "transport": "tcp", "stream": 324, "initiator_ip": "10.8.15.133", "initiator_port": 50006, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15625, "last_frame": 15633, "first_seen_epoch": "1723681450.745256", "last_seen_epoch": "1723681451.13534", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-cd39daf6c00791214564e7ac", "transport": "tcp", "stream": 325, "initiator_ip": "10.8.15.133", "initiator_port": 50007, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15636, "last_frame": 15644, "first_seen_epoch": "1723681455.914759", "last_seen_epoch": "1723681456.556985", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-d4036e3c80a5a3587c617dc2", "transport": "udp", "stream": 138, "initiator_ip": "10.8.15.133", "initiator_port": 56533, "responder_ip": "239.255.255.250", "responder_port": 1900, "first_frame": 15645, "last_frame": 15648, "first_seen_epoch": "1723681458.87645", "last_seen_epoch": "1723681461.899983", "packets": 4, "bytes": 868, "initiator_bytes": 868, "responder_bytes": 0 }, { "flow_id": "flow-7f3cd36a17588d8e231cdbdd", "transport": "tcp", "stream": 326, "initiator_ip": "10.8.15.133", "initiator_port": 50008, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15649, "last_frame": 15658, "first_seen_epoch": "1723681462.666468", "last_seen_epoch": "1723681464.087962", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-69250c68f81465c084929aee", "transport": "tcp", "stream": 327, "initiator_ip": "10.8.15.133", "initiator_port": 50009, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15659, "last_frame": 15668, "first_seen_epoch": "1723681469.525175", "last_seen_epoch": "1723681469.914577", "packets": 10, "bytes": 1228, "initiator_bytes": 731, "responder_bytes": 497 }, { "flow_id": "flow-7bc09f49a3836e0711f19bbf", "transport": "tcp", "stream": 328, "initiator_ip": "10.8.15.133", "initiator_port": 50010, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15669, "last_frame": 15677, "first_seen_epoch": "1723681472.994012", "last_seen_epoch": "1723681473.377905", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-7b980d7a47d4b6773649571c", "transport": "tcp", "stream": 329, "initiator_ip": "10.8.15.133", "initiator_port": 50011, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15680, "last_frame": 15691, "first_seen_epoch": "1723681479.918875", "last_seen_epoch": "1723681481.990554", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-2081e0f2f546c1e169641f87", "transport": "tcp", "stream": 330, "initiator_ip": "10.8.15.133", "initiator_port": 50012, "responder_ip": "10.8.15.4", "responder_port": 445, "first_frame": 15692, "last_frame": 15739, "first_seen_epoch": "1723681486.486535", "last_seen_epoch": "1723681497.218747", "packets": 24, "bytes": 7676, "initiator_bytes": 5508, "responder_bytes": 2168 }, { "flow_id": "flow-d48ea8d57cbba8706759c1f7", "transport": "tcp", "stream": 331, "initiator_ip": "10.8.15.133", "initiator_port": 50013, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15711, "last_frame": 15723, "first_seen_epoch": "1723681488.947377", "last_seen_epoch": "1723681489.326262", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-c508a287a8b76d35d2a2e44d", "transport": "tcp", "stream": 332, "initiator_ip": "10.8.15.133", "initiator_port": 50014, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15724, "last_frame": 15732, "first_seen_epoch": "1723681495.432961", "last_seen_epoch": "1723681496.432347", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-efbbdce1603144837a16c05d", "transport": "tcp", "stream": 333, "initiator_ip": "10.8.15.133", "initiator_port": 50015, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15740, "last_frame": 15748, "first_seen_epoch": "1723681501.455912", "last_seen_epoch": "1723681501.857417", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-2cf60886e34bcc479a234482", "transport": "tcp", "stream": 334, "initiator_ip": "10.8.15.133", "initiator_port": 50016, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15749, "last_frame": 15757, "first_seen_epoch": "1723681508.198288", "last_seen_epoch": "1723681508.579278", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-f881b0b0ccb5bdc6d376a0e8", "transport": "udp", "stream": 136, "initiator_ip": "10.8.15.133", "initiator_port": 53, "responder_ip": "10.8.15.4", "responder_port": 62388, "first_frame": 15762, "last_frame": 15762, "first_seen_epoch": "1723681510.197475", "last_seen_epoch": "1723681510.197475", "packets": 1, "bytes": 257, "initiator_bytes": 257, "responder_bytes": 0 }, { "flow_id": "flow-58542ad36de7cd7f84028d3b", "transport": "tcp", "stream": 335, "initiator_ip": "10.8.15.133", "initiator_port": 50017, "responder_ip": "52.113.194.132", "responder_port": 443, "first_frame": 15763, "last_frame": 15852, "first_seen_epoch": "1723681510.203823", "last_seen_epoch": "1723681512.60208", "packets": 46, "bytes": 38947, "initiator_bytes": 1929, "responder_bytes": 37018 }, { "flow_id": "flow-3afa40b277377243d39b782e", "transport": "tcp", "stream": 336, "initiator_ip": "10.8.15.133", "initiator_port": 50018, "responder_ip": "52.113.194.132", "responder_port": 443, "first_frame": 15764, "last_frame": 15932, "first_seen_epoch": "1723681510.209472", "last_seen_epoch": "1723681532.130984", "packets": 48, "bytes": 39059, "initiator_bytes": 1983, "responder_bytes": 37076 }, { "flow_id": "flow-04c57503d1f03ea2d43166db", "transport": "tcp", "stream": 337, "initiator_ip": "10.8.15.133", "initiator_port": 50019, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15856, "last_frame": 15864, "first_seen_epoch": "1723681513.447557", "last_seen_epoch": "1723681513.832857", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-00a59a2deba94348198d493f", "transport": "udp", "stream": 139, "initiator_ip": "10.8.15.133", "initiator_port": 55916, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 15865, "last_frame": 15989, "first_seen_epoch": "1723681517.318589", "last_seen_epoch": "1723681540.736897", "packets": 11, "bytes": 1572, "initiator_bytes": 581, "responder_bytes": 991 }, { "flow_id": "flow-e5a886d0ff6fcfa24a68496c", "transport": "tcp", "stream": 338, "initiator_ip": "10.8.15.133", "initiator_port": 50020, "responder_ip": "20.25.227.174", "responder_port": 443, "first_frame": 15867, "last_frame": 15900, "first_seen_epoch": "1723681517.433213", "last_seen_epoch": "1723681517.946127", "packets": 24, "bytes": 9901, "initiator_bytes": 2157, "responder_bytes": 7744 }, { "flow_id": "flow-c5e272eb9857f79b8ef7fab6", "transport": "tcp", "stream": 339, "initiator_ip": "10.8.15.133", "initiator_port": 50021, "responder_ip": "204.79.197.203", "responder_port": 80, "first_frame": 15881, "last_frame": 16096, "first_seen_epoch": "1723681517.618663", "last_seen_epoch": "1723681578.612175", "packets": 12, "bytes": 3304, "initiator_bytes": 589, "responder_bytes": 2715 }, { "flow_id": "flow-d7ba6ad90c37af75a28881d9", "transport": "tcp", "stream": 340, "initiator_ip": "10.8.15.133", "initiator_port": 50022, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15903, "last_frame": 15911, "first_seen_epoch": "1723681519.85362", "last_seen_epoch": "1723681520.221809", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-476d9becdb5671e61c10f33e", "transport": "tcp", "stream": 341, "initiator_ip": "10.8.15.133", "initiator_port": 50023, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15912, "last_frame": 15921, "first_seen_epoch": "1723681524.44733", "last_seen_epoch": "1723681524.826625", "packets": 10, "bytes": 1228, "initiator_bytes": 731, "responder_bytes": 497 }, { "flow_id": "flow-27d9e8368547b901fea9501b", "transport": "tcp", "stream": 342, "initiator_ip": "10.8.15.133", "initiator_port": 50024, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15922, "last_frame": 15931, "first_seen_epoch": "1723681529.573341", "last_seen_epoch": "1723681529.950131", "packets": 10, "bytes": 1228, "initiator_bytes": 731, "responder_bytes": 497 }, { "flow_id": "flow-849b6d199c9668b3259454c4", "transport": "tcp", "stream": 343, "initiator_ip": "10.8.15.133", "initiator_port": 50025, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15933, "last_frame": 15941, "first_seen_epoch": "1723681535.717497", "last_seen_epoch": "1723681536.107323", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-63902440a1f5fa8fb593d762", "transport": "tcp", "stream": 344, "initiator_ip": "10.8.15.133", "initiator_port": 50026, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 15942, "last_frame": 15950, "first_seen_epoch": "1723681539.843695", "last_seen_epoch": "1723681540.205241", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-e9ac8b4ec24a663c3ffd868f", "transport": "udp", "stream": 140, "initiator_ip": "10.8.15.133", "initiator_port": 55918, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 15955, "last_frame": 15956, "first_seen_epoch": "1723681540.269376", "last_seen_epoch": "1723681540.269723", "packets": 2, "bytes": 564, "initiator_bytes": 316, "responder_bytes": 248 }, { "flow_id": "flow-2629a2bb76aa41d529927c3c", "transport": "tcp", "stream": 345, "initiator_ip": "10.8.15.133", "initiator_port": 50027, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 15957, "last_frame": 15973, "first_seen_epoch": "1723681540.373884", "last_seen_epoch": "1723681540.381393", "packets": 17, "bytes": 6751, "initiator_bytes": 3074, "responder_bytes": 3677 }, { "flow_id": "flow-3021908c52c24ac8ca5513e0", "transport": "tcp", "stream": 346, "initiator_ip": "10.8.15.133", "initiator_port": 50028, "responder_ip": "10.8.15.4", "responder_port": 389, "first_frame": 15974, "last_frame": 15986, "first_seen_epoch": "1723681540.393142", "last_seen_epoch": "1723681540.39737", "packets": 13, "bytes": 3344, "initiator_bytes": 2616, "responder_bytes": 728 }, { "flow_id": "flow-c0977379e10d3bfabcf2a8b3", "transport": "tcp", "stream": 347, "initiator_ip": "10.8.15.133", "initiator_port": 50029, "responder_ip": "20.96.153.111", "responder_port": 443, "first_frame": 15990, "last_frame": 16262, "first_seen_epoch": "1723681540.739387", "last_seen_epoch": "1723681666.616862", "packets": 29, "bytes": 10565, "initiator_bytes": 2822, "responder_bytes": 7743 }, { "flow_id": "flow-d7c6f44d3f83e5f23e2f4fec", "transport": "tcp", "stream": 348, "initiator_ip": "10.8.15.133", "initiator_port": 50030, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16020, "last_frame": 16028, "first_seen_epoch": "1723681543.933955", "last_seen_epoch": "1723681544.347328", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-33c7b893312e3795490552b8", "transport": "tcp", "stream": 349, "initiator_ip": "10.8.15.133", "initiator_port": 50031, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16031, "last_frame": 16039, "first_seen_epoch": "1723681548.136143", "last_seen_epoch": "1723681548.508617", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-a7659f00e3ba65b1599b1cdd", "transport": "tcp", "stream": 350, "initiator_ip": "10.8.15.133", "initiator_port": 50032, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16044, "last_frame": 16052, "first_seen_epoch": "1723681552.339249", "last_seen_epoch": "1723681552.717787", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-4f353c6470e35dd31de6b4ef", "transport": "tcp", "stream": 351, "initiator_ip": "10.8.15.133", "initiator_port": 50033, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16053, "last_frame": 16061, "first_seen_epoch": "1723681556.667384", "last_seen_epoch": "1723681557.057837", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-76082d1ae20af179c196b972", "transport": "tcp", "stream": 352, "initiator_ip": "10.8.15.133", "initiator_port": 50034, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16062, "last_frame": 16070, "first_seen_epoch": "1723681561.261469", "last_seen_epoch": "1723681561.638481", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-226916bf57a7b67dcd3e8e13", "transport": "tcp", "stream": 353, "initiator_ip": "10.8.15.133", "initiator_port": 50035, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16073, "last_frame": 16082, "first_seen_epoch": "1723681566.323893", "last_seen_epoch": "1723681566.711053", "packets": 10, "bytes": 1228, "initiator_bytes": 731, "responder_bytes": 497 }, { "flow_id": "flow-2445ee75551de7299df8b7d0", "transport": "tcp", "stream": 354, "initiator_ip": "10.8.15.133", "initiator_port": 50036, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16083, "last_frame": 16092, "first_seen_epoch": "1723681572.370442", "last_seen_epoch": "1723681574.457127", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-562ad1066b01c96a0a46f2d0", "transport": "udp", "stream": 141, "initiator_ip": "10.8.15.133", "initiator_port": 55919, "responder_ip": "239.255.255.250", "responder_port": 1900, "first_frame": 16097, "last_frame": 16105, "first_seen_epoch": "1723681578.889568", "last_seen_epoch": "1723681581.917327", "packets": 4, "bytes": 868, "initiator_bytes": 868, "responder_bytes": 0 }, { "flow_id": "flow-ed916dbd004516608e174d32", "transport": "tcp", "stream": 355, "initiator_ip": "10.8.15.133", "initiator_port": 50037, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16098, "last_frame": 16109, "first_seen_epoch": "1723681579.667819", "last_seen_epoch": "1723681581.990869", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-450ce92ae9431ebe1678aa06", "transport": "tcp", "stream": 356, "initiator_ip": "10.8.15.133", "initiator_port": 50038, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16110, "last_frame": 16120, "first_seen_epoch": "1723681586.543122", "last_seen_epoch": "1723681587.715528", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-125978c1cc8cf7d8430b16ca", "transport": "tcp", "stream": 357, "initiator_ip": "10.8.15.133", "initiator_port": 50039, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16121, "last_frame": 16129, "first_seen_epoch": "1723681593.902563", "last_seen_epoch": "1723681595.051984", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-2eb2e2864767694756f74d9a", "transport": "tcp", "stream": 358, "initiator_ip": "10.8.15.133", "initiator_port": 50040, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16130, "last_frame": 16138, "first_seen_epoch": "1723681600.371099", "last_seen_epoch": "1723681600.745708", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-8f5305ba492968987e0a14f6", "transport": "tcp", "stream": 359, "initiator_ip": "10.8.15.133", "initiator_port": 50041, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16139, "last_frame": 16148, "first_seen_epoch": "1723681607.684117", "last_seen_epoch": "1723681609.11435", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-9c832f3bb83bbf29e2eb3adc", "transport": "tcp", "stream": 360, "initiator_ip": "10.8.15.133", "initiator_port": 50042, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16151, "last_frame": 16161, "first_seen_epoch": "1723681616.215451", "last_seen_epoch": "1723681617.116684", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-a0ddd224418d74991a5b0092", "transport": "tcp", "stream": 361, "initiator_ip": "10.8.15.133", "initiator_port": 50043, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16164, "last_frame": 16176, "first_seen_epoch": "1723681624.030346", "last_seen_epoch": "1723681624.412123", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-2ceea2a6de58a0daefa02848", "transport": "tcp", "stream": 362, "initiator_ip": "10.8.15.133", "initiator_port": 50044, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16177, "last_frame": 16185, "first_seen_epoch": "1723681630.434401", "last_seen_epoch": "1723681630.797802", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-b763d9598f539712ee78663c", "transport": "tcp", "stream": 363, "initiator_ip": "10.8.15.133", "initiator_port": 50045, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16188, "last_frame": 16198, "first_seen_epoch": "1723681635.013014", "last_seen_epoch": "1723681635.391904", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-5036a1da56dab4e36fad0c2e", "transport": "tcp", "stream": 364, "initiator_ip": "10.8.15.133", "initiator_port": 50046, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16199, "last_frame": 16207, "first_seen_epoch": "1723681640.106352", "last_seen_epoch": "1723681640.478428", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-21df2dd0fbe08d81f6a5e791", "transport": "tcp", "stream": 365, "initiator_ip": "10.8.15.133", "initiator_port": 50047, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16208, "last_frame": 16218, "first_seen_epoch": "1723681646.169267", "last_seen_epoch": "1723681646.545411", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-d4cc212cd8fdfb20e9e46af5", "transport": "tcp", "stream": 366, "initiator_ip": "10.8.15.133", "initiator_port": 50048, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16219, "last_frame": 16227, "first_seen_epoch": "1723681650.107222", "last_seen_epoch": "1723681650.490913", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-8051dee69d325f37a54b4c86", "transport": "tcp", "stream": 367, "initiator_ip": "10.8.15.133", "initiator_port": 50049, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16228, "last_frame": 16236, "first_seen_epoch": "1723681653.90415", "last_seen_epoch": "1723681654.297659", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-927fac3657bf0c1e20a83ae5", "transport": "tcp", "stream": 368, "initiator_ip": "10.8.15.133", "initiator_port": 50050, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16241, "last_frame": 16250, "first_seen_epoch": "1723681657.435093", "last_seen_epoch": "1723681657.809524", "packets": 10, "bytes": 1228, "initiator_bytes": 731, "responder_bytes": 497 }, { "flow_id": "flow-3a0ab18f10a5ff233f4cccd2", "transport": "tcp", "stream": 369, "initiator_ip": "10.8.15.133", "initiator_port": 50051, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16251, "last_frame": 16261, "first_seen_epoch": "1723681664.467197", "last_seen_epoch": "1723681664.991277", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-f8d45b305890c3ca4d50080c", "transport": "udp", "stream": 142, "initiator_ip": "10.8.15.133", "initiator_port": 53742, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 16265, "last_frame": 16280, "first_seen_epoch": "1723681669.530149", "last_seen_epoch": "1723681672.618317", "packets": 5, "bytes": 582, "initiator_bytes": 356, "responder_bytes": 226 }, { "flow_id": "flow-0085c8ae20a411ed83aff6df", "transport": "tcp", "stream": 370, "initiator_ip": "10.8.15.133", "initiator_port": 50052, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16268, "last_frame": 16278, "first_seen_epoch": "1723681670.622852", "last_seen_epoch": "1723681670.981508", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-5b9bf54ee2218e557e83253b", "transport": "tcp", "stream": 371, "initiator_ip": "10.8.15.133", "initiator_port": 50053, "responder_ip": "52.168.117.170", "responder_port": 443, "first_frame": 16281, "last_frame": 16318, "first_seen_epoch": "1723681672.619588", "last_seen_epoch": "1723681673.316978", "packets": 38, "bytes": 13760, "initiator_bytes": 7835, "responder_bytes": 5925 }, { "flow_id": "flow-5ed19b1c4cab9d428001a183", "transport": "tcp", "stream": 372, "initiator_ip": "10.8.15.133", "initiator_port": 50054, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16319, "last_frame": 16327, "first_seen_epoch": "1723681674.421069", "last_seen_epoch": "1723681675.578335", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-8face372e4e863e7087b7985", "transport": "tcp", "stream": 373, "initiator_ip": "10.8.15.133", "initiator_port": 50055, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16330, "last_frame": 16392, "first_seen_epoch": "1723681679.513248", "last_seen_epoch": "1723681707.078596", "packets": 20, "bytes": 1787, "initiator_bytes": 851, "responder_bytes": 936 }, { "flow_id": "flow-bdf729ed4df49bee33560b67", "transport": "tcp", "stream": 374, "initiator_ip": "10.8.15.133", "initiator_port": 50056, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16347, "last_frame": 16355, "first_seen_epoch": "1723681687.388371", "last_seen_epoch": "1723681687.784713", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-3a802d8b579437145b78e416", "transport": "tcp", "stream": 375, "initiator_ip": "10.8.15.133", "initiator_port": 50057, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16357, "last_frame": 16365, "first_seen_epoch": "1723681691.63997", "last_seen_epoch": "1723681692.04364", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-e47d08fbd78467a7c149c5bf", "transport": "tcp", "stream": 376, "initiator_ip": "10.8.15.133", "initiator_port": 50058, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16367, "last_frame": 16375, "first_seen_epoch": "1723681696.060033", "last_seen_epoch": "1723681696.453717", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-6ee844f2e906273a209348ed", "transport": "udp", "stream": 143, "initiator_ip": "10.8.15.133", "initiator_port": 53743, "responder_ip": "239.255.255.250", "responder_port": 1900, "first_frame": 16376, "last_frame": 16383, "first_seen_epoch": "1723681698.893814", "last_seen_epoch": "1723681701.929794", "packets": 4, "bytes": 868, "initiator_bytes": 868, "responder_bytes": 0 }, { "flow_id": "flow-06cdc7eef484e5700c4a45f5", "transport": "tcp", "stream": 377, "initiator_ip": "10.8.15.133", "initiator_port": 50059, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16380, "last_frame": 16391, "first_seen_epoch": "1723681700.780222", "last_seen_epoch": "1723681702.866751", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-fdced58ced0aea9f21e363fa", "transport": "tcp", "stream": 378, "initiator_ip": "10.8.15.133", "initiator_port": 50060, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16393, "last_frame": 16402, "first_seen_epoch": "1723681709.509753", "last_seen_epoch": "1723681710.935438", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-2327b2d1bb3d2add70f67545", "transport": "tcp", "stream": 379, "initiator_ip": "10.8.15.133", "initiator_port": 50061, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16403, "last_frame": 16411, "first_seen_epoch": "1723681717.4511", "last_seen_epoch": "1723681717.841945", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-343998149ac070f99205eacb", "transport": "tcp", "stream": 380, "initiator_ip": "10.8.15.133", "initiator_port": 50062, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16414, "last_frame": 16422, "first_seen_epoch": "1723681723.080444", "last_seen_epoch": "1723681723.444234", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-971dd17576c08b517ec5d189", "transport": "tcp", "stream": 381, "initiator_ip": "10.8.15.133", "initiator_port": 50063, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16423, "last_frame": 16432, "first_seen_epoch": "1723681730.191921", "last_seen_epoch": "1723681731.84678", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-7695f2fc32e0f3e24acc0fff", "transport": "tcp", "stream": 382, "initiator_ip": "10.8.15.133", "initiator_port": 50064, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16433, "last_frame": 16441, "first_seen_epoch": "1723681738.797474", "last_seen_epoch": "1723681739.174956", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-5df535504566377e98eddadb", "transport": "tcp", "stream": 383, "initiator_ip": "10.8.15.133", "initiator_port": 50065, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16444, "last_frame": 16452, "first_seen_epoch": "1723681745.262366", "last_seen_epoch": "1723681745.666722", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-f508d8d524a5f480e80df1c5", "transport": "tcp", "stream": 384, "initiator_ip": "10.8.15.133", "initiator_port": 50066, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16453, "last_frame": 16461, "first_seen_epoch": "1723681750.045899", "last_seen_epoch": "1723681750.4129", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-166ed6ffe9a2ba0a59bdecea", "transport": "tcp", "stream": 385, "initiator_ip": "10.8.15.133", "initiator_port": 50067, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16462, "last_frame": 16470, "first_seen_epoch": "1723681755.451848", "last_seen_epoch": "1723681755.818288", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-736543f798e1acff6bcbf8d8", "transport": "tcp", "stream": 386, "initiator_ip": "10.8.15.133", "initiator_port": 50068, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16471, "last_frame": 16479, "first_seen_epoch": "1723681762.17245", "last_seen_epoch": "1723681763.187942", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-78a9bb35bf1b1df5dfa56903", "transport": "tcp", "stream": 387, "initiator_ip": "10.8.15.133", "initiator_port": 50069, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16482, "last_frame": 16490, "first_seen_epoch": "1723681768.721193", "last_seen_epoch": "1723681769.080739", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-4f740deb1a5eb54fa577801a", "transport": "tcp", "stream": 388, "initiator_ip": "10.8.15.133", "initiator_port": 50070, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16491, "last_frame": 16499, "first_seen_epoch": "1723681772.317026", "last_seen_epoch": "1723681772.678095", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-c501a2d39962019743357f19", "transport": "tcp", "stream": 389, "initiator_ip": "10.8.15.133", "initiator_port": 50071, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16500, "last_frame": 16508, "first_seen_epoch": "1723681779.500392", "last_seen_epoch": "1723681779.875027", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-bdb84fe8c0382f8734107968", "transport": "tcp", "stream": 390, "initiator_ip": "10.8.15.133", "initiator_port": 50072, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16514, "last_frame": 16522, "first_seen_epoch": "1723681785.703482", "last_seen_epoch": "1723681786.08936", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-e340f6e0dca246c02a729096", "transport": "tcp", "stream": 391, "initiator_ip": "10.8.15.133", "initiator_port": 50073, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16527, "last_frame": 16535, "first_seen_epoch": "1723681789.936196", "last_seen_epoch": "1723681790.298791", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-e5a730c17677f2bc02cd7155", "transport": "tcp", "stream": 392, "initiator_ip": "10.8.15.133", "initiator_port": 50074, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16536, "last_frame": 16544, "first_seen_epoch": "1723681794.267421", "last_seen_epoch": "1723681794.652869", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-ff50e359f08bfdbc5e63d0cf", "transport": "tcp", "stream": 393, "initiator_ip": "10.8.15.133", "initiator_port": 50075, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16546, "last_frame": 16554, "first_seen_epoch": "1723681798.889567", "last_seen_epoch": "1723681799.286531", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-36b74ac23df25c4b6bee59dc", "transport": "tcp", "stream": 394, "initiator_ip": "10.8.15.133", "initiator_port": 50076, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16557, "last_frame": 16565, "first_seen_epoch": "1723681804.040023", "last_seen_epoch": "1723681804.419068", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-59f3e56fb34d5fbb76e40b67", "transport": "tcp", "stream": 395, "initiator_ip": "10.8.15.133", "initiator_port": 50077, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16566, "last_frame": 16574, "first_seen_epoch": "1723681810.227605", "last_seen_epoch": "1723681810.60472", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-bdeff2eb2724434958c6c5dc", "transport": "tcp", "stream": 396, "initiator_ip": "10.8.15.133", "initiator_port": 50078, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 16575, "last_frame": 16845, "first_seen_epoch": "1723681810.62161", "last_seen_epoch": "1723681920.686428", "packets": 35, "bytes": 11699, "initiator_bytes": 2859, "responder_bytes": 8840 }, { "flow_id": "flow-c3d27d3f6d6bd2af983c36de", "transport": "tcp", "stream": 397, "initiator_ip": "10.8.15.133", "initiator_port": 50079, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16608, "last_frame": 16618, "first_seen_epoch": "1723681814.399517", "last_seen_epoch": "1723681814.790782", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-fbdf1b2f40a66d829319a75f", "transport": "tcp", "stream": 398, "initiator_ip": "10.8.15.133", "initiator_port": 50080, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16621, "last_frame": 16630, "first_seen_epoch": "1723681818.680877", "last_seen_epoch": "1723681819.139183", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-fd7c6dc58074b6750f27fb73", "transport": "udp", "stream": 144, "initiator_ip": "10.8.15.133", "initiator_port": 53744, "responder_ip": "239.255.255.250", "responder_port": 1900, "first_frame": 16622, "last_frame": 16635, "first_seen_epoch": "1723681818.903653", "last_seen_epoch": "1723681821.930353", "packets": 4, "bytes": 868, "initiator_bytes": 868, "responder_bytes": 0 }, { "flow_id": "flow-ca056ae7c6fc895f5bf251a9", "transport": "tcp", "stream": 399, "initiator_ip": "10.8.15.133", "initiator_port": 50081, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16636, "last_frame": 16645, "first_seen_epoch": "1723681823.274903", "last_seen_epoch": "1723681824.939379", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-1821fb97ed82ee00c1b8cd16", "transport": "tcp", "stream": 400, "initiator_ip": "10.8.15.133", "initiator_port": 50082, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16646, "last_frame": 16654, "first_seen_epoch": "1723681830.77482", "last_seen_epoch": "1723681831.148616", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-d2896181823b4cac0c5276ab", "transport": "tcp", "stream": 401, "initiator_ip": "10.8.15.133", "initiator_port": 50083, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16657, "last_frame": 16665, "first_seen_epoch": "1723681835.009037", "last_seen_epoch": "1723681835.379046", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-1a6b4c60a1437e05a4161fa0", "transport": "tcp", "stream": 402, "initiator_ip": "10.8.15.133", "initiator_port": 50084, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16666, "last_frame": 16674, "first_seen_epoch": "1723681839.3683", "last_seen_epoch": "1723681840.272284", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-79125f50e512b5bdad227e98", "transport": "tcp", "stream": 403, "initiator_ip": "10.8.15.133", "initiator_port": 50085, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16677, "last_frame": 16685, "first_seen_epoch": "1723681845.055675", "last_seen_epoch": "1723681845.979228", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-f96bed2e5234d3918494939e", "transport": "tcp", "stream": 404, "initiator_ip": "10.8.15.133", "initiator_port": 50086, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16688, "last_frame": 16697, "first_seen_epoch": "1723681852.385486", "last_seen_epoch": "1723681854.818289", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-7116f1ab46e95e970c5bb4d4", "transport": "udp", "stream": 145, "initiator_ip": "10.8.15.133", "initiator_port": 56835, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 16702, "last_frame": 16792, "first_seen_epoch": "1723681860.168429", "last_seen_epoch": "1723681909.536295", "packets": 7, "bytes": 829, "initiator_bytes": 439, "responder_bytes": 390 }, { "flow_id": "flow-2901ceeeddc68039a43316ac", "transport": "tcp", "stream": 405, "initiator_ip": "10.8.15.133", "initiator_port": 50087, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16704, "last_frame": 16712, "first_seen_epoch": "1723681861.854095", "last_seen_epoch": "1723681862.228925", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-2318cc764ac1da2788c4d4fa", "transport": "tcp", "stream": 406, "initiator_ip": "10.8.15.133", "initiator_port": 50088, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16713, "last_frame": 16721, "first_seen_epoch": "1723681868.480504", "last_seen_epoch": "1723681868.878982", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-ddba9ac9e0269341104c5cce", "transport": "tcp", "stream": 407, "initiator_ip": "10.8.15.133", "initiator_port": 50089, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16722, "last_frame": 16731, "first_seen_epoch": "1723681873.607092", "last_seen_epoch": "1723681875.294937", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-4e0be716679cf14c254f70da", "transport": "tcp", "stream": 408, "initiator_ip": "10.8.15.133", "initiator_port": 50090, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16734, "last_frame": 16745, "first_seen_epoch": "1723681882.339635", "last_seen_epoch": "1723681884.42747", "packets": 12, "bytes": 1348, "initiator_bytes": 851, "responder_bytes": 497 }, { "flow_id": "flow-eceebf991d6e4ab869066b2a", "transport": "tcp", "stream": 409, "initiator_ip": "10.8.15.133", "initiator_port": 50091, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16746, "last_frame": 16754, "first_seen_epoch": "1723681888.275995", "last_seen_epoch": "1723681889.419708", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-495876dff7a1d5d84d6487ac", "transport": "tcp", "stream": 410, "initiator_ip": "10.8.15.133", "initiator_port": 50092, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16755, "last_frame": 16763, "first_seen_epoch": "1723681894.213257", "last_seen_epoch": "1723681895.639018", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-d210a34d9d1545d24844701e", "transport": "tcp", "stream": 411, "initiator_ip": "10.8.15.133", "initiator_port": 50093, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16768, "last_frame": 16776, "first_seen_epoch": "1723681902.557639", "last_seen_epoch": "1723681902.91936", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-782cc23ae6e40a9683b4cf85", "transport": "tcp", "stream": 412, "initiator_ip": "10.8.15.133", "initiator_port": 50094, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16782, "last_frame": 16791, "first_seen_epoch": "1723681908.916963", "last_seen_epoch": "1723681909.40727", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-c255e5f77cebf836a2eed25c", "transport": "tcp", "stream": 413, "initiator_ip": "10.8.15.133", "initiator_port": 50095, "responder_ip": "20.189.173.9", "responder_port": 443, "first_frame": 16793, "last_frame": 16821, "first_seen_epoch": "1723681909.537116", "last_seen_epoch": "1723681910.052387", "packets": 27, "bytes": 8327, "initiator_bytes": 2835, "responder_bytes": 5492 }, { "flow_id": "flow-27f06702b73929c6e48eb232", "transport": "tcp", "stream": 414, "initiator_ip": "10.8.15.133", "initiator_port": 50096, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16822, "last_frame": 16832, "first_seen_epoch": "1723681913.698326", "last_seen_epoch": "1723681914.731253", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-39b899dd6321c9e1fb3ff05c", "transport": "tcp", "stream": 415, "initiator_ip": "10.8.15.133", "initiator_port": 50097, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16833, "last_frame": 16843, "first_seen_epoch": "1723681920.26226", "last_seen_epoch": "1723681920.652891", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-5edd89888c2d29af7fea3712", "transport": "tcp", "stream": 416, "initiator_ip": "10.8.15.133", "initiator_port": 50098, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16846, "last_frame": 16856, "first_seen_epoch": "1723681923.888431", "last_seen_epoch": "1723681925.04544", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-b9b2263949b88e314909c94b", "transport": "tcp", "stream": 417, "initiator_ip": "10.8.15.133", "initiator_port": 50099, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16857, "last_frame": 16865, "first_seen_epoch": "1723681928.590255", "last_seen_epoch": "1723681928.979664", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-84fc079794913cab90814c3b", "transport": "tcp", "stream": 418, "initiator_ip": "10.8.15.133", "initiator_port": 50100, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16866, "last_frame": 16874, "first_seen_epoch": "1723681932.371945", "last_seen_epoch": "1723681932.759155", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-cd37d4d85ef82da8050a56b4", "transport": "tcp", "stream": 419, "initiator_ip": "10.8.15.133", "initiator_port": 50101, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16875, "last_frame": 16883, "first_seen_epoch": "1723681935.824796", "last_seen_epoch": "1723681936.684649", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-34790e338f5239c637e4c5cc", "transport": "udp", "stream": 146, "initiator_ip": "10.8.15.133", "initiator_port": 56836, "responder_ip": "239.255.255.250", "responder_port": 1900, "first_frame": 16884, "last_frame": 16887, "first_seen_epoch": "1723681938.91462", "last_seen_epoch": "1723681941.949202", "packets": 4, "bytes": 868, "initiator_bytes": 868, "responder_bytes": 0 }, { "flow_id": "flow-a8f2548e7c1ab70f6a8fa35a", "transport": "tcp", "stream": 420, "initiator_ip": "10.8.15.133", "initiator_port": 50102, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16888, "last_frame": 16896, "first_seen_epoch": "1723681943.684321", "last_seen_epoch": "1723681944.071305", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-5b07ac49db6a9938f155df28", "transport": "tcp", "stream": 421, "initiator_ip": "10.8.15.133", "initiator_port": 50103, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16899, "last_frame": 16907, "first_seen_epoch": "1723681950.245895", "last_seen_epoch": "1723681950.607704", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-e16e39f69c91d50f5c996dfa", "transport": "tcp", "stream": 422, "initiator_ip": "10.8.15.133", "initiator_port": 50104, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16908, "last_frame": 16916, "first_seen_epoch": "1723681955.136334", "last_seen_epoch": "1723681955.702137", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-91ab9c020a22685995db11e5", "transport": "tcp", "stream": 423, "initiator_ip": "10.8.15.133", "initiator_port": 50105, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16917, "last_frame": 16927, "first_seen_epoch": "1723681961.236479", "last_seen_epoch": "1723681961.598663", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-02e6185cefd41f9e7926cc4f", "transport": "tcp", "stream": 424, "initiator_ip": "10.8.15.133", "initiator_port": 50106, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16928, "last_frame": 16937, "first_seen_epoch": "1723681964.825453", "last_seen_epoch": "1723681965.204382", "packets": 10, "bytes": 1228, "initiator_bytes": 731, "responder_bytes": 497 }, { "flow_id": "flow-78b97bfcfd83a9869bb47f9e", "transport": "tcp", "stream": 425, "initiator_ip": "10.8.15.133", "initiator_port": 50107, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16940, "last_frame": 16948, "first_seen_epoch": "1723681972.029223", "last_seen_epoch": "1723681972.398165", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-ef8e0cd38cb73541c0cb5bd1", "transport": "tcp", "stream": 426, "initiator_ip": "10.8.15.133", "initiator_port": 50108, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16949, "last_frame": 16957, "first_seen_epoch": "1723681978.230801", "last_seen_epoch": "1723681978.620045", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-7b510c6082e301ff1a42eedb", "transport": "tcp", "stream": 427, "initiator_ip": "10.8.15.133", "initiator_port": 50109, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16958, "last_frame": 16968, "first_seen_epoch": "1723681982.496472", "last_seen_epoch": "1723681982.875138", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-1f37280695ff15fddc37c85d", "transport": "tcp", "stream": 428, "initiator_ip": "10.8.15.133", "initiator_port": 50110, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16969, "last_frame": 16977, "first_seen_epoch": "1723681986.887614", "last_seen_epoch": "1723681987.25915", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-3a67460b3c05b15eb16b68f5", "transport": "tcp", "stream": 429, "initiator_ip": "10.8.15.133", "initiator_port": 50111, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16978, "last_frame": 16990, "first_seen_epoch": "1723681991.577231", "last_seen_epoch": "1723681991.958196", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-c558aaea246b18909102f6ea", "transport": "tcp", "stream": 430, "initiator_ip": "10.8.15.133", "initiator_port": 50112, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 16991, "last_frame": 16999, "first_seen_epoch": "1723681996.871716", "last_seen_epoch": "1723681997.248644", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-edadecb25848428a843a5e4d", "transport": "tcp", "stream": 431, "initiator_ip": "10.8.15.133", "initiator_port": 50113, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17000, "last_frame": 17008, "first_seen_epoch": "1723682003.372497", "last_seen_epoch": "1723682003.75229", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-81fbe8d81d083a9c26f77335", "transport": "tcp", "stream": 432, "initiator_ip": "10.8.15.133", "initiator_port": 50114, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17009, "last_frame": 17017, "first_seen_epoch": "1723682008.185736", "last_seen_epoch": "1723682008.56836", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-642030bf09f578af6f2e5e6d", "transport": "tcp", "stream": 433, "initiator_ip": "10.8.15.133", "initiator_port": 50115, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17018, "last_frame": 17028, "first_seen_epoch": "1723682013.715665", "last_seen_epoch": "1723682014.097651", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-071f37e917389194bf835e8f", "transport": "tcp", "stream": 434, "initiator_ip": "10.8.15.133", "initiator_port": 50116, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17031, "last_frame": 17039, "first_seen_epoch": "1723682020.68193", "last_seen_epoch": "1723682021.059359", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-0727930683fb82f2574b2a40", "transport": "tcp", "stream": 435, "initiator_ip": "10.8.15.133", "initiator_port": 50117, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17042, "last_frame": 17051, "first_seen_epoch": "1723682026.399828", "last_seen_epoch": "1723682026.789522", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-e97332b036c64f9f3b0b161d", "transport": "tcp", "stream": 436, "initiator_ip": "10.8.15.133", "initiator_port": 50118, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17054, "last_frame": 17062, "first_seen_epoch": "1723682033.764153", "last_seen_epoch": "1723682034.148057", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-367130446cabf32b06ddcb84", "transport": "tcp", "stream": 437, "initiator_ip": "10.8.15.133", "initiator_port": 50119, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17065, "last_frame": 17075, "first_seen_epoch": "1723682040.292489", "last_seen_epoch": "1723682040.671253", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-4ac9418b18befbc105e8cd06", "transport": "tcp", "stream": 438, "initiator_ip": "10.8.15.133", "initiator_port": 50120, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17078, "last_frame": 17086, "first_seen_epoch": "1723682045.156978", "last_seen_epoch": "1723682045.539712", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-120304fd503654dadf24f21e", "transport": "tcp", "stream": 439, "initiator_ip": "10.8.15.133", "initiator_port": 50121, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17087, "last_frame": 17095, "first_seen_epoch": "1723682050.794691", "last_seen_epoch": "1723682051.179889", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-7903d42b68c20158b3bb0303", "transport": "tcp", "stream": 440, "initiator_ip": "10.8.15.133", "initiator_port": 50122, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17100, "last_frame": 17112, "first_seen_epoch": "1723682057.982335", "last_seen_epoch": "1723682059.657788", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-c0599547f9a9c3153a522196", "transport": "udp", "stream": 147, "initiator_ip": "10.8.15.133", "initiator_port": 56837, "responder_ip": "239.255.255.250", "responder_port": 1900, "first_frame": 17101, "last_frame": 17115, "first_seen_epoch": "1723682058.923035", "last_seen_epoch": "1723682061.966193", "packets": 4, "bytes": 868, "initiator_bytes": 868, "responder_bytes": 0 }, { "flow_id": "flow-ee982a97e43a26cc1916dd56", "transport": "tcp", "stream": 441, "initiator_ip": "10.8.15.133", "initiator_port": 50123, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17116, "last_frame": 17125, "first_seen_epoch": "1723682066.748112", "last_seen_epoch": "1723682068.640127", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-a271f52b00cf387a5c77fc84", "transport": "udp", "stream": 148, "initiator_ip": "10.8.15.133", "initiator_port": 65223, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 17126, "last_frame": 17128, "first_seen_epoch": "1723682071.03699", "last_seen_epoch": "1723682071.184741", "packets": 3, "bytes": 377, "initiator_bytes": 148, "responder_bytes": 229 }, { "flow_id": "flow-8087d6b9956e366cb80ba371", "transport": "tcp", "stream": 442, "initiator_ip": "10.8.15.133", "initiator_port": 50124, "responder_ip": "52.113.194.132", "responder_port": 443, "first_frame": 17129, "last_frame": 17293, "first_seen_epoch": "1723682071.185747", "last_seen_epoch": "1723682144.334419", "packets": 32, "bytes": 11793, "initiator_bytes": 2633, "responder_bytes": 9160 }, { "flow_id": "flow-52ec24ac1b2508308f315e19", "transport": "tcp", "stream": 443, "initiator_ip": "10.8.15.133", "initiator_port": 50125, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17153, "last_frame": 17161, "first_seen_epoch": "1723682072.411585", "last_seen_epoch": "1723682072.782686", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-8b2552ba04ed541f8f8a4473", "transport": "tcp", "stream": 444, "initiator_ip": "10.8.15.133", "initiator_port": 50126, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17166, "last_frame": 17174, "first_seen_epoch": "1723682076.602985", "last_seen_epoch": "1723682076.988361", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-bcdccd8ba6a2a695ee64c9e8", "transport": "tcp", "stream": 445, "initiator_ip": "10.8.15.133", "initiator_port": 50127, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17179, "last_frame": 17190, "first_seen_epoch": "1723682080.920274", "last_seen_epoch": "1723682083.368902", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-5c8978c69a677bea085e1ec9", "transport": "tcp", "stream": 446, "initiator_ip": "10.8.15.133", "initiator_port": 50128, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17191, "last_frame": 17201, "first_seen_epoch": "1723682089.576648", "last_seen_epoch": "1723682089.952378", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-c69ee797c705a0f03420e140", "transport": "tcp", "stream": 447, "initiator_ip": "10.8.15.133", "initiator_port": 50129, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17202, "last_frame": 17210, "first_seen_epoch": "1723682094.561334", "last_seen_epoch": "1723682094.910578", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-f953f442464cfcaeec1e0d8f", "transport": "tcp", "stream": 448, "initiator_ip": "10.8.15.133", "initiator_port": 50130, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17211, "last_frame": 17219, "first_seen_epoch": "1723682100.379096", "last_seen_epoch": "1723682101.358978", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-8546526c35e3c8221c4a18b9", "transport": "tcp", "stream": 449, "initiator_ip": "10.8.15.133", "initiator_port": 50131, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17222, "last_frame": 17230, "first_seen_epoch": "1723682105.09327", "last_seen_epoch": "1723682105.720997", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-d07d43e24d794c03e31d3e29", "transport": "tcp", "stream": 450, "initiator_ip": "10.8.15.133", "initiator_port": 50132, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17231, "last_frame": 17240, "first_seen_epoch": "1723682109.718928", "last_seen_epoch": "1723682111.755691", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-cf7175c13fc1d5b10b7edbc8", "transport": "tcp", "stream": 451, "initiator_ip": "10.8.15.133", "initiator_port": 50133, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17241, "last_frame": 17250, "first_seen_epoch": "1723682117.68727", "last_seen_epoch": "1723682118.067574", "packets": 10, "bytes": 1228, "initiator_bytes": 731, "responder_bytes": 497 }, { "flow_id": "flow-dbb6d258197e5f84e9a5d42c", "transport": "tcp", "stream": 452, "initiator_ip": "10.8.15.133", "initiator_port": 50134, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17251, "last_frame": 17259, "first_seen_epoch": "1723682122.112949", "last_seen_epoch": "1723682124.152532", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-fc284a74189bf790137d97ae", "transport": "tcp", "stream": 453, "initiator_ip": "10.8.15.133", "initiator_port": 50135, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17262, "last_frame": 17270, "first_seen_epoch": "1723682130.186745", "last_seen_epoch": "1723682130.565387", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-ca6fa0f24fdfb8430058aae4", "transport": "tcp", "stream": 454, "initiator_ip": "10.8.15.133", "initiator_port": 50136, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17271, "last_frame": 17279, "first_seen_epoch": "1723682134.829297", "last_seen_epoch": "1723682135.219437", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-d1914bdc32ec6cf43f4ac051", "transport": "tcp", "stream": 455, "initiator_ip": "10.8.15.133", "initiator_port": 50137, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17280, "last_frame": 17288, "first_seen_epoch": "1723682140.03155", "last_seen_epoch": "1723682140.431222", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-60460e80833363ebf9c1541e", "transport": "tcp", "stream": 456, "initiator_ip": "10.8.15.133", "initiator_port": 50138, "responder_ip": "52.113.194.132", "responder_port": 443, "first_frame": 17291, "last_frame": 17429, "first_seen_epoch": "1723682143.922455", "last_seen_epoch": "1723682210.066007", "packets": 19, "bytes": 4440, "initiator_bytes": 2714, "responder_bytes": 1726 }, { "flow_id": "flow-c578b6f09c4238bad2a46972", "transport": "tcp", "stream": 457, "initiator_ip": "10.8.15.133", "initiator_port": 50139, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17313, "last_frame": 17322, "first_seen_epoch": "1723682146.358978", "last_seen_epoch": "1723682148.800126", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-b360b4533574b60f3b1781bb", "transport": "tcp", "stream": 458, "initiator_ip": "10.8.15.133", "initiator_port": 50140, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17327, "last_frame": 17335, "first_seen_epoch": "1723682154.908832", "last_seen_epoch": "1723682155.273841", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-acf6dce80a6c6a08dd0c50cd", "transport": "tcp", "stream": 459, "initiator_ip": "10.8.15.133", "initiator_port": 50141, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17336, "last_frame": 17344, "first_seen_epoch": "1723682159.671815", "last_seen_epoch": "1723682160.059945", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-6f3cbda5bed378b78746cd85", "transport": "tcp", "stream": 460, "initiator_ip": "10.8.15.133", "initiator_port": 50142, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17345, "last_frame": 17353, "first_seen_epoch": "1723682165.145344", "last_seen_epoch": "1723682165.538761", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-c5b31d3be0b381dd30d1abcd", "transport": "tcp", "stream": 461, "initiator_ip": "10.8.15.133", "initiator_port": 50143, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17356, "last_frame": 17365, "first_seen_epoch": "1723682172.00011", "last_seen_epoch": "1723682173.681294", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-e38445bf7671e3a36844b854", "transport": "udp", "stream": 149, "initiator_ip": "10.8.15.133", "initiator_port": 65224, "responder_ip": "239.255.255.250", "responder_port": 1900, "first_frame": 17366, "last_frame": 17378, "first_seen_epoch": "1723682178.941562", "last_seen_epoch": "1723682181.983964", "packets": 4, "bytes": 868, "initiator_bytes": 868, "responder_bytes": 0 }, { "flow_id": "flow-3976add53a69aaffea7995af", "transport": "tcp", "stream": 462, "initiator_ip": "10.8.15.133", "initiator_port": 50144, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17368, "last_frame": 17376, "first_seen_epoch": "1723682180.093993", "last_seen_epoch": "1723682180.487884", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-cb8a3395f61dea1169dc6cdb", "transport": "tcp", "stream": 463, "initiator_ip": "10.8.15.133", "initiator_port": 50145, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17379, "last_frame": 17388, "first_seen_epoch": "1723682185.515953", "last_seen_epoch": "1723682186.939134", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-cca537a2afc602e5a8c584d9", "transport": "tcp", "stream": 464, "initiator_ip": "10.8.15.133", "initiator_port": 50146, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17389, "last_frame": 17399, "first_seen_epoch": "1723682190.234841", "last_seen_epoch": "1723682190.620391", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-490d1e7e220dc57818544ecb", "transport": "tcp", "stream": 465, "initiator_ip": "10.8.15.133", "initiator_port": 50147, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17402, "last_frame": 17410, "first_seen_epoch": "1723682197.59416", "last_seen_epoch": "1723682197.979924", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-6cf2e0da5f457383327906f7", "transport": "tcp", "stream": 466, "initiator_ip": "10.8.15.133", "initiator_port": 50148, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17411, "last_frame": 17419, "first_seen_epoch": "1723682204.110306", "last_seen_epoch": "1723682204.479715", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-745deb5a02102a08b5eebde3", "transport": "tcp", "stream": 467, "initiator_ip": "10.8.15.133", "initiator_port": 50149, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17420, "last_frame": 17428, "first_seen_epoch": "1723682208.922937", "last_seen_epoch": "1723682209.313022", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-9784fb5a0959f940da012521", "transport": "tcp", "stream": 468, "initiator_ip": "10.8.15.133", "initiator_port": 50150, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17430, "last_frame": 17439, "first_seen_epoch": "1723682214.50119", "last_seen_epoch": "1723682215.457352", "packets": 10, "bytes": 1228, "initiator_bytes": 731, "responder_bytes": 497 }, { "flow_id": "flow-70e01526a226897f2e8af6a6", "transport": "tcp", "stream": 469, "initiator_ip": "10.8.15.133", "initiator_port": 50151, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17442, "last_frame": 17450, "first_seen_epoch": "1723682218.595144", "last_seen_epoch": "1723682218.980016", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-90aed54d62801a3a6e252ce4", "transport": "tcp", "stream": 470, "initiator_ip": "10.8.15.133", "initiator_port": 50152, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17451, "last_frame": 17459, "first_seen_epoch": "1723682225.642127", "last_seen_epoch": "1723682226.020017", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-5afc14bae2ceef7c4be73100", "transport": "tcp", "stream": 471, "initiator_ip": "10.8.15.133", "initiator_port": 50153, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17460, "last_frame": 17468, "first_seen_epoch": "1723682231.532663", "last_seen_epoch": "1723682231.899308", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-6b1c2fe065be9782c2bac123", "transport": "tcp", "stream": 472, "initiator_ip": "10.8.15.133", "initiator_port": 50154, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17469, "last_frame": 17477, "first_seen_epoch": "1723682235.095338", "last_seen_epoch": "1723682235.469542", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-edc5c50cc05885af22b538ac", "transport": "tcp", "stream": 473, "initiator_ip": "10.8.15.133", "initiator_port": 50155, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17480, "last_frame": 17488, "first_seen_epoch": "1723682242.236126", "last_seen_epoch": "1723682242.600806", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-a5f022b164a2a328578f49b8", "transport": "tcp", "stream": 474, "initiator_ip": "10.8.15.133", "initiator_port": 50156, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17489, "last_frame": 17497, "first_seen_epoch": "1723682248.304686", "last_seen_epoch": "1723682248.691351", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-52b2638d6c2c39db8272225e", "transport": "tcp", "stream": 475, "initiator_ip": "10.8.15.133", "initiator_port": 50157, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17498, "last_frame": 17506, "first_seen_epoch": "1723682252.300305", "last_seen_epoch": "1723682252.663419", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-80f09fda344527c7fd289f22", "transport": "tcp", "stream": 476, "initiator_ip": "10.8.15.133", "initiator_port": 50158, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17507, "last_frame": 17515, "first_seen_epoch": "1723682256.143369", "last_seen_epoch": "1723682256.513793", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-f9039911e2e6fea95ab78744", "transport": "tcp", "stream": 477, "initiator_ip": "10.8.15.133", "initiator_port": 50159, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17516, "last_frame": 17524, "first_seen_epoch": "1723682259.738486", "last_seen_epoch": "1723682260.113583", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-d5f025a68e9c9d2714271729", "transport": "tcp", "stream": 478, "initiator_ip": "10.8.15.133", "initiator_port": 50160, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17529, "last_frame": 17537, "first_seen_epoch": "1723682266.955399", "last_seen_epoch": "1723682267.350947", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-71c108f38b6adbc43384f09c", "transport": "tcp", "stream": 479, "initiator_ip": "10.8.15.133", "initiator_port": 50161, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17540, "last_frame": 17549, "first_seen_epoch": "1723682273.236723", "last_seen_epoch": "1723682273.61246", "packets": 10, "bytes": 1228, "initiator_bytes": 731, "responder_bytes": 497 }, { "flow_id": "flow-56cc70adb4346821c3ab3812", "transport": "tcp", "stream": 480, "initiator_ip": "10.8.15.133", "initiator_port": 50162, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17550, "last_frame": 17558, "first_seen_epoch": "1723682277.565097", "last_seen_epoch": "1723682277.939721", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-a88b63731d56dc71d7636a30", "transport": "tcp", "stream": 481, "initiator_ip": "10.8.15.133", "initiator_port": 50163, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17559, "last_frame": 17567, "first_seen_epoch": "1723682282.127467", "last_seen_epoch": "1723682282.503484", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-aed447c12e0fdccd60a7dd2d", "transport": "tcp", "stream": 482, "initiator_ip": "10.8.15.133", "initiator_port": 50164, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17570, "last_frame": 17578, "first_seen_epoch": "1723682287.158879", "last_seen_epoch": "1723682287.534203", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-4e489e529f58c7160a662a98", "transport": "tcp", "stream": 483, "initiator_ip": "10.8.15.133", "initiator_port": 50165, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17581, "last_frame": 17589, "first_seen_epoch": "1723682293.112653", "last_seen_epoch": "1723682293.493154", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-165b35c9b51b7feea95da82a", "transport": "tcp", "stream": 484, "initiator_ip": "10.8.15.133", "initiator_port": 50166, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17590, "last_frame": 17599, "first_seen_epoch": "1723682296.847811", "last_seen_epoch": "1723682297.240605", "packets": 10, "bytes": 1228, "initiator_bytes": 731, "responder_bytes": 497 }, { "flow_id": "flow-057ba0fdb152690262d1498c", "transport": "udp", "stream": 150, "initiator_ip": "10.8.15.133", "initiator_port": 65225, "responder_ip": "239.255.255.250", "responder_port": 1900, "first_frame": 17600, "last_frame": 17604, "first_seen_epoch": "1723682298.943814", "last_seen_epoch": "1723682301.986852", "packets": 4, "bytes": 868, "initiator_bytes": 868, "responder_bytes": 0 }, { "flow_id": "flow-4bc2b1d347c7b0e6094868d8", "transport": "tcp", "stream": 485, "initiator_ip": "10.8.15.133", "initiator_port": 50167, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17607, "last_frame": 17615, "first_seen_epoch": "1723682304.315348", "last_seen_epoch": "1723682304.693227", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-477645b81a1a7e765ee9bc58", "transport": "tcp", "stream": 486, "initiator_ip": "10.8.15.133", "initiator_port": 50168, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17618, "last_frame": 17626, "first_seen_epoch": "1723682311.049789", "last_seen_epoch": "1723682311.422494", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-30376e63fca0d5e96763cafa", "transport": "tcp", "stream": 487, "initiator_ip": "10.8.15.133", "initiator_port": 50169, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17627, "last_frame": 17635, "first_seen_epoch": "1723682316.300088", "last_seen_epoch": "1723682316.660768", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-60cbacc826cd32bfbd4531f8", "transport": "tcp", "stream": 488, "initiator_ip": "10.8.15.133", "initiator_port": 50170, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17636, "last_frame": 17644, "first_seen_epoch": "1723682322.706586", "last_seen_epoch": "1723682323.081135", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-9edf5474a58da47322a5e79c", "transport": "tcp", "stream": 489, "initiator_ip": "10.8.15.133", "initiator_port": 50171, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17645, "last_frame": 17654, "first_seen_epoch": "1723682327.356092", "last_seen_epoch": "1723682327.736971", "packets": 10, "bytes": 1228, "initiator_bytes": 731, "responder_bytes": 497 }, { "flow_id": "flow-6877bd646a6fb8a73543c810", "transport": "tcp", "stream": 490, "initiator_ip": "10.8.15.133", "initiator_port": 50172, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17657, "last_frame": 17665, "first_seen_epoch": "1723682332.56611", "last_seen_epoch": "1723682333.051464", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-1837f4a20260b43ebd38eac2", "transport": "tcp", "stream": 491, "initiator_ip": "10.8.15.133", "initiator_port": 50173, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17666, "last_frame": 17674, "first_seen_epoch": "1723682339.09839", "last_seen_epoch": "1723682339.472028", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-14629bb8be5e563bdcda5dc9", "transport": "tcp", "stream": 492, "initiator_ip": "10.8.15.133", "initiator_port": 50174, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17675, "last_frame": 17683, "first_seen_epoch": "1723682343.739315", "last_seen_epoch": "1723682344.115551", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-6414342ef6ef1ed12de8f1d8", "transport": "tcp", "stream": 493, "initiator_ip": "10.8.15.133", "initiator_port": 50175, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17684, "last_frame": 17692, "first_seen_epoch": "1723682348.942606", "last_seen_epoch": "1723682349.302633", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-461b4c7cfddbd190756e96ce", "transport": "tcp", "stream": 494, "initiator_ip": "10.8.15.133", "initiator_port": 50176, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17695, "last_frame": 17703, "first_seen_epoch": "1723682355.208405", "last_seen_epoch": "1723682355.580943", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-fce5fd53c6d30c8d39abe05d", "transport": "tcp", "stream": 495, "initiator_ip": "10.8.15.133", "initiator_port": 50177, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17704, "last_frame": 17712, "first_seen_epoch": "1723682359.5664", "last_seen_epoch": "1723682359.941208", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-f84fd88be4b5e6eccbe4595b", "transport": "tcp", "stream": 496, "initiator_ip": "10.8.15.133", "initiator_port": 50178, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17713, "last_frame": 17721, "first_seen_epoch": "1723682364.207358", "last_seen_epoch": "1723682364.597235", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-2f1e4498cd33bc53a831f93b", "transport": "tcp", "stream": 497, "initiator_ip": "10.8.15.133", "initiator_port": 50179, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17722, "last_frame": 17730, "first_seen_epoch": "1723682369.426021", "last_seen_epoch": "1723682369.794482", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-af4438bc1f3bf55c3440f198", "transport": "tcp", "stream": 498, "initiator_ip": "10.8.15.133", "initiator_port": 50180, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17733, "last_frame": 17742, "first_seen_epoch": "1723682375.707773", "last_seen_epoch": "1723682376.081203", "packets": 10, "bytes": 1228, "initiator_bytes": 731, "responder_bytes": 497 }, { "flow_id": "flow-fa7459c8e1cb937cf2df18ca", "transport": "tcp", "stream": 499, "initiator_ip": "10.8.15.133", "initiator_port": 50181, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17743, "last_frame": 17753, "first_seen_epoch": "1723682380.101212", "last_seen_epoch": "1723682380.481236", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-9f89da37bf4add588899e522", "transport": "tcp", "stream": 500, "initiator_ip": "10.8.15.133", "initiator_port": 50182, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17754, "last_frame": 17765, "first_seen_epoch": "1723682384.801847", "last_seen_epoch": "1723682385.179412", "packets": 10, "bytes": 1228, "initiator_bytes": 731, "responder_bytes": 497 }, { "flow_id": "flow-fe9e67e24cb5aa4a98c1a715", "transport": "tcp", "stream": 501, "initiator_ip": "10.8.15.133", "initiator_port": 50183, "responder_ip": "10.8.15.4", "responder_port": 445, "first_frame": 17769, "last_frame": 17850, "first_seen_epoch": "1723682386.511129", "last_seen_epoch": "1723682397.303727", "packets": 24, "bytes": 7676, "initiator_bytes": 5508, "responder_bytes": 2168 }, { "flow_id": "flow-de798749d9beb2dd22fec766", "transport": "tcp", "stream": 502, "initiator_ip": "10.8.15.133", "initiator_port": 50184, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17788, "last_frame": 17907, "first_seen_epoch": "1723682390.099318", "last_seen_epoch": "1723682415.972942", "packets": 19, "bytes": 1721, "initiator_bytes": 785, "responder_bytes": 936 }, { "flow_id": "flow-13caec5b7b9efd55b91fab53", "transport": "udp", "stream": 151, "initiator_ip": "10.8.15.133", "initiator_port": 52348, "responder_ip": "10.8.15.4", "responder_port": 53, "first_frame": 17805, "last_frame": 18011, "first_seen_epoch": "1723682392.071763", "last_seen_epoch": "1723682460.198419", "packets": 4, "bytes": 558, "initiator_bytes": 175, "responder_bytes": 383 }, { "flow_id": "flow-0435a35d9083812ff51911a3", "transport": "tcp", "stream": 503, "initiator_ip": "10.8.15.133", "initiator_port": 50185, "responder_ip": "13.70.79.200", "responder_port": 443, "first_frame": 17807, "last_frame": 17832, "first_seen_epoch": "1723682392.122793", "last_seen_epoch": "1723682393.138266", "packets": 26, "bytes": 9987, "initiator_bytes": 2555, "responder_bytes": 7432 }, { "flow_id": "flow-f8189a45f74f0152b977aa5a", "transport": "tcp", "stream": 504, "initiator_ip": "10.8.15.133", "initiator_port": 50186, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17834, "last_frame": 17845, "first_seen_epoch": "1723682396.582728", "last_seen_epoch": "1723682396.985027", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-43f2b40177e241709b069515", "transport": "tcp", "stream": 505, "initiator_ip": "10.8.15.133", "initiator_port": 50187, "responder_ip": "13.70.79.200", "responder_port": 443, "first_frame": 17851, "last_frame": 18086, "first_seen_epoch": "1723682398.771241", "last_seen_epoch": "1723682502.42269", "packets": 30, "bytes": 10514, "initiator_bytes": 2729, "responder_bytes": 7785 }, { "flow_id": "flow-5064ad7c30f37bcfdcf1acf0", "transport": "tcp", "stream": 506, "initiator_ip": "10.8.15.133", "initiator_port": 50188, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17861, "last_frame": 17871, "first_seen_epoch": "1723682401.411367", "last_seen_epoch": "1723682401.801187", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-92943396a2ca87f979fc9f4c", "transport": "tcp", "stream": 507, "initiator_ip": "10.8.15.133", "initiator_port": 50189, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17887, "last_frame": 17895, "first_seen_epoch": "1723682406.943244", "last_seen_epoch": "1723682407.321105", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-abb5934b1419e71055185eea", "transport": "tcp", "stream": 508, "initiator_ip": "10.8.15.133", "initiator_port": 50190, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17896, "last_frame": 17904, "first_seen_epoch": "1723682413.89504", "last_seen_epoch": "1723682414.281679", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-0989c01013da82efbeed2e9c", "transport": "udp", "stream": 152, "initiator_ip": "10.8.15.133", "initiator_port": 52349, "responder_ip": "239.255.255.250", "responder_port": 1900, "first_frame": 17908, "last_frame": 17922, "first_seen_epoch": "1723682418.947637", "last_seen_epoch": "1723682421.984333", "packets": 4, "bytes": 868, "initiator_bytes": 868, "responder_bytes": 0 }, { "flow_id": "flow-c77e34a99b3660fd63f93d65", "transport": "tcp", "stream": 509, "initiator_ip": "10.8.15.133", "initiator_port": 50191, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17909, "last_frame": 17920, "first_seen_epoch": "1723682419.630763", "last_seen_epoch": "1723682420.011776", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-30104465e13216f6f208704a", "transport": "tcp", "stream": 510, "initiator_ip": "10.8.15.133", "initiator_port": 50192, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17923, "last_frame": 17931, "first_seen_epoch": "1723682426.989631", "last_seen_epoch": "1723682427.375163", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-b428d73ae54fe34c76e53af4", "transport": "tcp", "stream": 511, "initiator_ip": "10.8.15.133", "initiator_port": 50193, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17932, "last_frame": 17940, "first_seen_epoch": "1723682433.521014", "last_seen_epoch": "1723682433.901579", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-aaec512984a8f04407cc8cd4", "transport": "tcp", "stream": 512, "initiator_ip": "10.8.15.133", "initiator_port": 50194, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17941, "last_frame": 17949, "first_seen_epoch": "1723682438.396002", "last_seen_epoch": "1723682438.775408", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-12d95d50ae3843b119a4ce07", "transport": "tcp", "stream": 513, "initiator_ip": "10.8.15.133", "initiator_port": 50195, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17952, "last_frame": 17961, "first_seen_epoch": "1723682444.036897", "last_seen_epoch": "1723682444.416775", "packets": 10, "bytes": 1228, "initiator_bytes": 731, "responder_bytes": 497 }, { "flow_id": "flow-4f3160ac2d2b6ee526138c21", "transport": "tcp", "stream": 514, "initiator_ip": "10.8.15.133", "initiator_port": 50196, "responder_ip": "52.113.194.132", "responder_port": 443, "first_frame": 17962, "last_frame": 18113, "first_seen_epoch": "1723682445.33379", "last_seen_epoch": "1723682511.740445", "packets": 25, "bytes": 10896, "initiator_bytes": 2756, "responder_bytes": 8140 }, { "flow_id": "flow-ef01fe9f03f9ee47f85a0699", "transport": "tcp", "stream": 515, "initiator_ip": "10.8.15.133", "initiator_port": 50197, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 17990, "last_frame": 18000, "first_seen_epoch": "1723682451.224463", "last_seen_epoch": "1723682451.601523", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-7da002edceaa880c0633616a", "transport": "tcp", "stream": 516, "initiator_ip": "10.8.15.133", "initiator_port": 50198, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 18001, "last_frame": 18009, "first_seen_epoch": "1723682457.412043", "last_seen_epoch": "1723682457.792403", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-39979a509dd759438e81cc4b", "transport": "tcp", "stream": 517, "initiator_ip": "10.8.15.133", "initiator_port": 50199, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 18014, "last_frame": 18022, "first_seen_epoch": "1723682461.599796", "last_seen_epoch": "1723682461.980707", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-77df87dda8b3e482b6f17580", "transport": "tcp", "stream": 518, "initiator_ip": "10.8.15.133", "initiator_port": 50200, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 18025, "last_frame": 18033, "first_seen_epoch": "1723682465.88046", "last_seen_epoch": "1723682466.282003", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-372c45fea05d9ed833d10a7b", "transport": "tcp", "stream": 519, "initiator_ip": "10.8.15.133", "initiator_port": 50201, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 18034, "last_frame": 18043, "first_seen_epoch": "1723682470.380492", "last_seen_epoch": "1723682471.681911", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-53bb29acd91f308cd86effd5", "transport": "tcp", "stream": 520, "initiator_ip": "10.8.15.133", "initiator_port": 50202, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 18044, "last_frame": 18052, "first_seen_epoch": "1723682477.084543", "last_seen_epoch": "1723682477.453761", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-354dcc94b6fc01c7565c1f4e", "transport": "tcp", "stream": 521, "initiator_ip": "10.8.15.133", "initiator_port": 50203, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 18053, "last_frame": 18061, "first_seen_epoch": "1723682484.536901", "last_seen_epoch": "1723682484.914973", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-beddc5ab5b3da9b811d7edbc", "transport": "tcp", "stream": 522, "initiator_ip": "10.8.15.133", "initiator_port": 50204, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 18064, "last_frame": 18072, "first_seen_epoch": "1723682491.261649", "last_seen_epoch": "1723682491.653938", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-d4298152e6ac695aa0266a58", "transport": "tcp", "stream": 523, "initiator_ip": "10.8.15.133", "initiator_port": 50205, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 18073, "last_frame": 18082, "first_seen_epoch": "1723682496.556594", "last_seen_epoch": "1723682498.84801", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-484b2a4a573012ffc7fbe9c0", "transport": "tcp", "stream": 524, "initiator_ip": "10.8.15.133", "initiator_port": 50206, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 18087, "last_frame": 18097, "first_seen_epoch": "1723682502.742214", "last_seen_epoch": "1723682503.11972", "packets": 11, "bytes": 1282, "initiator_bytes": 785, "responder_bytes": 497 }, { "flow_id": "flow-1b85420d08250c813a491eee", "transport": "tcp", "stream": 525, "initiator_ip": "10.8.15.133", "initiator_port": 50207, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 18100, "last_frame": 18108, "first_seen_epoch": "1723682507.195136", "last_seen_epoch": "1723682507.581185", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-58a62bb05ffbb2c5e4336a25", "transport": "tcp", "stream": 526, "initiator_ip": "10.8.15.133", "initiator_port": 50208, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 18114, "last_frame": 18122, "first_seen_epoch": "1723682512.00762", "last_seen_epoch": "1723682512.794046", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-f5ab2b3f987cb909f5e4c319", "transport": "tcp", "stream": 527, "initiator_ip": "10.8.15.133", "initiator_port": 50209, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 18123, "last_frame": 18132, "first_seen_epoch": "1723682518.351445", "last_seen_epoch": "1723682518.720951", "packets": 10, "bytes": 1228, "initiator_bytes": 731, "responder_bytes": 497 }, { "flow_id": "flow-9574f5c18a39004b14583686", "transport": "tcp", "stream": 528, "initiator_ip": "10.8.15.133", "initiator_port": 50210, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 18137, "last_frame": 18145, "first_seen_epoch": "1723682522.00765", "last_seen_epoch": "1723682523.862393", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-3b41e3da580812c2e4cfe19e", "transport": "tcp", "stream": 529, "initiator_ip": "10.8.15.133", "initiator_port": 50211, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 18146, "last_frame": 18155, "first_seen_epoch": "1723682528.196106", "last_seen_epoch": "1723682528.576554", "packets": 10, "bytes": 1228, "initiator_bytes": 731, "responder_bytes": 497 }, { "flow_id": "flow-51e7ab107864631b9120d76f", "transport": "tcp", "stream": 530, "initiator_ip": "10.8.15.133", "initiator_port": 50212, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 18158, "last_frame": 18167, "first_seen_epoch": "1723682533.524054", "last_seen_epoch": "1723682535.981468", "packets": 10, "bytes": 1240, "initiator_bytes": 797, "responder_bytes": 443 }, { "flow_id": "flow-4f29c1283d11dd342902a86c", "transport": "udp", "stream": 153, "initiator_ip": "10.8.15.133", "initiator_port": 52350, "responder_ip": "239.255.255.250", "responder_port": 1900, "first_frame": 18168, "last_frame": 18180, "first_seen_epoch": "1723682538.950589", "last_seen_epoch": "1723682541.976598", "packets": 4, "bytes": 868, "initiator_bytes": 868, "responder_bytes": 0 }, { "flow_id": "flow-f9ea9fb3cc9fde829e39b66b", "transport": "tcp", "stream": 531, "initiator_ip": "10.8.15.133", "initiator_port": 50213, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 18170, "last_frame": 18178, "first_seen_epoch": "1723682540.14894", "last_seen_epoch": "1723682540.522092", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 }, { "flow_id": "flow-ede69472b28609e9c6a7c163", "transport": "tcp", "stream": 532, "initiator_ip": "10.8.15.133", "initiator_port": 50214, "responder_ip": "72.5.43.29", "responder_port": 80, "first_frame": 18181, "last_frame": 18189, "first_seen_epoch": "1723682545.117358", "last_seen_epoch": "1723682546.009239", "packets": 9, "bytes": 1174, "initiator_bytes": 731, "responder_bytes": 443 } ], "events": { "dns": [ { "event_id": "evt-19251337dc8670285211cecf", "kind": "dns", "frame_number": 20, "timestamp_epoch": "1723680584.163120000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 59553, "dst_port": 53, "tcp_stream": null, "udp_stream": 4, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.dc._msdcs.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-d12f343058b3f2e506a7a813", "kind": "dns", "frame_number": 21, "timestamp_epoch": "1723680584.163446000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 59553, "tcp_stream": null, "udp_stream": 4, "fields": { "dns.a": "10.8.15.4", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.dc._msdcs.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-ffe8c5dcad0a630767f4d703", "kind": "dns", "frame_number": 22, "timestamp_epoch": "1723680584.185334000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 59553, "dst_port": 53, "tcp_stream": null, "udp_stream": 4, "fields": { "dns.flags.response": "False", "dns.qry.name": "win-jegjix7q9rs.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-d62d777e7d88f1489e5db00d", "kind": "dns", "frame_number": 23, "timestamp_epoch": "1723680584.185623000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 59553, "tcp_stream": null, "udp_stream": 4, "fields": { "dns.a": "10.8.15.4", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "win-jegjix7q9rs.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-63c44a3f5bbc630a67fe25f4", "kind": "dns", "frame_number": 32, "timestamp_epoch": "1723680584.314131000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 59553, "dst_port": 53, "tcp_stream": null, "udp_stream": 4, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.dc._msdcs.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-9544af97f1551f31f6a0e932", "kind": "dns", "frame_number": 33, "timestamp_epoch": "1723680584.314689000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 59553, "tcp_stream": null, "udp_stream": 4, "fields": { "dns.a": "10.8.15.4", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.dc._msdcs.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-b37906c18c76534217edb8a8", "kind": "dns", "frame_number": 55, "timestamp_epoch": "1723680584.978235000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53383, "dst_port": 53, "tcp_stream": null, "udp_stream": 9, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-f7a27c001b6c132fda180946", "kind": "dns", "frame_number": 56, "timestamp_epoch": "1723680584.978533000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 53383, "tcp_stream": null, "udp_stream": 9, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-38c9672169fd46770ff54abe", "kind": "dns", "frame_number": 59, "timestamp_epoch": "1723680584.996099000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58264, "dst_port": 53, "tcp_stream": null, "udp_stream": 10, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-aaf61b04a913312eb068a925", "kind": "dns", "frame_number": 60, "timestamp_epoch": "1723680584.996370000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58264, "tcp_stream": null, "udp_stream": 10, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-1f152c7a3b772878ec1748fe", "kind": "dns", "frame_number": 61, "timestamp_epoch": "1723680585.022161000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58264, "dst_port": 53, "tcp_stream": null, "udp_stream": 10, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.msftconnecttest.com", "dns.qry.type": "1" } }, { "event_id": "evt-aa2150172c1f5ba184b87a5a", "kind": "dns", "frame_number": 62, "timestamp_epoch": "1723680585.064601000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58264, "tcp_stream": null, "udp_stream": 10, "fields": { "dns.a": "23.205.110.48,23.205.110.62", "dns.cname": "ncsi-geo.trafficmanager.net,www.msftncsi.com.edgesuite.net,a1961.g2.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.msftconnecttest.com", "dns.qry.type": "1" } }, { "event_id": "evt-7bbe82a5655a271e385e1d3e", "kind": "dns", "frame_number": 72, "timestamp_epoch": "1723680585.304554000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53383, "dst_port": 53, "tcp_stream": null, "udp_stream": 9, "fields": { "dns.flags.response": "False", "dns.qry.name": "go.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-83768d74a01d4f6423124d38", "kind": "dns", "frame_number": 73, "timestamp_epoch": "1723680585.344967000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 53383, "tcp_stream": null, "udp_stream": 9, "fields": { "dns.a": "23.33.138.184", "dns.cname": "go.microsoft.com.edgekey.net,e11290.dspg.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "go.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-f1ca3328332883738f4bad3e", "kind": "dns", "frame_number": 110, "timestamp_epoch": "1723680585.919222000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53383, "dst_port": 53, "tcp_stream": null, "udp_stream": 9, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-191b9257121091958bf4d0c6", "kind": "dns", "frame_number": 111, "timestamp_epoch": "1723680585.919506000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 53383, "tcp_stream": null, "udp_stream": 9, "fields": { "dns.a": "10.8.15.4", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-1b7f4d1fa58a828d069765cf", "kind": "dns", "frame_number": 114, "timestamp_epoch": "1723680585.949913000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53383, "dst_port": 53, "tcp_stream": null, "udp_stream": 9, "fields": { "dns.flags.response": "False", "dns.qry.name": "_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-046548204151afe7f01e003c", "kind": "dns", "frame_number": 115, "timestamp_epoch": "1723680585.950206000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 53383, "tcp_stream": null, "udp_stream": 9, "fields": { "dns.a": "10.8.15.4", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-a8cf699c5d02a64794cf665a", "kind": "dns", "frame_number": 124, "timestamp_epoch": "1723680585.976186000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53383, "dst_port": 53, "tcp_stream": null, "udp_stream": 9, "fields": { "dns.flags.response": "False", "dns.qry.name": "_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-d978d0befd7b6f703727c52c", "kind": "dns", "frame_number": 125, "timestamp_epoch": "1723680585.976431000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 53383, "tcp_stream": null, "udp_stream": 9, "fields": { "dns.a": "10.8.15.4", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-b5e5b3cccf42a4a471adcc3b", "kind": "dns", "frame_number": 318, "timestamp_epoch": "1723680586.189605000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53383, "dst_port": 53, "tcp_stream": null, "udp_stream": 9, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-1a910911cfc012a8595fa0b9", "kind": "dns", "frame_number": 319, "timestamp_epoch": "1723680586.189773000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 53383, "tcp_stream": null, "udp_stream": 9, "fields": { "dns.a": "10.8.15.4", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-fa33c2f5d0ac3c93077b7814", "kind": "dns", "frame_number": 371, "timestamp_epoch": "1723680586.334689000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53383, "dst_port": 53, "tcp_stream": null, "udp_stream": 9, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-39ab0f991940b9d41add52a9", "kind": "dns", "frame_number": 372, "timestamp_epoch": "1723680586.334885000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 53383, "tcp_stream": null, "udp_stream": 9, "fields": { "dns.a": "10.8.15.4", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-355b0b4547121cb79634027b", "kind": "dns", "frame_number": 437, "timestamp_epoch": "1723680586.460654000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64949, "dst_port": 53, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-ecb524871ee74416c8d7e141", "kind": "dns", "frame_number": 438, "timestamp_epoch": "1723680586.460882000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 64949, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.a": "10.8.15.4", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-37ac7bf727ba23cc676dbff9", "kind": "dns", "frame_number": 472, "timestamp_epoch": "1723680586.701803000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64949, "dst_port": 53, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.response": "False", "dns.qry.name": "WIN-JEGJIX7Q9RS.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-26654f25a62e397062cda0ac", "kind": "dns", "frame_number": 473, "timestamp_epoch": "1723680586.702046000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 64949, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.a": "10.8.15.4", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "WIN-JEGJIX7Q9RS.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-a8a9f09d9d6980d3de97b8d7", "kind": "dns", "frame_number": 513, "timestamp_epoch": "1723680586.972529000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64949, "dst_port": 53, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.response": "False", "dns.qry.name": "officeclient.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-c54a02ebbdb93cec74724524", "kind": "dns", "frame_number": 623, "timestamp_epoch": "1723680587.162563000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 64949, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.a": "52.109.20.38", "dns.cname": "config.officeapps.live.com,prod.configsvc1.live.com.akadns.net,us.configsvc1.live.com.akadns.net,scus-azsc-config.officeapps.live.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "officeclient.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-709de3027103b2f1b898acfd", "kind": "dns", "frame_number": 727, "timestamp_epoch": "1723680588.022122000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64949, "dst_port": 53, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.response": "False", "dns.qry.name": "mobile.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-d1286f76acd410d465257dd9", "kind": "dns", "frame_number": 728, "timestamp_epoch": "1723680588.065143000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 64949, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.a": "13.89.179.13", "dns.cname": "mobile.events.data.trafficmanager.net,onedscolprdcus21.centralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "mobile.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-1cd1ff7461e7dfbde96f359d", "kind": "dns", "frame_number": 755, "timestamp_epoch": "1723680588.921219000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64949, "dst_port": 53, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-81cb55434a6efb397fede8a2", "kind": "dns", "frame_number": 756, "timestamp_epoch": "1723680588.921441000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 64949, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.a": "10.8.15.4", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-5dfd3e74a3098c954037612b", "kind": "dns", "frame_number": 842, "timestamp_epoch": "1723680591.535572000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64949, "dst_port": 53, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.response": "False", "dns.qry.name": "mobile.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-d0d45da6a158081de3a8d548", "kind": "dns", "frame_number": 843, "timestamp_epoch": "1723680591.535872000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 64949, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.a": "13.89.179.13", "dns.cname": "mobile.events.data.trafficmanager.net,onedscolprdcus21.centralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "mobile.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-3f3175f0861f3ec64b1281ec", "kind": "dns", "frame_number": 961, "timestamp_epoch": "1723680599.997113000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64949, "dst_port": 53, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-77c6e6b189d7cac1661f6e68", "kind": "dns", "frame_number": 962, "timestamp_epoch": "1723680599.997451000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 64949, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-66a810d4bad64dad66c0cdd4", "kind": "dns", "frame_number": 963, "timestamp_epoch": "1723680600.043877000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 52477, "dst_port": 53, "tcp_stream": null, "udp_stream": 20, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-aa7acd12ff82b45bd8c75cf1", "kind": "dns", "frame_number": 964, "timestamp_epoch": "1723680600.044261000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 52477, "tcp_stream": null, "udp_stream": 20, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-f491d9473614ea2aa5cc013e", "kind": "dns", "frame_number": 1158, "timestamp_epoch": "1723680609.315786000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64949, "dst_port": 53, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-8c25b953a36d90ef7f5a8976", "kind": "dns", "frame_number": 1160, "timestamp_epoch": "1723680609.378919000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 64949, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.a": "23.220.103.18,23.220.103.8", "dns.cname": "www-www.bing.com.trafficmanager.net,www.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-a38194fbb9360b61e5b8992c", "kind": "dns", "frame_number": 1192, "timestamp_epoch": "1723680609.647203000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64949, "dst_port": 53, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.response": "False", "dns.qry.name": "v20.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-27730a3e0e4802d1b4f9f873", "kind": "dns", "frame_number": 1194, "timestamp_epoch": "1723680609.679431000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 64949, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.a": "51.116.253.170", "dns.cname": "win-global-asimov-leafs-events-data.trafficmanager.net,onedscolprdgwc07.germanywestcentral.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v20.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-79732784166026c2a7014d9b", "kind": "dns", "frame_number": 1238, "timestamp_epoch": "1723680610.515418000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64949, "dst_port": 53, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.response": "False", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1" } }, { "event_id": "evt-c61e9ef23befc86a949ed075", "kind": "dns", "frame_number": 1239, "timestamp_epoch": "1723680610.533196000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 57585, "dst_port": 53, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.response": "False", "dns.qry.name": "fd.api.iris.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-d1753223ea9cac09f1f5144c", "kind": "dns", "frame_number": 1241, "timestamp_epoch": "1723680610.587785000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 64949, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.a": "20.10.31.115", "dns.cname": "wns.notify.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1" } }, { "event_id": "evt-f70123606422405c7e875095", "kind": "dns", "frame_number": 1242, "timestamp_epoch": "1723680610.587790000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 57585, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.a": "20.96.153.111", "dns.cname": "fd-api-iris.trafficmanager.net,iris-de-prod-azsc-v2-eus2.eastus2.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fd.api.iris.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-b132d0abce5de37173651d54", "kind": "dns", "frame_number": 1286, "timestamp_epoch": "1723680610.846039000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64949, "dst_port": 53, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.response": "False", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-b784a184c26242c96a21d1f3", "kind": "dns", "frame_number": 1293, "timestamp_epoch": "1723680610.884498000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 64949, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.a": "23.53.13.203,23.53.13.206,23.53.13.208,23.53.13.197,23.53.13.207", "dns.cname": "assets.msn.com.edgekey.net,e28578.d.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-1f2ace7562447822aa83a8e9", "kind": "dns", "frame_number": 1345, "timestamp_epoch": "1723680613.163355000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 57585, "dst_port": 53, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.response": "False", "dns.qry.name": "officeclient.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-b976328a5cf4e9626a487811", "kind": "dns", "frame_number": 1348, "timestamp_epoch": "1723680613.191028000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 57585, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.a": "52.109.20.38", "dns.cname": "config.officeapps.live.com,prod.configsvc1.live.com.akadns.net,us.configsvc1.live.com.akadns.net,scus-azsc-config.officeapps.live.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "officeclient.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-8138dc0f0e6a2829e28f23eb", "kind": "dns", "frame_number": 1484, "timestamp_epoch": "1723680613.588748000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64949, "dst_port": 53, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.response": "False", "dns.qry.name": "windows.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-9e3409a4f04a415ff22d29f5", "kind": "dns", "frame_number": 1485, "timestamp_epoch": "1723680613.622537000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 64949, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.a": "204.79.197.203", "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "windows.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-72e937fd3ac6a34aec1af352", "kind": "dns", "frame_number": 1491, "timestamp_epoch": "1723680613.672233000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 57585, "dst_port": 53, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.response": "False", "dns.qry.name": "odc.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-6fa8332fd20d43c0e365abaa", "kind": "dns", "frame_number": 1540, "timestamp_epoch": "1723680613.861164000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 57585, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.a": "52.109.0.142", "dns.cname": "prod.odcsm1.live.com.akadns.net,us2.odcsm1.live.com.akadns.net,wus-azsc-000.odc.officeapps.live.com,osiprod-wus-bronze-azsc-000.westus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "odc.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-13ac0cc70301f9824db25c21", "kind": "dns", "frame_number": 1584, "timestamp_epoch": "1723680613.967415000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64949, "dst_port": 53, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.response": "False", "dns.qry.name": "th.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-1191b11d2e3e744e60f0335d", "kind": "dns", "frame_number": 1589, "timestamp_epoch": "1723680614.023363000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 57585, "dst_port": 53, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-85c9dcf03d37595a7c5d4de4", "kind": "dns", "frame_number": 1590, "timestamp_epoch": "1723680614.023628000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 57585, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.a": "204.79.197.203", "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-c3448ec860b65e0d6a4e0df7", "kind": "dns", "frame_number": 1592, "timestamp_epoch": "1723680614.030530000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 64949, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.a": "23.220.103.8,23.220.103.18", "dns.cname": "p-th.bing.com.trafficmanager.net,th.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "th.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-cca10dfea0f95a5f8302068a", "kind": "dns", "frame_number": 2105, "timestamp_epoch": "1723680618.771992000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 57585, "dst_port": 53, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-8f414f77ecab0630efc5d5d6", "kind": "dns", "frame_number": 2106, "timestamp_epoch": "1723680618.772193000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 57585, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-64957c206013acd624abdc76", "kind": "dns", "frame_number": 2107, "timestamp_epoch": "1723680618.962098000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 52062, "dst_port": 53, "tcp_stream": null, "udp_stream": 24, "fields": { "dns.flags.response": "False", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-afdced378e2bf5025e61d0b2", "kind": "dns", "frame_number": 2108, "timestamp_epoch": "1723680618.962307000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 54218, "dst_port": 53, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.flags.response": "False", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-39db1d4974fdae5bdd83d112", "kind": "dns", "frame_number": 2109, "timestamp_epoch": "1723680618.962508000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 54218, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.cname": "edge-microsoft-com.dual-a-0036.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-62daf2815efae1734e0fe49e", "kind": "dns", "frame_number": 2110, "timestamp_epoch": "1723680618.967730000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 51572, "dst_port": 53, "tcp_stream": null, "udp_stream": 26, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-9a2b63990a7eb2f28d0333d4", "kind": "dns", "frame_number": 2111, "timestamp_epoch": "1723680618.967976000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 59615, "dst_port": 53, "tcp_stream": null, "udp_stream": 27, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-c748a080f90a296bccac37eb", "kind": "dns", "frame_number": 2112, "timestamp_epoch": "1723680618.968040000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 51572, "tcp_stream": null, "udp_stream": 26, "fields": { "dns.a": "23.220.103.18,23.220.103.8", "dns.cname": "www-www.bing.com.trafficmanager.net,www.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-1e0fd10f63763384404b6dba", "kind": "dns", "frame_number": 2114, "timestamp_epoch": "1723680619.000574000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 59615, "tcp_stream": null, "udp_stream": 27, "fields": { "dns.cname": "www-www.bing.com.trafficmanager.net,www.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-1c3f8adcbbc35d1b9fb3b785", "kind": "dns", "frame_number": 2115, "timestamp_epoch": "1723680619.000623000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 52062, "tcp_stream": null, "udp_stream": 24, "fields": { "dns.a": "13.107.21.239,204.79.197.239", "dns.cname": "edge-microsoft-com.dual-a-0036.a-msedge.net,dual-a-0036.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-133f047715fa0fe5da79f6ed", "kind": "dns", "frame_number": 2116, "timestamp_epoch": "1723680619.000733000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53, "dst_port": 59615, "tcp_stream": null, "udp_stream": 27, "fields": { "dns.cname": "www-www.bing.com.trafficmanager.net,www.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-302be07c2666e54318247ec6", "kind": "dns", "frame_number": 2244, "timestamp_epoch": "1723680619.207596000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64949, "dst_port": 53, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.response": "False", "dns.qry.name": "login.microsoftonline.com", "dns.qry.type": "1" } }, { "event_id": "evt-0a9eadf9fdf9f4dcd5f5e824", "kind": "dns", "frame_number": 2245, "timestamp_epoch": "1723680619.207937000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 64949, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.a": "40.126.29.13,40.126.29.15,40.126.29.6,40.126.29.7,40.126.29.10,40.126.29.11,20.190.157.9,40.126.29.9", "dns.cname": "login.mso.msidentity.com,ak.privatelink.msidentity.com,www.tm.ak.prd.aadg.akadns.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "login.microsoftonline.com", "dns.qry.type": "1" } }, { "event_id": "evt-590469acb7066574903b24ac", "kind": "dns", "frame_number": 2280, "timestamp_epoch": "1723680619.360469000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 59189, "dst_port": 53, "tcp_stream": null, "udp_stream": 28, "fields": { "dns.flags.response": "False", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-4aaa4a7acf3e89ddd3ed9c05", "kind": "dns", "frame_number": 2281, "timestamp_epoch": "1723680619.360576000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 54422, "dst_port": 53, "tcp_stream": null, "udp_stream": 29, "fields": { "dns.flags.response": "False", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-7f2c8c679867f7385d80aa8b", "kind": "dns", "frame_number": 2282, "timestamp_epoch": "1723680619.360829000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 59189, "tcp_stream": null, "udp_stream": 28, "fields": { "dns.a": "204.79.197.239,13.107.21.239", "dns.cname": "edge-microsoft-com.dual-a-0036.a-msedge.net,dual-a-0036.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-5e8a01a4548eda8470310fe3", "kind": "dns", "frame_number": 2286, "timestamp_epoch": "1723680619.392816000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 54422, "tcp_stream": null, "udp_stream": 29, "fields": { "dns.cname": "edge-microsoft-com.dual-a-0036.a-msedge.net,dual-a-0036.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-3183e1abf7853fdaff3e1079", "kind": "dns", "frame_number": 2314, "timestamp_epoch": "1723680619.724662000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 54773, "dst_port": 53, "tcp_stream": null, "udp_stream": 30, "fields": { "dns.flags.response": "False", "dns.qry.name": "edgeservices.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-beb389b5243a2a07a95f534b", "kind": "dns", "frame_number": 2315, "timestamp_epoch": "1723680619.724901000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 56117, "dst_port": 53, "tcp_stream": null, "udp_stream": 31, "fields": { "dns.flags.response": "False", "dns.qry.name": "edgeservices.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-ec4290ed0042b74b7d277c45", "kind": "dns", "frame_number": 2316, "timestamp_epoch": "1723680619.725181000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 54773, "tcp_stream": null, "udp_stream": 30, "fields": { "dns.a": "23.220.103.8,23.220.103.18", "dns.cname": "www.bing.com,www-www.bing.com.trafficmanager.net,www.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edgeservices.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-182398d1a948fcce6cebe280", "kind": "dns", "frame_number": 2317, "timestamp_epoch": "1723680619.725298000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 56117, "tcp_stream": null, "udp_stream": 31, "fields": { "dns.cname": "www.bing.com,www-www.bing.com.trafficmanager.net,www.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edgeservices.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-5fa7855c194bc044e1fb1105", "kind": "dns", "frame_number": 2329, "timestamp_epoch": "1723680619.794845000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 54323, "dst_port": 53, "tcp_stream": null, "udp_stream": 32, "fields": { "dns.flags.response": "False", "dns.qry.name": "edgeservices.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-67c6f2972ab155b79c5b6341", "kind": "dns", "frame_number": 2330, "timestamp_epoch": "1723680619.795182000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 54323, "tcp_stream": null, "udp_stream": 32, "fields": { "dns.a": "23.220.103.18,23.220.103.8", "dns.cname": "www.bing.com,www-www.bing.com.trafficmanager.net,www.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edgeservices.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-12e552abc80335e03ea7b833", "kind": "dns", "frame_number": 2331, "timestamp_epoch": "1723680619.795686000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 54613, "dst_port": 53, "tcp_stream": null, "udp_stream": 33, "fields": { "dns.flags.response": "False", "dns.qry.name": "edgeservices.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-2391b317864cf198ffada069", "kind": "dns", "frame_number": 2332, "timestamp_epoch": "1723680619.795941000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 54613, "tcp_stream": null, "udp_stream": 33, "fields": { "dns.cname": "www.bing.com,www-www.bing.com.trafficmanager.net,www.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edgeservices.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-0287bd8545358d93533ba782", "kind": "dns", "frame_number": 2334, "timestamp_epoch": "1723680619.796643000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 65378, "dst_port": 53, "tcp_stream": null, "udp_stream": 34, "fields": { "dns.flags.response": "False", "dns.qry.name": "edgeservices.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-7bd2dd8bac98f93efe8cad23", "kind": "dns", "frame_number": 2335, "timestamp_epoch": "1723680619.796873000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 65378, "tcp_stream": null, "udp_stream": 34, "fields": { "dns.a": "23.220.103.8,23.220.103.18", "dns.cname": "www.bing.com,www-www.bing.com.trafficmanager.net,www.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edgeservices.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-5bff55bc8cab474765495d6b", "kind": "dns", "frame_number": 2398, "timestamp_epoch": "1723680620.446606000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53929, "dst_port": 53, "tcp_stream": null, "udp_stream": 35, "fields": { "dns.flags.response": "False", "dns.qry.name": "edgeservices.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-2cd37b94d2922efccee71893", "kind": "dns", "frame_number": 2399, "timestamp_epoch": "1723680620.446770000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 57298, "dst_port": 53, "tcp_stream": null, "udp_stream": 36, "fields": { "dns.flags.response": "False", "dns.qry.name": "edgeservices.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-b393763d5e9ff6443b3072f3", "kind": "dns", "frame_number": 2400, "timestamp_epoch": "1723680620.447044000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 53929, "tcp_stream": null, "udp_stream": 35, "fields": { "dns.a": "23.220.103.18,23.220.103.8", "dns.cname": "www.bing.com,www-www.bing.com.trafficmanager.net,www.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edgeservices.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-768f65ebed5deb594ffb92b1", "kind": "dns", "frame_number": 2401, "timestamp_epoch": "1723680620.447047000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 57298, "tcp_stream": null, "udp_stream": 36, "fields": { "dns.a": "23.220.103.8,23.220.103.18", "dns.cname": "www.bing.com,www-www.bing.com.trafficmanager.net,www.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edgeservices.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-04eac667092246eb1df0d9f8", "kind": "dns", "frame_number": 2996, "timestamp_epoch": "1723680622.289222000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 57585, "dst_port": 53, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.response": "False", "dns.qry.name": "g.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-76b565ecbad6d18cd3e5e827", "kind": "dns", "frame_number": 2997, "timestamp_epoch": "1723680622.291194000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64949, "dst_port": 53, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.response": "False", "dns.qry.name": "ecs.office.com", "dns.qry.type": "1" } }, { "event_id": "evt-64d3f2df8fc69586024051d5", "kind": "dns", "frame_number": 2998, "timestamp_epoch": "1723680622.306637000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58818, "dst_port": 53, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.response": "False", "dns.qry.name": "odc.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-a5a0e93cf284ce786908aa6b", "kind": "dns", "frame_number": 2999, "timestamp_epoch": "1723680622.344915000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 57585, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.a": "20.241.44.114", "dns.cname": "g.msn.com,g-msn-com-nsatc.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "g.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-62e040c7206b37c166c784f1", "kind": "dns", "frame_number": 3000, "timestamp_epoch": "1723680622.357357000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58818, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.a": "52.109.0.142", "dns.cname": "prod.odcsm1.live.com.akadns.net,us2.odcsm1.live.com.akadns.net,wus-azsc-000.odc.officeapps.live.com,osiprod-wus-bronze-azsc-000.westus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "odc.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-4dd050a59fefc5b20a57b508", "kind": "dns", "frame_number": 3001, "timestamp_epoch": "1723680622.357369000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 64949, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.a": "52.113.194.132", "dns.cname": "ecs.office.trafficmanager.net,s-0005-office.config.skype.com,ecs-office.s-0005.s-msedge.net,s-0005.s-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ecs.office.com", "dns.qry.type": "1" } }, { "event_id": "evt-137df340ce3558d397120675", "kind": "dns", "frame_number": 3063, "timestamp_epoch": "1723680622.787624000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 57585, "dst_port": 53, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.response": "False", "dns.qry.name": "oneclient.sfx.ms", "dns.qry.type": "1" } }, { "event_id": "evt-df6f86c06d05c673a59e52da", "kind": "dns", "frame_number": 3065, "timestamp_epoch": "1723680622.844577000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 57585, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.a": "23.63.205.134", "dns.cname": "oneclient.sfx.ms.edgekey.net,e9659.dspg.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "oneclient.sfx.ms", "dns.qry.type": "1" } }, { "event_id": "evt-914b152b65f90235f306cf42", "kind": "dns", "frame_number": 3146, "timestamp_epoch": "1723680623.819087000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 51383, "dst_port": 53, "tcp_stream": null, "udp_stream": 39, "fields": { "dns.flags.response": "False", "dns.qry.name": "th.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-f322256de891668ee44d8b62", "kind": "dns", "frame_number": 3147, "timestamp_epoch": "1723680623.819219000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 60588, "dst_port": 53, "tcp_stream": null, "udp_stream": 40, "fields": { "dns.flags.response": "False", "dns.qry.name": "th.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-4280a01d5204d068a425c178", "kind": "dns", "frame_number": 3148, "timestamp_epoch": "1723680623.819458000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 51383, "tcp_stream": null, "udp_stream": 39, "fields": { "dns.a": "23.220.103.18,23.220.103.8", "dns.cname": "p-th.bing.com.trafficmanager.net,th.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "th.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-52fe5ab321c96d50ab26521e", "kind": "dns", "frame_number": 3149, "timestamp_epoch": "1723680623.819510000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 60588, "tcp_stream": null, "udp_stream": 40, "fields": { "dns.cname": "p-th.bing.com.trafficmanager.net,th.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "th.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-8aa341bb53d2605433843469", "kind": "dns", "frame_number": 3541, "timestamp_epoch": "1723680626.033462000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58818, "dst_port": 53, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.response": "False", "dns.qry.name": "default.exp-tas.com", "dns.qry.type": "1" } }, { "event_id": "evt-c9d1ce9f3e5597f2f4f5ce0d", "kind": "dns", "frame_number": 3542, "timestamp_epoch": "1723680626.079863000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58818, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.a": "13.107.5.93", "dns.cname": "deault-exp-tas-com.e-0014.e-msedge.net,e-0014.e-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "default.exp-tas.com", "dns.qry.type": "1" } }, { "event_id": "evt-c4ce33b31a95bf611f162d22", "kind": "dns", "frame_number": 3575, "timestamp_epoch": "1723680626.785346000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64949, "dst_port": 53, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-22ed8520c740f44643223f0f", "kind": "dns", "frame_number": 3576, "timestamp_epoch": "1723680626.785646000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 64949, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-77a77829ac8d78c986a2fec4", "kind": "dns", "frame_number": 3654, "timestamp_epoch": "1723680646.086019000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58475, "dst_port": 53, "tcp_stream": null, "udp_stream": 42, "fields": { "dns.flags.response": "False", "dns.qry.name": "ntp.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-c9d976f8b7409a73cd3ecb37", "kind": "dns", "frame_number": 3655, "timestamp_epoch": "1723680646.086144000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 57244, "dst_port": 53, "tcp_stream": null, "udp_stream": 43, "fields": { "dns.flags.response": "False", "dns.qry.name": "ntp.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-13f66e0f354e6de85554788d", "kind": "dns", "frame_number": 3656, "timestamp_epoch": "1723680646.086404000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58475, "tcp_stream": null, "udp_stream": 42, "fields": { "dns.a": "204.79.197.203", "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ntp.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-543208ab5b404c9afba711f2", "kind": "dns", "frame_number": 3657, "timestamp_epoch": "1723680646.093113000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58157, "dst_port": 53, "tcp_stream": null, "udp_stream": 44, "fields": { "dns.flags.response": "False", "dns.qry.name": "ntp.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-20d9c91c9a29e754671c118e", "kind": "dns", "frame_number": 3658, "timestamp_epoch": "1723680646.093457000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58157, "tcp_stream": null, "udp_stream": 44, "fields": { "dns.a": "204.79.197.203", "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ntp.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-f7d6051608982a7bd86ebecc", "kind": "dns", "frame_number": 3662, "timestamp_epoch": "1723680646.155440000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 56503, "dst_port": 53, "tcp_stream": null, "udp_stream": 45, "fields": { "dns.flags.response": "False", "dns.qry.name": "business.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-007b0ab60d5eb0a319a51456", "kind": "dns", "frame_number": 3663, "timestamp_epoch": "1723680646.155667000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 51850, "dst_port": 53, "tcp_stream": null, "udp_stream": 46, "fields": { "dns.flags.response": "False", "dns.qry.name": "business.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-199e6d536bb870ef48fe917d", "kind": "dns", "frame_number": 3664, "timestamp_epoch": "1723680646.404859000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 56503, "tcp_stream": null, "udp_stream": 45, "fields": { "dns.a": "13.107.6.158", "dns.cname": "business-bing-com.b-0005.b-msedge.net,b-0005.b-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "business.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-1cadfbbf65dcd0625e63a750", "kind": "dns", "frame_number": 3797, "timestamp_epoch": "1723680647.617210000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 61665, "dst_port": 53, "tcp_stream": null, "udp_stream": 47, "fields": { "dns.flags.response": "False", "dns.qry.name": "img-s-msn-com.akamaized.net", "dns.qry.type": "1" } }, { "event_id": "evt-69fe7bcd53ef0381242c8ef6", "kind": "dns", "frame_number": 3798, "timestamp_epoch": "1723680647.617356000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 60813, "dst_port": 53, "tcp_stream": null, "udp_stream": 48, "fields": { "dns.flags.response": "False", "dns.qry.name": "img-s-msn-com.akamaized.net", "dns.qry.type": "65" } }, { "event_id": "evt-ba77106feff8a0baa9f5e5c1", "kind": "dns", "frame_number": 3799, "timestamp_epoch": "1723680647.617991000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 60586, "dst_port": 53, "tcp_stream": null, "udp_stream": 49, "fields": { "dns.flags.response": "False", "dns.qry.name": "sb.scorecardresearch.com", "dns.qry.type": "1" } }, { "event_id": "evt-a6c0c8730ffcda715b2aa22e", "kind": "dns", "frame_number": 3800, "timestamp_epoch": "1723680647.618121000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53282, "dst_port": 53, "tcp_stream": null, "udp_stream": 50, "fields": { "dns.flags.response": "False", "dns.qry.name": "sb.scorecardresearch.com", "dns.qry.type": "65" } }, { "event_id": "evt-9226ff6b22f56b6fb06cd5de", "kind": "dns", "frame_number": 3801, "timestamp_epoch": "1723680647.618882000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 57917, "dst_port": 53, "tcp_stream": null, "udp_stream": 51, "fields": { "dns.flags.response": "False", "dns.qry.name": "th.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-40f4fc0d8a5876e029c55682", "kind": "dns", "frame_number": 3802, "timestamp_epoch": "1723680647.618976000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58089, "dst_port": 53, "tcp_stream": null, "udp_stream": 52, "fields": { "dns.flags.response": "False", "dns.qry.name": "th.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-1de2c01937025290e8b66c2b", "kind": "dns", "frame_number": 3803, "timestamp_epoch": "1723680647.633735000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 56208, "dst_port": 53, "tcp_stream": null, "udp_stream": 53, "fields": { "dns.flags.response": "False", "dns.qry.name": "browser.events.data.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-5453d2703ff6fbac9c382b38", "kind": "dns", "frame_number": 3804, "timestamp_epoch": "1723680647.633897000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 57821, "dst_port": 53, "tcp_stream": null, "udp_stream": 54, "fields": { "dns.flags.response": "False", "dns.qry.name": "browser.events.data.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-d28ab20605aeeeb9edf22a78", "kind": "dns", "frame_number": 3815, "timestamp_epoch": "1723680647.652290000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 53282, "tcp_stream": null, "udp_stream": 50, "fields": { "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "sb.scorecardresearch.com", "dns.qry.type": "65" } }, { "event_id": "evt-ea2a47073b2903596420899a", "kind": "dns", "frame_number": 3816, "timestamp_epoch": "1723680647.655918000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 61665, "tcp_stream": null, "udp_stream": 47, "fields": { "dns.a": "23.205.110.12,23.205.110.59", "dns.cname": "a1834.dscg2.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "img-s-msn-com.akamaized.net", "dns.qry.type": "1" } }, { "event_id": "evt-e330be4bb334aff820eae81c", "kind": "dns", "frame_number": 3817, "timestamp_epoch": "1723680647.663999000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58089, "tcp_stream": null, "udp_stream": 52, "fields": { "dns.cname": "p-th.bing.com.trafficmanager.net,th.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "th.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-496769760d990230be7282e7", "kind": "dns", "frame_number": 3818, "timestamp_epoch": "1723680647.664993000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 50688, "dst_port": 53, "tcp_stream": null, "udp_stream": 55, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-cf3d91dffb730afe5b80d8ad", "kind": "dns", "frame_number": 3819, "timestamp_epoch": "1723680647.665107000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64317, "dst_port": 53, "tcp_stream": null, "udp_stream": 56, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-3d7bbef74c448b99718951c6", "kind": "dns", "frame_number": 3820, "timestamp_epoch": "1723680647.665273000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 64317, "tcp_stream": null, "udp_stream": 56, "fields": { "dns.cname": "www-www.bing.com.trafficmanager.net,www.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-07ef2a9e3ef63aec3103311c", "kind": "dns", "frame_number": 3821, "timestamp_epoch": "1723680647.678840000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 57917, "tcp_stream": null, "udp_stream": 51, "fields": { "dns.a": "23.220.103.8,23.220.103.18", "dns.cname": "p-th.bing.com.trafficmanager.net,th.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "th.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-383fab3145b344ca6054925c", "kind": "dns", "frame_number": 3822, "timestamp_epoch": "1723680647.678854000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 60586, "tcp_stream": null, "udp_stream": 49, "fields": { "dns.a": "18.160.156.115,18.160.156.41,18.160.156.89,18.160.156.14", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "sb.scorecardresearch.com", "dns.qry.type": "1" } }, { "event_id": "evt-2a3fdeef57dedeb3942257cc", "kind": "dns", "frame_number": 3823, "timestamp_epoch": "1723680647.679002000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 56208, "tcp_stream": null, "udp_stream": 53, "fields": { "dns.a": "20.42.72.131", "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdeus00.eastus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "browser.events.data.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-7939a65213f7bfb52cdb5f97", "kind": "dns", "frame_number": 3824, "timestamp_epoch": "1723680647.679975000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 65056, "dst_port": 53, "tcp_stream": null, "udp_stream": 57, "fields": { "dns.flags.response": "False", "dns.qry.name": "c.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-b9840b1b8985e8024a6bb8cf", "kind": "dns", "frame_number": 3825, "timestamp_epoch": "1723680647.680212000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 59582, "dst_port": 53, "tcp_stream": null, "udp_stream": 58, "fields": { "dns.flags.response": "False", "dns.qry.name": "c.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-b588fb51cedadd1c4557caee", "kind": "dns", "frame_number": 3826, "timestamp_epoch": "1723680647.680678000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 60393, "dst_port": 53, "tcp_stream": null, "udp_stream": 59, "fields": { "dns.flags.response": "False", "dns.qry.name": "c.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-fe992ae5f111686d1b4165ab", "kind": "dns", "frame_number": 3827, "timestamp_epoch": "1723680647.680817000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 61703, "dst_port": 53, "tcp_stream": null, "udp_stream": 60, "fields": { "dns.flags.response": "False", "dns.qry.name": "c.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-7e54f89e3801ff12773decb7", "kind": "dns", "frame_number": 3828, "timestamp_epoch": "1723680647.681941000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 60813, "tcp_stream": null, "udp_stream": 48, "fields": { "dns.cname": "a1834.dscg2.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "img-s-msn-com.akamaized.net", "dns.qry.type": "65" } }, { "event_id": "evt-527cbce05c9ea64aeca5d6b0", "kind": "dns", "frame_number": 3829, "timestamp_epoch": "1723680647.682049000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53, "dst_port": 60813, "tcp_stream": null, "udp_stream": 48, "fields": { "dns.cname": "a1834.dscg2.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "img-s-msn-com.akamaized.net", "dns.qry.type": "65" } }, { "event_id": "evt-0f63dbcb41ca07601e1a28aa", "kind": "dns", "frame_number": 3831, "timestamp_epoch": "1723680647.704145000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 50688, "tcp_stream": null, "udp_stream": 55, "fields": { "dns.a": "23.220.103.18,23.220.103.8", "dns.cname": "www-www.bing.com.trafficmanager.net,www.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-9251fb96b861124165af130b", "kind": "dns", "frame_number": 3833, "timestamp_epoch": "1723680647.707158000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 59403, "dst_port": 53, "tcp_stream": null, "udp_stream": 61, "fields": { "dns.flags.response": "False", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-f92603503c150c1225ab2aa0", "kind": "dns", "frame_number": 3834, "timestamp_epoch": "1723680647.707250000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 59155, "dst_port": 53, "tcp_stream": null, "udp_stream": 62, "fields": { "dns.flags.response": "False", "dns.qry.name": "assets.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-8307164f96296e35ee1131cc", "kind": "dns", "frame_number": 3835, "timestamp_epoch": "1723680647.712629000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 57821, "tcp_stream": null, "udp_stream": 54, "fields": { "dns.cname": "global.asimov.events.data.trafficmanager.net,onedscolprdeus00.eastus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "browser.events.data.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-26db57fda4cccb455f0e1c76", "kind": "dns", "frame_number": 3836, "timestamp_epoch": "1723680647.712660000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 60393, "tcp_stream": null, "udp_stream": 59, "fields": { "dns.a": "13.107.21.237,204.79.197.237", "dns.cname": "c-bing-com.dual-a-0034.a-msedge.net,dual-a-0034.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "c.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-1531956f7a24d4fbe20e118b", "kind": "dns", "frame_number": 3838, "timestamp_epoch": "1723680647.730583000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 65056, "tcp_stream": null, "udp_stream": 57, "fields": { "dns.a": "20.125.209.212", "dns.cname": "c-msn-com-nsatc.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "c.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-73fa21bcd342d02d4e51b303", "kind": "dns", "frame_number": 3839, "timestamp_epoch": "1723680647.730733000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 59582, "tcp_stream": null, "udp_stream": 58, "fields": { "dns.cname": "c-msn-com-nsatc.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "c.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-add05d88be5e98b95c1f344f", "kind": "dns", "frame_number": 3841, "timestamp_epoch": "1723680647.732029000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 62921, "dst_port": 53, "tcp_stream": null, "udp_stream": 63, "fields": { "dns.flags.response": "False", "dns.qry.name": "api.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-b6fc479a13aa676b4eae70f6", "kind": "dns", "frame_number": 3842, "timestamp_epoch": "1723680647.732238000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 57734, "dst_port": 53, "tcp_stream": null, "udp_stream": 64, "fields": { "dns.flags.response": "False", "dns.qry.name": "api.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-a960bab704e013613bb624cf", "kind": "dns", "frame_number": 3845, "timestamp_epoch": "1723680647.738191000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 59155, "tcp_stream": null, "udp_stream": 62, "fields": { "dns.cname": "assets.msn.com.edgekey.net,e28578.d.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "assets.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-f56bbe2f0bb277538ac739ec", "kind": "dns", "frame_number": 3850, "timestamp_epoch": "1723680647.745289000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 61703, "tcp_stream": null, "udp_stream": 60, "fields": { "dns.cname": "c-bing-com.dual-a-0034.a-msedge.net,dual-a-0034.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "c.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-c48fe72f42ea33d0c3d17a8a", "kind": "dns", "frame_number": 3853, "timestamp_epoch": "1723680647.756613000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 59403, "tcp_stream": null, "udp_stream": 61, "fields": { "dns.a": "23.53.13.203,23.53.13.206,23.53.13.207,23.53.13.202,23.53.13.200,23.53.13.197,23.53.13.199", "dns.cname": "assets.msn.com.edgekey.net,e28578.d.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-c768976a585b08877876bafe", "kind": "dns", "frame_number": 3864, "timestamp_epoch": "1723680647.770709000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 62921, "tcp_stream": null, "udp_stream": 63, "fields": { "dns.a": "204.79.197.203", "dns.cname": "api-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "api.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-c70f46b07c473c7faa1d727b", "kind": "dns", "frame_number": 3884, "timestamp_epoch": "1723680647.809673000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 57734, "tcp_stream": null, "udp_stream": 64, "fields": { "dns.cname": "api-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "api.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-33836ca20b742a7227efa17a", "kind": "dns", "frame_number": 4384, "timestamp_epoch": "1723680648.357201000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 62319, "dst_port": 53, "tcp_stream": null, "udp_stream": 66, "fields": { "dns.flags.response": "False", "dns.qry.name": "srtb.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-74683e65fd4704e4aa5d9e33", "kind": "dns", "frame_number": 4385, "timestamp_epoch": "1723680648.357394000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 54071, "dst_port": 53, "tcp_stream": null, "udp_stream": 67, "fields": { "dns.flags.response": "False", "dns.qry.name": "srtb.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-7ec4bb7f9fc3f74ef468966d", "kind": "dns", "frame_number": 4386, "timestamp_epoch": "1723680648.357602000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 62319, "tcp_stream": null, "udp_stream": 66, "fields": { "dns.a": "204.79.197.203", "dns.cname": "www.msn.com,www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "srtb.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-47e6cb1ce3e06d7624b4fec1", "kind": "dns", "frame_number": 4387, "timestamp_epoch": "1723680648.357606000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 54071, "tcp_stream": null, "udp_stream": 67, "fields": { "dns.cname": "www.msn.com,www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "srtb.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-a90af3db6add6d7a1ff872e2", "kind": "dns", "frame_number": 4395, "timestamp_epoch": "1723680648.389188000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 50336, "dst_port": 53, "tcp_stream": null, "udp_stream": 68, "fields": { "dns.flags.response": "False", "dns.qry.name": "edge-consumer-static.azureedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-526a7e6a92cfdd72ddbffe08", "kind": "dns", "frame_number": 4396, "timestamp_epoch": "1723680648.389385000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58981, "dst_port": 53, "tcp_stream": null, "udp_stream": 69, "fields": { "dns.flags.response": "False", "dns.qry.name": "edge-consumer-static.azureedge.net", "dns.qry.type": "65" } }, { "event_id": "evt-a948847d52ffa002e9208253", "kind": "dns", "frame_number": 4404, "timestamp_epoch": "1723680648.443397000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 50336, "tcp_stream": null, "udp_stream": 68, "fields": { "dns.a": "13.107.246.57", "dns.cname": "edge-consumer-static.afd.azureedge.net,azureedge-t-prod.trafficmanager.net,shed.dual-low.s-part-0029.t-0009.t-msedge.net,s-part-0029.t-0009.t-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edge-consumer-static.azureedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-c0ca7ee2481f7703a0e478b4", "kind": "dns", "frame_number": 4413, "timestamp_epoch": "1723680648.484064000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58981, "tcp_stream": null, "udp_stream": 69, "fields": { "dns.cname": "edge-consumer-static.afd.azureedge.net,azureedge-t-prod.trafficmanager.net,shed.dual-low.s-part-0029.t-0009.t-msedge.net,s-part-0029.t-0009.t-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edge-consumer-static.azureedge.net", "dns.qry.type": "65" } }, { "event_id": "evt-815e9d5781066d7b24f40053", "kind": "dns", "frame_number": 4414, "timestamp_epoch": "1723680648.484222000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53, "dst_port": 58981, "tcp_stream": null, "udp_stream": 69, "fields": { "dns.cname": "edge-consumer-static.afd.azureedge.net,azureedge-t-prod.trafficmanager.net,shed.dual-low.s-part-0029.t-0009.t-msedge.net,s-part-0029.t-0009.t-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edge-consumer-static.azureedge.net", "dns.qry.type": "65" } }, { "event_id": "evt-b14e06f57c253534fbe3979d", "kind": "dns", "frame_number": 4684, "timestamp_epoch": "1723680649.628039000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 62440, "dst_port": 53, "tcp_stream": null, "udp_stream": 70, "fields": { "dns.flags.response": "False", "dns.qry.name": "r.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-5c44ec9fe975e455d6e39131", "kind": "dns", "frame_number": 4685, "timestamp_epoch": "1723680649.628122000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58878, "dst_port": 53, "tcp_stream": null, "udp_stream": 71, "fields": { "dns.flags.response": "False", "dns.qry.name": "r.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-525e2470f1a57b712d35994d", "kind": "dns", "frame_number": 4686, "timestamp_epoch": "1723680649.628579000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53169, "dst_port": 53, "tcp_stream": null, "udp_stream": 72, "fields": { "dns.flags.response": "False", "dns.qry.name": "r.msftstatic.com", "dns.qry.type": "1" } }, { "event_id": "evt-8ce5f6227093e01561746295", "kind": "dns", "frame_number": 4687, "timestamp_epoch": "1723680649.628681000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 65521, "dst_port": 53, "tcp_stream": null, "udp_stream": 73, "fields": { "dns.flags.response": "False", "dns.qry.name": "r.msftstatic.com", "dns.qry.type": "65" } }, { "event_id": "evt-ece4712a9b05cc768b0a0210", "kind": "dns", "frame_number": 4772, "timestamp_epoch": "1723680649.669924000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 65521, "tcp_stream": null, "udp_stream": 73, "fields": { "dns.cname": "r-msftstatic-com.a-0016.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "r.msftstatic.com", "dns.qry.type": "65" } }, { "event_id": "evt-a4daa9779ab41f2b62efcf6e", "kind": "dns", "frame_number": 4773, "timestamp_epoch": "1723680649.669936000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 53169, "tcp_stream": null, "udp_stream": 72, "fields": { "dns.a": "204.79.197.219", "dns.cname": "r-msftstatic-com.a-0016.a-msedge.net,a-0016.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "r.msftstatic.com", "dns.qry.type": "1" } }, { "event_id": "evt-fbac52ba94e9460fead80ba8", "kind": "dns", "frame_number": 4774, "timestamp_epoch": "1723680649.671886000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 62440, "tcp_stream": null, "udp_stream": 70, "fields": { "dns.a": "23.220.103.8,23.220.103.18", "dns.cname": "p-static.bing.trafficmanager.net,r.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "r.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-a5cb3c9577045e6cf46f7f20", "kind": "dns", "frame_number": 4778, "timestamp_epoch": "1723680649.682080000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58878, "tcp_stream": null, "udp_stream": 71, "fields": { "dns.cname": "p-static.bing.trafficmanager.net,r.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "r.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-20ffc7bfbccd7a9aa5630153", "kind": "dns", "frame_number": 5162, "timestamp_epoch": "1723680650.180461000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 57244, "tcp_stream": null, "udp_stream": 43, "fields": { "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ntp.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-1211adcfe662791d471cef04", "kind": "dns", "frame_number": 5164, "timestamp_epoch": "1723680650.180626000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53, "dst_port": 57244, "tcp_stream": null, "udp_stream": 43, "fields": { "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ntp.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-13b18c46b31443a1a92726f8", "kind": "dns", "frame_number": 5368, "timestamp_epoch": "1723680650.245055000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 51850, "tcp_stream": null, "udp_stream": 46, "fields": { "dns.cname": "business-bing-com.b-0005.b-msedge.net,b-0005.b-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "business.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-966ed4cd4f3dc083fd8b3259", "kind": "dns", "frame_number": 5420, "timestamp_epoch": "1723680650.426947000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 51888, "dst_port": 53, "tcp_stream": null, "udp_stream": 75, "fields": { "dns.flags.response": "False", "dns.qry.name": "ecn-us.dev.virtualearth.net", "dns.qry.type": "1" } }, { "event_id": "evt-1ae527224ec49c6afa387827", "kind": "dns", "frame_number": 5421, "timestamp_epoch": "1723680650.427087000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 63681, "dst_port": 53, "tcp_stream": null, "udp_stream": 76, "fields": { "dns.flags.response": "False", "dns.qry.name": "ecn-us.dev.virtualearth.net", "dns.qry.type": "65" } }, { "event_id": "evt-215f4877b88c4cbc5c779f29", "kind": "dns", "frame_number": 5423, "timestamp_epoch": "1723680650.427346000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 63681, "tcp_stream": null, "udp_stream": 76, "fields": { "dns.cname": "ecn-us.dev.virtualearth.net.edgekey.net,e4113.dscd.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ecn-us.dev.virtualearth.net", "dns.qry.type": "65" } }, { "event_id": "evt-296b77b811d7c3e866be739f", "kind": "dns", "frame_number": 5450, "timestamp_epoch": "1723680650.492145000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 51888, "tcp_stream": null, "udp_stream": 75, "fields": { "dns.a": "23.43.244.167", "dns.cname": "ecn-us.dev.virtualearth.net.edgekey.net,e4113.dscd.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ecn-us.dev.virtualearth.net", "dns.qry.type": "1" } }, { "event_id": "evt-c893bccb26c6d4190db8f9d5", "kind": "dns", "frame_number": 6200, "timestamp_epoch": "1723680655.252841000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64767, "dst_port": 53, "tcp_stream": null, "udp_stream": 77, "fields": { "dns.flags.response": "False", "dns.qry.name": "quote.checkfedexexp.com", "dns.qry.type": "1" } }, { "event_id": "evt-cf214dac7edbba5814e573af", "kind": "dns", "frame_number": 6201, "timestamp_epoch": "1723680655.253474000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 52997, "dst_port": 53, "tcp_stream": null, "udp_stream": 78, "fields": { "dns.flags.response": "False", "dns.qry.name": "quote.checkfedexexp.com", "dns.qry.type": "65" } }, { "event_id": "evt-a82516a1eb22dfa3ebda116e", "kind": "dns", "frame_number": 6202, "timestamp_epoch": "1723680655.259919000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 60250, "dst_port": 53, "tcp_stream": null, "udp_stream": 79, "fields": { "dns.flags.response": "False", "dns.qry.name": "quote.checkfedexexp.com", "dns.qry.type": "1" } }, { "event_id": "evt-c2172960b405bb68348f09b4", "kind": "dns", "frame_number": 6317, "timestamp_epoch": "1723680656.264200000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 54240, "dst_port": 53, "tcp_stream": null, "udp_stream": 81, "fields": { "dns.flags.response": "False", "dns.qry.name": "quote.checkfedexexp.com", "dns.qry.type": "1" } }, { "event_id": "evt-64ccf28043177408a405f069", "kind": "dns", "frame_number": 6318, "timestamp_epoch": "1723680656.264628000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 56993, "dst_port": 53, "tcp_stream": null, "udp_stream": 82, "fields": { "dns.flags.response": "False", "dns.qry.name": "quote.checkfedexexp.com", "dns.qry.type": "65" } }, { "event_id": "evt-25a438366c435d40e9a3f4eb", "kind": "dns", "frame_number": 6319, "timestamp_epoch": "1723680656.280145000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 65030, "dst_port": 53, "tcp_stream": null, "udp_stream": 83, "fields": { "dns.flags.response": "False", "dns.qry.name": "quote.checkfedexexp.com", "dns.qry.type": "1" } }, { "event_id": "evt-c61df4ae02df7a6e4916135e", "kind": "dns", "frame_number": 6371, "timestamp_epoch": "1723680657.268388000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 62933, "dst_port": 53, "tcp_stream": null, "udp_stream": 84, "fields": { "dns.flags.response": "False", "dns.qry.name": "nav-edge.smartscreen.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-448e79f6ce2f7b490c2236b1", "kind": "dns", "frame_number": 6372, "timestamp_epoch": "1723680657.268615000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58166, "dst_port": 53, "tcp_stream": null, "udp_stream": 85, "fields": { "dns.flags.response": "False", "dns.qry.name": "nav-edge.smartscreen.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-bff2940370445d7b4b34fe24", "kind": "dns", "frame_number": 6373, "timestamp_epoch": "1723680657.315924000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 62933, "tcp_stream": null, "udp_stream": 84, "fields": { "dns.a": "20.25.227.174", "dns.cname": "prod-atm-wds-edge.trafficmanager.net,prod-agic-ncu-3.northcentralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "nav-edge.smartscreen.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-9d032d894dd8a6d71a27285f", "kind": "dns", "frame_number": 6374, "timestamp_epoch": "1723680657.315929000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58166, "tcp_stream": null, "udp_stream": 85, "fields": { "dns.cname": "prod-atm-wds-edge.trafficmanager.net,prod-agic-ncu-3.northcentralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "nav-edge.smartscreen.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-b9e7d6dcefcf16d8325e5e13", "kind": "dns", "frame_number": 6403, "timestamp_epoch": "1723680658.296347000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 57585, "dst_port": 53, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.response": "False", "dns.qry.name": "quote.checkfedexexp.com", "dns.qry.type": "1" } }, { "event_id": "evt-6d587d56208c801bfd77f9da", "kind": "dns", "frame_number": 6404, "timestamp_epoch": "1723680658.485902000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 60250, "tcp_stream": null, "udp_stream": 79, "fields": { "dns.a": "104.21.55.70,172.67.170.159", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "quote.checkfedexexp.com", "dns.qry.type": "1" } }, { "event_id": "evt-0a5c340b27e84634622eb7ac", "kind": "dns", "frame_number": 6405, "timestamp_epoch": "1723680658.485954000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 54240, "tcp_stream": null, "udp_stream": 81, "fields": { "dns.a": "104.21.55.70,172.67.170.159", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "quote.checkfedexexp.com", "dns.qry.type": "1" } }, { "event_id": "evt-1b8ec2ccb1399a3c9de6f3ef", "kind": "dns", "frame_number": 6406, "timestamp_epoch": "1723680658.486039000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 65030, "tcp_stream": null, "udp_stream": 83, "fields": { "dns.a": "104.21.55.70,172.67.170.159", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "quote.checkfedexexp.com", "dns.qry.type": "1" } }, { "event_id": "evt-076a1312c5612ca399a83826", "kind": "dns", "frame_number": 6407, "timestamp_epoch": "1723680658.486084000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 57585, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.a": "104.21.55.70,172.67.170.159", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "quote.checkfedexexp.com", "dns.qry.type": "1" } }, { "event_id": "evt-65a64a5517e6f622bd23c521", "kind": "dns", "frame_number": 6408, "timestamp_epoch": "1723680658.486173000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 64767, "tcp_stream": null, "udp_stream": 77, "fields": { "dns.a": "104.21.55.70,172.67.170.159", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "quote.checkfedexexp.com", "dns.qry.type": "1" } }, { "event_id": "evt-8c61980c555db1ec7586c099", "kind": "dns", "frame_number": 6409, "timestamp_epoch": "1723680658.486185000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53, "dst_port": 60250, "tcp_stream": null, "udp_stream": 79, "fields": { "dns.a": "104.21.55.70,172.67.170.159", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "quote.checkfedexexp.com", "dns.qry.type": "1" } }, { "event_id": "evt-d6251383efa9fdee0de12b1a", "kind": "dns", "frame_number": 6412, "timestamp_epoch": "1723680658.527301000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 56993, "tcp_stream": null, "udp_stream": 82, "fields": { "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "quote.checkfedexexp.com", "dns.qry.type": "65" } }, { "event_id": "evt-faaa2f04f2215e52fd9202e6", "kind": "dns", "frame_number": 6413, "timestamp_epoch": "1723680658.527356000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 52997, "tcp_stream": null, "udp_stream": 78, "fields": { "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "quote.checkfedexexp.com", "dns.qry.type": "65" } }, { "event_id": "evt-c2d00cd7932d44db6a388662", "kind": "dns", "frame_number": 6438, "timestamp_epoch": "1723680660.000064000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58818, "dst_port": 53, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-fabb5b49946cb725ab66ebda", "kind": "dns", "frame_number": 6439, "timestamp_epoch": "1723680660.000329000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58818, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-1d791cf4000fcd553ac15776", "kind": "dns", "frame_number": 6440, "timestamp_epoch": "1723680660.047727000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 52477, "dst_port": 53, "tcp_stream": null, "udp_stream": 20, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-6749527cdb53bc191df01ccc", "kind": "dns", "frame_number": 6441, "timestamp_epoch": "1723680660.047965000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 52477, "tcp_stream": null, "udp_stream": 20, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-cbb1cc914caf1f264d0df017", "kind": "dns", "frame_number": 6458, "timestamp_epoch": "1723680661.691806000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64949, "dst_port": 53, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-0a1064d671d94882a5a06d3f", "kind": "dns", "frame_number": 6459, "timestamp_epoch": "1723680661.692095000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 64949, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-e652d1e826a92de98e47c7ac", "kind": "dns", "frame_number": 6474, "timestamp_epoch": "1723680663.071843000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 51132, "dst_port": 53, "tcp_stream": null, "udp_stream": 86, "fields": { "dns.flags.response": "False", "dns.qry.name": "dl-edge.smartscreen.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-f34421e77377e6a848236402", "kind": "dns", "frame_number": 6475, "timestamp_epoch": "1723680663.072024000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 55308, "dst_port": 53, "tcp_stream": null, "udp_stream": 87, "fields": { "dns.flags.response": "False", "dns.qry.name": "dl-edge.smartscreen.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-0209eeed2f60c1bc42a43beb", "kind": "dns", "frame_number": 6476, "timestamp_epoch": "1723680663.104422000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 51132, "tcp_stream": null, "udp_stream": 86, "fields": { "dns.a": "20.25.227.174", "dns.cname": "prod-atm-wds-edge.trafficmanager.net,prod-agic-ncu-3.northcentralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dl-edge.smartscreen.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-9daad7d076e7273a26f291c5", "kind": "dns", "frame_number": 6477, "timestamp_epoch": "1723680663.113141000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 55308, "tcp_stream": null, "udp_stream": 87, "fields": { "dns.cname": "prod-atm-wds-edge.trafficmanager.net,prod-agic-ncu-3.northcentralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dl-edge.smartscreen.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-8c5b5b12544398db265244d6", "kind": "dns", "frame_number": 8661, "timestamp_epoch": "1723680664.215425000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 54413, "dst_port": 53, "tcp_stream": null, "udp_stream": 88, "fields": { "dns.flags.response": "False", "dns.qry.name": "app-edge.smartscreen.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-1baab04c833c7a6df94eb15c", "kind": "dns", "frame_number": 8662, "timestamp_epoch": "1723680664.215734000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58784, "dst_port": 53, "tcp_stream": null, "udp_stream": 89, "fields": { "dns.flags.response": "False", "dns.qry.name": "app-edge.smartscreen.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-14937a7ba47367f39f7a808c", "kind": "dns", "frame_number": 8682, "timestamp_epoch": "1723680665.231999000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 59180, "dst_port": 53, "tcp_stream": null, "udp_stream": 90, "fields": { "dns.flags.response": "False", "dns.qry.name": "app-edge.smartscreen.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-b632e63a3ec4e947f868130a", "kind": "dns", "frame_number": 8683, "timestamp_epoch": "1723680665.233026000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 55746, "dst_port": 53, "tcp_stream": null, "udp_stream": 91, "fields": { "dns.flags.response": "False", "dns.qry.name": "app-edge.smartscreen.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-ab866f0ac3a4f83f882402ab", "kind": "dns", "frame_number": 8701, "timestamp_epoch": "1723680667.265972000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 57585, "dst_port": 53, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.response": "False", "dns.qry.name": "app-edge.smartscreen.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-af1a2af05a5106c490886fcf", "kind": "dns", "frame_number": 8718, "timestamp_epoch": "1723680668.267596000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 57585, "dst_port": 53, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.response": "False", "dns.qry.name": "app-edge.smartscreen.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-7544cfd1363789c6abe4e6fe", "kind": "dns", "frame_number": 8719, "timestamp_epoch": "1723680668.316350000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 57585, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.a": "104.40.82.182", "dns.cname": "prod-atm-wds-apprep.trafficmanager.net,prod-agic-wu-3.westus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "app-edge.smartscreen.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-408fc638ab7faaef364dfea9", "kind": "dns", "frame_number": 8751, "timestamp_epoch": "1723680669.037777000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58818, "dst_port": 53, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-c2a2328d0b7a7ac9a163156f", "kind": "dns", "frame_number": 8752, "timestamp_epoch": "1723680669.038090000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58818, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.a": "10.8.15.4", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-e24cca1b6e2e4a19139ee782", "kind": "dns", "frame_number": 8890, "timestamp_epoch": "1723680677.670259000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64949, "dst_port": 53, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.response": "False", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-5da105ba173024ce056e0135", "kind": "dns", "frame_number": 8891, "timestamp_epoch": "1723680678.670302000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64949, "dst_port": 53, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.response": "False", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-790fe65249510fe1a434e503", "kind": "dns", "frame_number": 8894, "timestamp_epoch": "1723680679.670382000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64949, "dst_port": 53, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.response": "False", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-6235a4874cdd613f2bde31ff", "kind": "dns", "frame_number": 8897, "timestamp_epoch": "1723680680.276752000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 55746, "tcp_stream": null, "udp_stream": 91, "fields": { "dns.flags.rcode": "2", "dns.flags.response": "True", "dns.qry.name": "app-edge.smartscreen.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-2df626f8327ac3bcb5daede2", "kind": "dns", "frame_number": 8898, "timestamp_epoch": "1723680680.276879000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58784, "tcp_stream": null, "udp_stream": 89, "fields": { "dns.flags.rcode": "2", "dns.flags.response": "True", "dns.qry.name": "app-edge.smartscreen.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-5b302512c6131821320d9015", "kind": "dns", "frame_number": 8899, "timestamp_epoch": "1723680680.276913000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53, "dst_port": 55746, "tcp_stream": null, "udp_stream": 91, "fields": { "dns.flags.rcode": "2", "dns.flags.response": "True", "dns.qry.name": "app-edge.smartscreen.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-e60b798b7b44b7dba88035b9", "kind": "dns", "frame_number": 8900, "timestamp_epoch": "1723680680.283851000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 59180, "tcp_stream": null, "udp_stream": 90, "fields": { "dns.flags.rcode": "2", "dns.flags.response": "True", "dns.qry.name": "app-edge.smartscreen.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-a5622ccd440d13f31c37bfb0", "kind": "dns", "frame_number": 8901, "timestamp_epoch": "1723680680.283935000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 57585, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.rcode": "2", "dns.flags.response": "True", "dns.qry.name": "app-edge.smartscreen.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-a26a2cdbfd853130c76bedec", "kind": "dns", "frame_number": 8902, "timestamp_epoch": "1723680680.283981000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 54413, "tcp_stream": null, "udp_stream": 88, "fields": { "dns.flags.rcode": "2", "dns.flags.response": "True", "dns.qry.name": "app-edge.smartscreen.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-fc0f2c7e25966e8b8ca0cbc3", "kind": "dns", "frame_number": 8906, "timestamp_epoch": "1723680680.969233000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58984, "dst_port": 53, "tcp_stream": null, "udp_stream": 93, "fields": { "dns.flags.response": "False", "dns.qry.name": "bzib.nelreports.net", "dns.qry.type": "1" } }, { "event_id": "evt-dd522451b2de2003ed5133de", "kind": "dns", "frame_number": 8907, "timestamp_epoch": "1723680680.969419000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64584, "dst_port": 53, "tcp_stream": null, "udp_stream": 94, "fields": { "dns.flags.response": "False", "dns.qry.name": "bzib.nelreports.net", "dns.qry.type": "65" } }, { "event_id": "evt-a3bdb975afbba33509edfff0", "kind": "dns", "frame_number": 8908, "timestamp_epoch": "1723680681.020509000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 64584, "tcp_stream": null, "udp_stream": 94, "fields": { "dns.cname": "bzib.nelreports.net.akamaized.net,a416.dscd.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "bzib.nelreports.net", "dns.qry.type": "65" } }, { "event_id": "evt-a0ec70b45570058070f54e87", "kind": "dns", "frame_number": 8910, "timestamp_epoch": "1723680681.044086000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58984, "tcp_stream": null, "udp_stream": 93, "fields": { "dns.a": "23.215.55.139,23.215.55.144", "dns.cname": "bzib.nelreports.net.akamaized.net,a416.dscd.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "bzib.nelreports.net", "dns.qry.type": "1" } }, { "event_id": "evt-63e3863a167370b28aaf0cd2", "kind": "dns", "frame_number": 8980, "timestamp_epoch": "1723680681.686186000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64949, "dst_port": 53, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.flags.response": "False", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-98d2630ae04aba31cd3f4923", "kind": "dns", "frame_number": 9002, "timestamp_epoch": "1723680682.288508000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 64949, "tcp_stream": null, "udp_stream": 14, "fields": { "dns.a": "23.53.13.196,23.53.13.200,23.53.13.204,23.53.13.206,23.53.13.197,23.53.13.207,23.53.13.205,23.53.13.198,23.53.13.202", "dns.cname": "assets.msn.com.edgekey.net,e28578.d.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-1ccee8c7cf1a45c3c10659a8", "kind": "dns", "frame_number": 9026, "timestamp_epoch": "1723680683.970135000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58818, "dst_port": 53, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.response": "False", "dns.qry.name": "business.checkfedexexp.com", "dns.qry.type": "1" } }, { "event_id": "evt-66b1005ea8c7fdbe83f1a5d0", "kind": "dns", "frame_number": 9027, "timestamp_epoch": "1723680684.025067000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58818, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.a": "172.67.170.159,104.21.55.70", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "business.checkfedexexp.com", "dns.qry.type": "1" } }, { "event_id": "evt-a6f9aa7c8318bd0749644a33", "kind": "dns", "frame_number": 10193, "timestamp_epoch": "1723680685.713930000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58818, "dst_port": 53, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.response": "False", "dns.qry.name": "msedge.b.tlu.dl.delivery.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-683dc818c4482cf35ccf25fd", "kind": "dns", "frame_number": 10194, "timestamp_epoch": "1723680685.765017000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58818, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.a": "199.232.210.172,199.232.214.172", "dns.cname": "star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com,cdp-f-tlu-net.trafficmanager.net,fg.microsoft.map.fastly.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "msedge.b.tlu.dl.delivery.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-552a0b67d1f453392602115f", "kind": "dns", "frame_number": 10235, "timestamp_epoch": "1723680693.779007000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 62859, "dst_port": 53, "tcp_stream": null, "udp_stream": 96, "fields": { "dns.flags.response": "False", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-8080f5f0dcdcf19d816ffa77", "kind": "dns", "frame_number": 10236, "timestamp_epoch": "1723680693.779153000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58738, "dst_port": 53, "tcp_stream": null, "udp_stream": 97, "fields": { "dns.flags.response": "False", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-8f1c87c588ce71b23f1b81fb", "kind": "dns", "frame_number": 10245, "timestamp_epoch": "1723680693.831947000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 62859, "tcp_stream": null, "udp_stream": 96, "fields": { "dns.a": "13.107.21.239,204.79.197.239", "dns.cname": "edge-microsoft-com.dual-a-0036.a-msedge.net,dual-a-0036.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-99435d5cff5310aa4786dfc9", "kind": "dns", "frame_number": 10247, "timestamp_epoch": "1723680693.864576000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58738, "tcp_stream": null, "udp_stream": 97, "fields": { "dns.cname": "edge-microsoft-com.dual-a-0036.a-msedge.net,dual-a-0036.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-6e6439db1f318c985461352f", "kind": "dns", "frame_number": 10248, "timestamp_epoch": "1723680693.864899000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53, "dst_port": 58738, "tcp_stream": null, "udp_stream": 97, "fields": { "dns.cname": "edge-microsoft-com.dual-a-0036.a-msedge.net,dual-a-0036.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-7fad152e1662233b8c75c4d5", "kind": "dns", "frame_number": 10281, "timestamp_epoch": "1723680706.485092000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58818, "dst_port": 53, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.response": "False", "dns.qry.name": "msedge.b.tlu.dl.delivery.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-7eb505dba10c99144f84c0c2", "kind": "dns", "frame_number": 10283, "timestamp_epoch": "1723680706.544699000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58818, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.a": "199.232.214.172,199.232.210.172", "dns.cname": "star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com,cdp-f-tlu-net.trafficmanager.net,fg.microsoft.map.fastly.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "msedge.b.tlu.dl.delivery.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-82205394a5a528e2d569f169", "kind": "dns", "frame_number": 10379, "timestamp_epoch": "1723680707.940727000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58818, "dst_port": 53, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.response": "False", "dns.qry.name": "login.microsoftonline.com", "dns.qry.type": "1" } }, { "event_id": "evt-acfd84e30db9ad62d49939b1", "kind": "dns", "frame_number": 10380, "timestamp_epoch": "1723680708.002327000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58818, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.a": "40.126.29.5,40.126.29.10,40.126.29.12,20.190.157.9,40.126.29.11,40.126.29.6,40.126.29.8,40.126.29.15", "dns.cname": "login.mso.msidentity.com,ak.privatelink.msidentity.com,www.tm.ak.prd.aadg.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "login.microsoftonline.com", "dns.qry.type": "1" } }, { "event_id": "evt-1c9d57a75e4196297ca9cf9e", "kind": "dns", "frame_number": 10406, "timestamp_epoch": "1723680708.820866000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58818, "dst_port": 53, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-4221612df057259a0dbe9469", "kind": "dns", "frame_number": 10409, "timestamp_epoch": "1723680708.899414000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58818, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.a": "52.137.106.217", "dns.cname": "atm-settingsfe-prod-geo2.trafficmanager.net,settings-prod-wus2-1.westus2.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-522b6cb24f781bf92c2aadb1", "kind": "dns", "frame_number": 10904, "timestamp_epoch": "1723680752.995003000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58818, "dst_port": 53, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-6143c7f88518ef78b97fceb4", "kind": "dns", "frame_number": 10905, "timestamp_epoch": "1723680753.042487000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58818, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.a": "52.182.143.215", "dns.cname": "win-global-asimov-leafs-events-data.trafficmanager.net,onedscolprdcus22.centralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-862a80ac44458d5687ea4f0e", "kind": "dns", "frame_number": 10937, "timestamp_epoch": "1723680753.377987000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58818, "dst_port": 53, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.response": "False", "dns.qry.name": "v20.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-7009fb16b718b8061517d4cf", "kind": "dns", "frame_number": 10939, "timestamp_epoch": "1723680753.424669000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58818, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.a": "52.182.143.215", "dns.cname": "win-global-asimov-leafs-events-data.trafficmanager.net,onedscolprdcus22.centralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v20.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-c0633218d3ee46f9cd3d85e1", "kind": "dns", "frame_number": 11630, "timestamp_epoch": "1723680795.687200000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58818, "dst_port": 53, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.WIN-JEGJIX7Q9RS.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-74a53ca3d48f18f884b5fdb3", "kind": "dns", "frame_number": 11631, "timestamp_epoch": "1723680795.687478000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58818, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.WIN-JEGJIX7Q9RS.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-7aacb8cb09a112afe7a62233", "kind": "dns", "frame_number": 11632, "timestamp_epoch": "1723680795.687836000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58818, "dst_port": 53, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.WIN-JEGJIX7Q9RS.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-1018e2cc7146120ad62017fb", "kind": "dns", "frame_number": 11633, "timestamp_epoch": "1723680795.688001000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58818, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.WIN-JEGJIX7Q9RS.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-3b10f38b63df8d457c794aa1", "kind": "dns", "frame_number": 11684, "timestamp_epoch": "1723680796.408305000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58818, "dst_port": 53, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.response": "False", "dns.qry.name": "fd.api.iris.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-c385643f6f2b44f4c3aa062e", "kind": "dns", "frame_number": 11690, "timestamp_epoch": "1723680797.397984000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58818, "dst_port": 53, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.response": "False", "dns.qry.name": "fd.api.iris.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-f61fae060221a86e4c255aaa", "kind": "dns", "frame_number": 11691, "timestamp_epoch": "1723680797.495755000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 56929, "dst_port": 53, "tcp_stream": null, "udp_stream": 99, "fields": { "dns.flags.response": "False", "dns.qry.name": "dual-s-ring.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-c116fa822bd26e542c703900", "kind": "dns", "frame_number": 11696, "timestamp_epoch": "1723680797.539068000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 56929, "tcp_stream": null, "udp_stream": 99, "fields": { "dns.a": "52.123.128.254,52.123.129.254", "dns.cname": "s-ring.dual-s-9999.dual-s-msedge.net,dual-s-9999.dual-s-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dual-s-ring.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-f4c3f072fc2adef0a9eeb821", "kind": "dns", "frame_number": 11731, "timestamp_epoch": "1723680797.768357000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 56929, "dst_port": 53, "tcp_stream": null, "udp_stream": 99, "fields": { "dns.flags.response": "False", "dns.qry.name": "ow1.res.office365.com", "dns.qry.type": "1" } }, { "event_id": "evt-b0c71c04a6f259fb9ea20e8b", "kind": "dns", "frame_number": 11732, "timestamp_epoch": "1723680797.801043000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 56929, "tcp_stream": null, "udp_stream": 99, "fields": { "dns.a": "23.53.13.205,23.53.13.206,23.53.13.204", "dns.cname": "ow1.res.office365.com.edgekey.net,e40491.dscd.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ow1.res.office365.com", "dns.qry.type": "1" } }, { "event_id": "evt-2d92963a963883cd2de60697", "kind": "dns", "frame_number": 11763, "timestamp_epoch": "1723680798.231667000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 56929, "dst_port": 53, "tcp_stream": null, "udp_stream": 99, "fields": { "dns.flags.response": "False", "dns.qry.name": "c-ring.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-0a38425112869bfead2a8524", "kind": "dns", "frame_number": 11764, "timestamp_epoch": "1723680798.271398000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 56929, "tcp_stream": null, "udp_stream": 99, "fields": { "dns.a": "13.107.4.254", "dns.cname": "c-ring.c-9999.c-msedge.net,c-9999.c-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "c-ring.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-a31989abd227733ebef7fc03", "kind": "dns", "frame_number": 11776, "timestamp_epoch": "1723680798.412708000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58818, "dst_port": 53, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.response": "False", "dns.qry.name": "fd.api.iris.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-7435eb2726aa7ff9f21cc3fa", "kind": "dns", "frame_number": 11801, "timestamp_epoch": "1723680798.683610000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 56929, "dst_port": 53, "tcp_stream": null, "udp_stream": 99, "fields": { "dns.flags.response": "False", "dns.qry.name": "fp.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-62d50b0f84d3ac79ddb80155", "kind": "dns", "frame_number": 11802, "timestamp_epoch": "1723680798.727364000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 56929, "tcp_stream": null, "udp_stream": 99, "fields": { "dns.a": "204.79.197.222", "dns.cname": "1.perf.msedge.net,a-0019.a-msedge.net,a-0019.a.dns.azurefd.net,a-0019.standard.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fp.msedge.net", "dns.qry.type": "1" } }, { "event_id": "evt-119a136e227274579e90f5f3", "kind": "dns", "frame_number": 11840, "timestamp_epoch": "1723680800.428651000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58818, "dst_port": 53, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.response": "False", "dns.qry.name": "fd.api.iris.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-b47ae0b492ec0538d01d02e0", "kind": "dns", "frame_number": 11866, "timestamp_epoch": "1723680800.899368000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58818, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.a": "23.96.180.189", "dns.cname": "fd-api-iris.trafficmanager.net,iris-de-prod-azsc-v2-ncus.northcentralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fd.api.iris.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-9d51933ce98deec10cb49c0b", "kind": "dns", "frame_number": 11900, "timestamp_epoch": "1723680802.766808000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 56929, "dst_port": 53, "tcp_stream": null, "udp_stream": 99, "fields": { "dns.flags.response": "False", "dns.qry.name": "cxcs.microsoft.net", "dns.qry.type": "1" } }, { "event_id": "evt-1263f163563852f5e21a501a", "kind": "dns", "frame_number": 11901, "timestamp_epoch": "1723680802.768051000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 51799, "dst_port": 53, "tcp_stream": null, "udp_stream": 100, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-b32cc226a03732fe4f9208eb", "kind": "dns", "frame_number": 11902, "timestamp_epoch": "1723680802.828739000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 56929, "tcp_stream": null, "udp_stream": 99, "fields": { "dns.a": "23.195.200.230", "dns.cname": "cxcs.microsoft.net.edgekey.net,e3230.b.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "cxcs.microsoft.net", "dns.qry.type": "1" } }, { "event_id": "evt-ac4836add0b4827759a6fd24", "kind": "dns", "frame_number": 11904, "timestamp_epoch": "1723680802.830048000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 51799, "tcp_stream": null, "udp_stream": 100, "fields": { "dns.a": "23.220.103.72,23.220.103.78", "dns.cname": "www-www.bing.com.trafficmanager.net,www.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-b7e5f9d5ab6294b6dd053300", "kind": "dns", "frame_number": 12102, "timestamp_epoch": "1723680857.693121000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 56929, "dst_port": 53, "tcp_stream": null, "udp_stream": 99, "fields": { "dns.flags.response": "False", "dns.qry.name": "weathermapdata.blob.core.windows.net", "dns.qry.type": "1" } }, { "event_id": "evt-5528d0316d2dd19cfd9dcff8", "kind": "dns", "frame_number": 12103, "timestamp_epoch": "1723680857.763655000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 56929, "tcp_stream": null, "udp_stream": 99, "fields": { "dns.a": "20.60.228.1", "dns.cname": "blob.mwh03prdstf02a.store.core.windows.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "weathermapdata.blob.core.windows.net", "dns.qry.type": "1" } }, { "event_id": "evt-f24f568a9cc4cdc1e8fd6060", "kind": "dns", "frame_number": 12206, "timestamp_epoch": "1723680895.679744000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 59670, "dst_port": 53, "tcp_stream": null, "udp_stream": 102, "fields": { "dns.flags.response": "False", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-bc2ff56e45b246adafcd607b", "kind": "dns", "frame_number": 12207, "timestamp_epoch": "1723680895.680047000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 57799, "dst_port": 53, "tcp_stream": null, "udp_stream": 103, "fields": { "dns.flags.response": "False", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-ba638872d3cf18d9ad22c9e3", "kind": "dns", "frame_number": 12208, "timestamp_epoch": "1723680895.684241000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 51799, "dst_port": 53, "tcp_stream": null, "udp_stream": 100, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-8c39f785ec58543f5f39ff2b", "kind": "dns", "frame_number": 12209, "timestamp_epoch": "1723680895.684574000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 51799, "tcp_stream": null, "udp_stream": 100, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-c4478742f273030a0983e0f1", "kind": "dns", "frame_number": 12210, "timestamp_epoch": "1723680895.742669000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 59670, "tcp_stream": null, "udp_stream": 102, "fields": { "dns.a": "13.107.21.239,204.79.197.239", "dns.cname": "edge-microsoft-com.dual-a-0036.a-msedge.net,dual-a-0036.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-556ed64284c2c70fa1476740", "kind": "dns", "frame_number": 12212, "timestamp_epoch": "1723680895.806474000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 57799, "tcp_stream": null, "udp_stream": 103, "fields": { "dns.cname": "edge-microsoft-com.dual-a-0036.a-msedge.net,dual-a-0036.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-399b549dae8043633d1de71c", "kind": "dns", "frame_number": 12213, "timestamp_epoch": "1723680895.806761000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53, "dst_port": 57799, "tcp_stream": null, "udp_stream": 103, "fields": { "dns.cname": "edge-microsoft-com.dual-a-0036.a-msedge.net,dual-a-0036.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "65" } }, { "event_id": "evt-7f29501ba2b51430e5540c82", "kind": "dns", "frame_number": 12259, "timestamp_epoch": "1723680909.209122000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 56929, "dst_port": 53, "tcp_stream": null, "udp_stream": 99, "fields": { "dns.flags.response": "False", "dns.qry.name": "mrodevicemgr.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-f6ed83ae57bc660371966ea6", "kind": "dns", "frame_number": 12260, "timestamp_epoch": "1723680909.256572000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 56929, "dst_port": 53, "tcp_stream": null, "udp_stream": 99, "fields": { "dns.flags.response": "False", "dns.qry.name": "mrodevicemgr.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-599e10e8855a20a545ec96b5", "kind": "dns", "frame_number": 12261, "timestamp_epoch": "1723680909.294038000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 56929, "tcp_stream": null, "udp_stream": 99, "fields": { "dns.a": "52.109.0.136", "dns.cname": "prod.mrodevicemgr.live.com.akadns.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "mrodevicemgr.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-a742ad9568a1b7719c29b773", "kind": "dns", "frame_number": 12409, "timestamp_epoch": "1723680911.067406000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 51799, "dst_port": 53, "tcp_stream": null, "udp_stream": 100, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-c2e8e46dfbc281d0dacd1908", "kind": "dns", "frame_number": 12410, "timestamp_epoch": "1723680911.067621000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 51799, "tcp_stream": null, "udp_stream": 100, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-57118b28827421ddcb92ef55", "kind": "dns", "frame_number": 12411, "timestamp_epoch": "1723680911.070171000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 51799, "dst_port": 53, "tcp_stream": null, "udp_stream": 100, "fields": { "dns.flags.response": "False", "dns.qry.name": "windows.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-a41551fcf053f0169aafe2e2", "kind": "dns", "frame_number": 12416, "timestamp_epoch": "1723680911.073896000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 62937, "dst_port": 53, "tcp_stream": null, "udp_stream": 104, "fields": { "dns.flags.response": "False", "dns.qry.name": "windows.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-f90acd4eb4693e4bc256b313", "kind": "dns", "frame_number": 12417, "timestamp_epoch": "1723680911.074019000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 59823, "dst_port": 53, "tcp_stream": null, "udp_stream": 105, "fields": { "dns.flags.response": "False", "dns.qry.name": "windows.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-59805a5c237a42361707fb6d", "kind": "dns", "frame_number": 12419, "timestamp_epoch": "1723680911.102840000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 62937, "tcp_stream": null, "udp_stream": 104, "fields": { "dns.a": "204.79.197.203", "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "windows.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-9a4512b589218d5d65c9c859", "kind": "dns", "frame_number": 12420, "timestamp_epoch": "1723680911.102883000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 51799, "tcp_stream": null, "udp_stream": 100, "fields": { "dns.a": "204.79.197.203", "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "windows.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-eaacad40015a58af1017bfe4", "kind": "dns", "frame_number": 12427, "timestamp_epoch": "1723680911.152944000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 59823, "tcp_stream": null, "udp_stream": 105, "fields": { "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "windows.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-c6031acf6310315c973fb86e", "kind": "dns", "frame_number": 12428, "timestamp_epoch": "1723680911.153097000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53, "dst_port": 59823, "tcp_stream": null, "udp_stream": 105, "fields": { "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "windows.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-07ae97bb9db81a7b66446a91", "kind": "dns", "frame_number": 12504, "timestamp_epoch": "1723680911.756577000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 51799, "dst_port": 53, "tcp_stream": null, "udp_stream": 100, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.WIN-JEGJIX7Q9RS.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-9eb582cd9ff88213dc2a5ccd", "kind": "dns", "frame_number": 12505, "timestamp_epoch": "1723680911.756852000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 51799, "tcp_stream": null, "udp_stream": 100, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.WIN-JEGJIX7Q9RS.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-da412cf0fa6a5a3fce545e2b", "kind": "dns", "frame_number": 12506, "timestamp_epoch": "1723680911.757150000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 51799, "dst_port": 53, "tcp_stream": null, "udp_stream": 100, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.WIN-JEGJIX7Q9RS.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-62c172d1fa248d2b817566b4", "kind": "dns", "frame_number": 12507, "timestamp_epoch": "1723680911.757303000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 51799, "tcp_stream": null, "udp_stream": 100, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.WIN-JEGJIX7Q9RS.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-ed653d4ae2c2e092e1e0ccb3", "kind": "dns", "frame_number": 12534, "timestamp_epoch": "1723680911.786577000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58263, "dst_port": 53, "tcp_stream": null, "udp_stream": 106, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-8d446edeb380e8fdaa9ae54f", "kind": "dns", "frame_number": 12535, "timestamp_epoch": "1723680911.786702000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 60775, "dst_port": 53, "tcp_stream": null, "udp_stream": 107, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-b874d49042122b52b2a471f8", "kind": "dns", "frame_number": 12536, "timestamp_epoch": "1723680911.786884000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58263, "tcp_stream": null, "udp_stream": 106, "fields": { "dns.a": "204.79.197.203", "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-66cceb0c0388e6998fbdd98f", "kind": "dns", "frame_number": 12537, "timestamp_epoch": "1723680911.786888000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 60775, "tcp_stream": null, "udp_stream": 107, "fields": { "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-60b30502a8ae921a96dd60b3", "kind": "dns", "frame_number": 12574, "timestamp_epoch": "1723680912.166445000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 54553, "dst_port": 53, "tcp_stream": null, "udp_stream": 108, "fields": { "dns.flags.response": "False", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-c3f947d6ec2e7a2fcb678b84", "kind": "dns", "frame_number": 12575, "timestamp_epoch": "1723680912.166716000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64957, "dst_port": 53, "tcp_stream": null, "udp_stream": 109, "fields": { "dns.flags.response": "False", "dns.qry.name": "assets.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-743dd056500add4b109ff913", "kind": "dns", "frame_number": 12576, "timestamp_epoch": "1723680912.167089000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 64957, "tcp_stream": null, "udp_stream": 109, "fields": { "dns.cname": "assets.msn.com.edgekey.net,e28578.d.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "assets.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-eacc17f7d803a624930a1fcb", "kind": "dns", "frame_number": 12577, "timestamp_epoch": "1723680912.207185000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 54553, "tcp_stream": null, "udp_stream": 108, "fields": { "dns.a": "23.223.31.34,23.223.31.32,23.223.31.40,23.223.31.39,23.223.31.33,23.223.31.31,23.223.31.37,23.223.31.29,23.223.31.36", "dns.cname": "assets.msn.com.edgekey.net,e28578.d.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-2d010919b06be0d61b4b4582", "kind": "dns", "frame_number": 12585, "timestamp_epoch": "1723680912.259888000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 65271, "dst_port": 53, "tcp_stream": null, "udp_stream": 110, "fields": { "dns.flags.response": "False", "dns.qry.name": "api.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-28b7eec3b4612e9a1d12e712", "kind": "dns", "frame_number": 12586, "timestamp_epoch": "1723680912.260050000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 60084, "dst_port": 53, "tcp_stream": null, "udp_stream": 111, "fields": { "dns.flags.response": "False", "dns.qry.name": "api.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-ea674fe7bb9e0d045545ec13", "kind": "dns", "frame_number": 12587, "timestamp_epoch": "1723680912.303311000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 60084, "tcp_stream": null, "udp_stream": 111, "fields": { "dns.cname": "api-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "api.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-367399af194c1e35e9bd725f", "kind": "dns", "frame_number": 12588, "timestamp_epoch": "1723680912.303775000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 65271, "tcp_stream": null, "udp_stream": 110, "fields": { "dns.a": "204.79.197.203", "dns.cname": "api-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "api.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-195c5fb5d953bfbb716ddc70", "kind": "dns", "frame_number": 12713, "timestamp_epoch": "1723680912.900370000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 62901, "dst_port": 53, "tcp_stream": null, "udp_stream": 112, "fields": { "dns.flags.response": "False", "dns.qry.name": "srtb.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-1ba0fe67548e08616fbbd784", "kind": "dns", "frame_number": 12714, "timestamp_epoch": "1723680912.900658000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 60564, "dst_port": 53, "tcp_stream": null, "udp_stream": 113, "fields": { "dns.flags.response": "False", "dns.qry.name": "srtb.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-61501028653363b7129f60d8", "kind": "dns", "frame_number": 12715, "timestamp_epoch": "1723680912.900953000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 62901, "tcp_stream": null, "udp_stream": 112, "fields": { "dns.a": "204.79.197.203", "dns.cname": "www.msn.com,www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "srtb.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-cc58dab2b9da2a530fd94580", "kind": "dns", "frame_number": 12716, "timestamp_epoch": "1723680912.900993000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 60564, "tcp_stream": null, "udp_stream": 113, "fields": { "dns.cname": "www.msn.com,www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "srtb.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-672f012fae6c8e7fc006d567", "kind": "dns", "frame_number": 12735, "timestamp_epoch": "1723680913.097542000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 59977, "dst_port": 53, "tcp_stream": null, "udp_stream": 114, "fields": { "dns.flags.response": "False", "dns.qry.name": "th.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-58f4de2ef5d73b2e85ccede6", "kind": "dns", "frame_number": 12736, "timestamp_epoch": "1723680913.097679000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 65219, "dst_port": 53, "tcp_stream": null, "udp_stream": 115, "fields": { "dns.flags.response": "False", "dns.qry.name": "th.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-8f8caf259e2368c18ff4c9aa", "kind": "dns", "frame_number": 12737, "timestamp_epoch": "1723680913.098044000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 56803, "dst_port": 53, "tcp_stream": null, "udp_stream": 116, "fields": { "dns.flags.response": "False", "dns.qry.name": "img-s-msn-com.akamaized.net", "dns.qry.type": "1" } }, { "event_id": "evt-99a557781623b846657a3143", "kind": "dns", "frame_number": 12738, "timestamp_epoch": "1723680913.098252000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 51724, "dst_port": 53, "tcp_stream": null, "udp_stream": 117, "fields": { "dns.flags.response": "False", "dns.qry.name": "img-s-msn-com.akamaized.net", "dns.qry.type": "65" } }, { "event_id": "evt-3eb185e55ba7b6837bb539a6", "kind": "dns", "frame_number": 12745, "timestamp_epoch": "1723680913.142890000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 59977, "tcp_stream": null, "udp_stream": 114, "fields": { "dns.a": "23.220.103.72,23.220.103.78", "dns.cname": "p-th.bing.com.trafficmanager.net,th.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "th.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-3e96bfcc24d8a28fed637733", "kind": "dns", "frame_number": 12746, "timestamp_epoch": "1723680913.142907000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 51724, "tcp_stream": null, "udp_stream": 117, "fields": { "dns.cname": "a1834.dscg2.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "img-s-msn-com.akamaized.net", "dns.qry.type": "65" } }, { "event_id": "evt-3268219bb9999548065a4498", "kind": "dns", "frame_number": 12747, "timestamp_epoch": "1723680913.153633000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 56803, "tcp_stream": null, "udp_stream": 116, "fields": { "dns.a": "23.205.110.12,23.205.110.59", "dns.cname": "a1834.dscg2.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "img-s-msn-com.akamaized.net", "dns.qry.type": "1" } }, { "event_id": "evt-872fcd631534a220904d7282", "kind": "dns", "frame_number": 12749, "timestamp_epoch": "1723680913.162609000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 65219, "tcp_stream": null, "udp_stream": 115, "fields": { "dns.cname": "p-th.bing.com.trafficmanager.net,th.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "th.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-101888fd8b8fa3751ef5ad7b", "kind": "dns", "frame_number": 12769, "timestamp_epoch": "1723680913.219315000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53643, "dst_port": 53, "tcp_stream": null, "udp_stream": 119, "fields": { "dns.flags.response": "False", "dns.qry.name": "img.s-msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-8dc52fc63f2bc9a6ac97f8e7", "kind": "dns", "frame_number": 12770, "timestamp_epoch": "1723680913.234543000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 51544, "dst_port": 53, "tcp_stream": null, "udp_stream": 120, "fields": { "dns.flags.response": "False", "dns.qry.name": "img.s-msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-78bcb130610b817853dee141", "kind": "dns", "frame_number": 12808, "timestamp_epoch": "1723680913.262783000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 53643, "tcp_stream": null, "udp_stream": 119, "fields": { "dns.a": "23.60.57.94", "dns.cname": "wildcard.s-msn.com.edgekey.net,e7341.g.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "img.s-msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-dec227462ada25fd582a149d", "kind": "dns", "frame_number": 12878, "timestamp_epoch": "1723680913.301703000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 51544, "tcp_stream": null, "udp_stream": 120, "fields": { "dns.cname": "wildcard.s-msn.com.edgekey.net,e7341.g.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "img.s-msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-a6ad6955c93b52191187d151", "kind": "dns", "frame_number": 12880, "timestamp_epoch": "1723680913.301933000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53, "dst_port": 51544, "tcp_stream": null, "udp_stream": 120, "fields": { "dns.cname": "wildcard.s-msn.com.edgekey.net,e7341.g.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "img.s-msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-5cee7fdcf9fc51691d02b262", "kind": "dns", "frame_number": 13245, "timestamp_epoch": "1723680913.479286000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 65099, "dst_port": 53, "tcp_stream": null, "udp_stream": 121, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-5faa2533314b6a88c9f2b5e6", "kind": "dns", "frame_number": 13246, "timestamp_epoch": "1723680913.479440000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 61445, "dst_port": 53, "tcp_stream": null, "udp_stream": 122, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-371a7bc92f4b5d10584346d6", "kind": "dns", "frame_number": 13255, "timestamp_epoch": "1723680913.536302000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 61445, "tcp_stream": null, "udp_stream": 122, "fields": { "dns.cname": "www-www.bing.com.trafficmanager.net,www.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-4334d3508856f7ee956c7ca6", "kind": "dns", "frame_number": 13256, "timestamp_epoch": "1723680913.536517000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 65099, "tcp_stream": null, "udp_stream": 121, "fields": { "dns.a": "23.220.103.78,23.220.103.72", "dns.cname": "www-www.bing.com.trafficmanager.net,www.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-0ac50f852dc59b6cccf6c27e", "kind": "dns", "frame_number": 13597, "timestamp_epoch": "1723680919.077443000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 51799, "dst_port": 53, "tcp_stream": null, "udp_stream": 100, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-772e9479dc0201d71893b77f", "kind": "dns", "frame_number": 13598, "timestamp_epoch": "1723680919.077883000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 51799, "tcp_stream": null, "udp_stream": 100, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-b7b6815b92197ee744f4c4f8", "kind": "dns", "frame_number": 13661, "timestamp_epoch": "1723680984.803670000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 51799, "dst_port": 53, "tcp_stream": null, "udp_stream": 100, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-e613a749169b58827cda63dd", "kind": "dns", "frame_number": 13662, "timestamp_epoch": "1723680984.804064000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 51799, "tcp_stream": null, "udp_stream": 100, "fields": { "dns.a": "10.8.15.4", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-91375f0c1b257f35e05f64d1", "kind": "dns", "frame_number": 13820, "timestamp_epoch": "1723680987.913914000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 51799, "dst_port": 53, "tcp_stream": null, "udp_stream": 100, "fields": { "dns.flags.response": "False", "dns.qry.name": "login.microsoftonline.com", "dns.qry.type": "1" } }, { "event_id": "evt-8dd4a8ebc11a7792cbeaa11b", "kind": "dns", "frame_number": 13826, "timestamp_epoch": "1723680987.962385000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 51799, "tcp_stream": null, "udp_stream": 100, "fields": { "dns.a": "40.126.29.10,40.126.29.12,20.190.157.9,40.126.29.11,40.126.29.6,40.126.29.8,40.126.29.15,40.126.29.5", "dns.cname": "login.mso.msidentity.com,ak.privatelink.msidentity.com,www.tm.ak.prd.aadg.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "login.microsoftonline.com", "dns.qry.type": "1" } }, { "event_id": "evt-51acaecb47d1fd60725f944d", "kind": "dns", "frame_number": 13828, "timestamp_epoch": "1723680987.992265000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 51799, "dst_port": 53, "tcp_stream": null, "udp_stream": 100, "fields": { "dns.flags.response": "False", "dns.qry.name": "pti.store.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-967608927071779c6ba7e7a0", "kind": "dns", "frame_number": 13833, "timestamp_epoch": "1723680988.023398000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 51799, "tcp_stream": null, "udp_stream": 100, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "pti.store.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-80748f505f818fa13fd04f67", "kind": "dns", "frame_number": 13848, "timestamp_epoch": "1723680988.261653000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 51799, "dst_port": 53, "tcp_stream": null, "udp_stream": 100, "fields": { "dns.flags.response": "False", "dns.qry.name": "displaycatalog.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-8924e0f12de7d5bfee9dbd77", "kind": "dns", "frame_number": 13849, "timestamp_epoch": "1723680988.309333000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 51799, "dst_port": 53, "tcp_stream": null, "udp_stream": 100, "fields": { "dns.flags.response": "False", "dns.qry.name": "displaycatalog.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-b2c2d895d35428c4b85144fb", "kind": "dns", "frame_number": 13850, "timestamp_epoch": "1723680988.363063000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 51799, "tcp_stream": null, "udp_stream": 100, "fields": { "dns.a": "20.99.184.37", "dns.cname": "displaycatalog-rp.md.mp.microsoft.com.akadns.net,rp-consumer-prod-displaycatalog-geomap.trafficmanager.net,wus2s1c-displaycatalog.frontdoor.bigcatalog.commerce.microsoft.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "displaycatalog.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-e02d85f31ff459777e85bd80", "kind": "dns", "frame_number": 13884, "timestamp_epoch": "1723680989.989230000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 56698, "dst_port": 53, "tcp_stream": null, "udp_stream": 125, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-66bd20a65f6d33aa20c76933", "kind": "dns", "frame_number": 13885, "timestamp_epoch": "1723680990.037397000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 56698, "dst_port": 53, "tcp_stream": null, "udp_stream": 125, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-a4859c6e7a51c73a40a6493b", "kind": "dns", "frame_number": 13886, "timestamp_epoch": "1723680990.182754000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 56698, "tcp_stream": null, "udp_stream": 125, "fields": { "dns.a": "52.137.106.217", "dns.cname": "atm-settingsfe-prod-geo2.trafficmanager.net,settings-prod-wus2-1.westus2.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-a17d3c7b2395adcec20f8d69", "kind": "dns", "frame_number": 13888, "timestamp_epoch": "1723680990.209907000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 65010, "dst_port": 53, "tcp_stream": null, "udp_stream": 126, "fields": { "dns.flags.response": "False", "dns.qry.name": "fe3cr.delivery.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-4fef7d283c9018005cc887c0", "kind": "dns", "frame_number": 13889, "timestamp_epoch": "1723680990.271942000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 65010, "dst_port": 53, "tcp_stream": null, "udp_stream": 126, "fields": { "dns.flags.response": "False", "dns.qry.name": "fe3cr.delivery.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-6ac5eb7b5ef8e8c6f479ec65", "kind": "dns", "frame_number": 13892, "timestamp_epoch": "1723680990.284320000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 65010, "tcp_stream": null, "udp_stream": 126, "fields": { "dns.a": "13.85.23.206", "dns.cname": "fe3.delivery.mp.microsoft.com,glb.cws.prod.dcat.dsp.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fe3cr.delivery.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-d8352a1b26dc3eec5e38c733", "kind": "dns", "frame_number": 14085, "timestamp_epoch": "1723680998.875866000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 59783, "dst_port": 53, "tcp_stream": null, "udp_stream": 127, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-072f5892ae09af6986305cb6", "kind": "dns", "frame_number": 14086, "timestamp_epoch": "1723680998.928817000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 59783, "dst_port": 53, "tcp_stream": null, "udp_stream": 127, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-b8276ccfbdcef14d2272db5f", "kind": "dns", "frame_number": 14088, "timestamp_epoch": "1723680999.929164000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 59783, "dst_port": 53, "tcp_stream": null, "udp_stream": 127, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-03279f29198848ec51dc1c78", "kind": "dns", "frame_number": 14097, "timestamp_epoch": "1723681001.929216000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 59783, "dst_port": 53, "tcp_stream": null, "udp_stream": 127, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-0c5df278288d957fdd56edec", "kind": "dns", "frame_number": 14098, "timestamp_epoch": "1723681003.136912000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 59783, "tcp_stream": null, "udp_stream": 127, "fields": { "dns.a": "20.42.65.94", "dns.cname": "win-global-asimov-leafs-events-data.trafficmanager.net,onedscolprdeus23.eastus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-d66d3ac207ba391d97aa886c", "kind": "dns", "frame_number": 14144, "timestamp_epoch": "1723681007.156999000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58863, "dst_port": 53, "tcp_stream": null, "udp_stream": 128, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-47ecc75ceaf66159307de706", "kind": "dns", "frame_number": 14145, "timestamp_epoch": "1723681007.203647000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58863, "tcp_stream": null, "udp_stream": 128, "fields": { "dns.a": "20.42.65.94", "dns.cname": "win-global-asimov-leafs-events-data.trafficmanager.net,onedscolprdeus23.eastus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-07bfccea48f272ba8bcdb12b", "kind": "dns", "frame_number": 14497, "timestamp_epoch": "1723681154.404442000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58863, "dst_port": 53, "tcp_stream": null, "udp_stream": 128, "fields": { "dns.flags.response": "False", "dns.qry.name": "g.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-266a5157f7798679e05ac594", "kind": "dns", "frame_number": 14498, "timestamp_epoch": "1723681154.462102000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 58863, "dst_port": 53, "tcp_stream": null, "udp_stream": 128, "fields": { "dns.flags.response": "False", "dns.qry.name": "g.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-8a7cacbb484dd4c5b3149e7f", "kind": "dns", "frame_number": 14499, "timestamp_epoch": "1723681154.477536000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 58863, "tcp_stream": null, "udp_stream": 128, "fields": { "dns.a": "20.241.44.114", "dns.cname": "g.msn.com,g-msn-com-nsatc.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "g.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-b24efe785d5bcbd449b9f6ee", "kind": "dns", "frame_number": 14524, "timestamp_epoch": "1723681154.855956000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64180, "dst_port": 53, "tcp_stream": null, "udp_stream": 130, "fields": { "dns.flags.response": "False", "dns.qry.name": "oneclient.sfx.ms", "dns.qry.type": "1" } }, { "event_id": "evt-4395b683fbecc7036df9cda3", "kind": "dns", "frame_number": 14526, "timestamp_epoch": "1723681154.915494000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 64180, "dst_port": 53, "tcp_stream": null, "udp_stream": 130, "fields": { "dns.flags.response": "False", "dns.qry.name": "oneclient.sfx.ms", "dns.qry.type": "1" } }, { "event_id": "evt-5abafe4b08e7c15942f5b3c3", "kind": "dns", "frame_number": 14527, "timestamp_epoch": "1723681154.917557000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 64180, "tcp_stream": null, "udp_stream": 130, "fields": { "dns.a": "23.56.233.15", "dns.cname": "oneclient.sfx.ms.edgekey.net,e9659.dspg.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "oneclient.sfx.ms", "dns.qry.type": "1" } }, { "event_id": "evt-b8e40a4de74e110d37361a4e", "kind": "dns", "frame_number": 14634, "timestamp_epoch": "1723681155.362065000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49872, "dst_port": 53, "tcp_stream": null, "udp_stream": 131, "fields": { "dns.flags.response": "False", "dns.qry.name": "ecs.office.com", "dns.qry.type": "1" } }, { "event_id": "evt-0f9701671ef27ad39956fe40", "kind": "dns", "frame_number": 14636, "timestamp_epoch": "1723681155.399633000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 49872, "tcp_stream": null, "udp_stream": 131, "fields": { "dns.a": "52.113.194.132", "dns.cname": "ecs.office.trafficmanager.net,s-0005-office.config.skype.com,ecs-office.s-0005.s-msedge.net,s-0005.s-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ecs.office.com", "dns.qry.type": "1" } }, { "event_id": "evt-31cfacd938da1b51803e10a9", "kind": "dns", "frame_number": 14766, "timestamp_epoch": "1723681192.073450000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49872, "dst_port": 53, "tcp_stream": null, "udp_stream": 131, "fields": { "dns.flags.response": "False", "dns.qry.name": "fe2cr.update.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-166943b556b5e66d5f5e213d", "kind": "dns", "frame_number": 14767, "timestamp_epoch": "1723681192.120676000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 49872, "tcp_stream": null, "udp_stream": 131, "fields": { "dns.a": "52.152.180.153,20.163.45.186", "dns.cname": "fe2cr.update.msft.com.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fe2cr.update.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-2f683ddae0f1b648ebe1b8ee", "kind": "dns", "frame_number": 14914, "timestamp_epoch": "1723681207.008309000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49872, "dst_port": 53, "tcp_stream": null, "udp_stream": 131, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-62b1c4e89e3d61b30dd01a92", "kind": "dns", "frame_number": 14915, "timestamp_epoch": "1723681207.056999000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49872, "dst_port": 53, "tcp_stream": null, "udp_stream": 131, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-591c8bd2cd1f405af5da1517", "kind": "dns", "frame_number": 14917, "timestamp_epoch": "1723681208.072665000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49872, "dst_port": 53, "tcp_stream": null, "udp_stream": 131, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-11c5dcaa291262f16869c212", "kind": "dns", "frame_number": 14927, "timestamp_epoch": "1723681209.832030000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 49872, "tcp_stream": null, "udp_stream": 131, "fields": { "dns.a": "20.44.10.122", "dns.cname": "win-global-asimov-leafs-events-data.trafficmanager.net,onedscolprdcus02.centralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-da2320508e201ea4147482a1", "kind": "dns", "frame_number": 15053, "timestamp_epoch": "1723681260.039225000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 63673, "dst_port": 53, "tcp_stream": null, "udp_stream": 133, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-90b214fac559390c5736787e", "kind": "dns", "frame_number": 15054, "timestamp_epoch": "1723681260.039606000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 63673, "tcp_stream": null, "udp_stream": 133, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-35586fad97dff55687b29ca8", "kind": "dns", "frame_number": 15055, "timestamp_epoch": "1723681260.083229000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 52477, "dst_port": 53, "tcp_stream": null, "udp_stream": 20, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-e169d0190b3fe0bfeaf76ff2", "kind": "dns", "frame_number": 15056, "timestamp_epoch": "1723681260.083829000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 52477, "tcp_stream": null, "udp_stream": 20, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-fc157a9aedf10efc20da31d7", "kind": "dns", "frame_number": 15105, "timestamp_epoch": "1723681282.313529000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 63673, "dst_port": 53, "tcp_stream": null, "udp_stream": 133, "fields": { "dns.flags.response": "False", "dns.qry.name": "licensing.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-75bb3ed055a7edf083434660", "kind": "dns", "frame_number": 15106, "timestamp_epoch": "1723681282.373419000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 63673, "dst_port": 53, "tcp_stream": null, "udp_stream": 133, "fields": { "dns.flags.response": "False", "dns.qry.name": "licensing.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-a4074ac4269ece8fd0430589", "kind": "dns", "frame_number": 15107, "timestamp_epoch": "1723681282.519199000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 63673, "tcp_stream": null, "udp_stream": 133, "fields": { "dns.a": "20.3.0.251", "dns.cname": "consumer-licensing-aks2aks.md.mp.microsoft.com.akadns.net,licensing-prod-frontdoor-geomap.trafficmanager.net,wus2-5.frontdoor.licensing.commerce.microsoft.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "licensing.mp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-144fab038ae4951df8bc5369", "kind": "dns", "frame_number": 15160, "timestamp_epoch": "1723681286.063208000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53628, "dst_port": 53, "tcp_stream": null, "udp_stream": 134, "fields": { "dns.flags.response": "False", "dns.qry.name": "storecatalogrevocation.storequality.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-5be2c2f244edbcef52e557d7", "kind": "dns", "frame_number": 15161, "timestamp_epoch": "1723681286.126339000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53628, "dst_port": 53, "tcp_stream": null, "udp_stream": 134, "fields": { "dns.flags.response": "False", "dns.qry.name": "storecatalogrevocation.storequality.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-5db3da0745eec9a2bac04043", "kind": "dns", "frame_number": 15164, "timestamp_epoch": "1723681287.132932000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53628, "dst_port": 53, "tcp_stream": null, "udp_stream": 134, "fields": { "dns.flags.response": "False", "dns.qry.name": "storecatalogrevocation.storequality.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-7756e27c530bb4fcdb8da5ec", "kind": "dns", "frame_number": 15176, "timestamp_epoch": "1723681289.147160000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53628, "dst_port": 53, "tcp_stream": null, "udp_stream": 134, "fields": { "dns.flags.response": "False", "dns.qry.name": "storecatalogrevocation.storequality.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-c5109ac5643b27d651760931", "kind": "dns", "frame_number": 15177, "timestamp_epoch": "1723681289.634667000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 53628, "tcp_stream": null, "udp_stream": 134, "fields": { "dns.a": "23.194.68.140", "dns.cname": "storecatalogrevocation.storequality.microsoft.com.edgekey.net,e10198.b.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "storecatalogrevocation.storequality.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-0831bad28acfd2a0d3df012f", "kind": "dns", "frame_number": 15274, "timestamp_epoch": "1723681312.748430000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 62238, "dst_port": 53, "tcp_stream": null, "udp_stream": 135, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-b7fd40c25596e289815cf965", "kind": "dns", "frame_number": 15275, "timestamp_epoch": "1723681312.791282000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 62238, "tcp_stream": null, "udp_stream": 135, "fields": { "dns.a": "20.42.65.88", "dns.cname": "win-global-asimov-leafs-events-data.trafficmanager.net,onedscolprdeus08.eastus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-1738442d4437638cd5b1fadb", "kind": "dns", "frame_number": 15338, "timestamp_epoch": "1723681329.688680000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 62238, "dst_port": 53, "tcp_stream": null, "udp_stream": 135, "fields": { "dns.flags.response": "False", "dns.qry.name": "acroipm2.adobe.com", "dns.qry.type": "1" } }, { "event_id": "evt-cc9078772d9e03018dbb1daa", "kind": "dns", "frame_number": 15339, "timestamp_epoch": "1723681329.745963000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 62238, "dst_port": 53, "tcp_stream": null, "udp_stream": 135, "fields": { "dns.flags.response": "False", "dns.qry.name": "acroipm2.adobe.com", "dns.qry.type": "1" } }, { "event_id": "evt-4b7f292358632bfabb6350bc", "kind": "dns", "frame_number": 15340, "timestamp_epoch": "1723681329.746257000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 62238, "tcp_stream": null, "udp_stream": 135, "fields": { "dns.a": "23.220.251.208,23.220.251.196", "dns.cname": "acroipm2.adobe.com.edgesuite.net,a122.dscd.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "acroipm2.adobe.com", "dns.qry.type": "1" } }, { "event_id": "evt-071a70e5b4ba0569bec459ec", "kind": "dns", "frame_number": 15341, "timestamp_epoch": "1723681329.746343000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 62238, "tcp_stream": null, "udp_stream": 135, "fields": { "dns.a": "23.220.251.196,23.220.251.208", "dns.cname": "acroipm2.adobe.com.edgesuite.net,a122.dscd.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "acroipm2.adobe.com", "dns.qry.type": "1" } }, { "event_id": "evt-a7411b1efafd8ed81af4c78d", "kind": "dns", "frame_number": 15349, "timestamp_epoch": "1723681330.002305000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 62388, "dst_port": 53, "tcp_stream": null, "udp_stream": 136, "fields": { "dns.flags.response": "False", "dns.qry.name": "armmf.adobe.com", "dns.qry.type": "1" } }, { "event_id": "evt-75320eb8f402a3f97713d771", "kind": "dns", "frame_number": 15350, "timestamp_epoch": "1723681330.035422000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 62388, "tcp_stream": null, "udp_stream": 136, "fields": { "dns.a": "23.221.36.164", "dns.cname": "ssl.adobe.com.edgekey.net,e4578.dscb.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "armmf.adobe.com", "dns.qry.type": "1" } }, { "event_id": "evt-5a5acb020806c808ea82ea06", "kind": "dns", "frame_number": 15369, "timestamp_epoch": "1723681330.394090000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 62388, "dst_port": 53, "tcp_stream": null, "udp_stream": 136, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-83b6ae1aa286547f0ffae8cd", "kind": "dns", "frame_number": 15370, "timestamp_epoch": "1723681330.394345000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 62388, "tcp_stream": null, "udp_stream": 136, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-2479cea57e7b8756d1265e8f", "kind": "dns", "frame_number": 15381, "timestamp_epoch": "1723681338.397385000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 62388, "dst_port": 53, "tcp_stream": null, "udp_stream": 136, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-826fc5e14e13d1f287d6b166", "kind": "dns", "frame_number": 15382, "timestamp_epoch": "1723681338.397619000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 62388, "tcp_stream": null, "udp_stream": 136, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-9cba50364c970cc9bf70880a", "kind": "dns", "frame_number": 15469, "timestamp_epoch": "1723681381.384878000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 62388, "dst_port": 53, "tcp_stream": null, "udp_stream": 136, "fields": { "dns.flags.response": "False", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-31ebde654bacf3d7173abcc6", "kind": "dns", "frame_number": 15470, "timestamp_epoch": "1723681381.435487000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 62388, "tcp_stream": null, "udp_stream": 136, "fields": { "dns.a": "23.53.13.197,23.53.13.207,23.53.13.208", "dns.cname": "assets.msn.com.edgekey.net,e28578.d.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-6abf2c7f90d1e3ae7bb59546", "kind": "dns", "frame_number": 15758, "timestamp_epoch": "1723681510.149307000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 62388, "dst_port": 53, "tcp_stream": null, "udp_stream": 136, "fields": { "dns.flags.response": "False", "dns.qry.name": "ecs.office.com", "dns.qry.type": "1" } }, { "event_id": "evt-bc625bcb1370a5c104f54038", "kind": "dns", "frame_number": 15759, "timestamp_epoch": "1723681510.196760000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 62388, "tcp_stream": null, "udp_stream": 136, "fields": { "dns.a": "52.113.194.132", "dns.cname": "ecs.office.trafficmanager.net,s-0005-office.config.skype.com,ecs-office.s-0005.s-msedge.net,s-0005.s-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ecs.office.com", "dns.qry.type": "1" } }, { "event_id": "evt-f9a0218520ac7d9f94480ed6", "kind": "dns", "frame_number": 15760, "timestamp_epoch": "1723681510.197099000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 62388, "dst_port": 53, "tcp_stream": null, "udp_stream": 136, "fields": { "dns.flags.response": "False", "dns.qry.name": "ecs.office.com", "dns.qry.type": "1" } }, { "event_id": "evt-f6db426ba2ac7dbe4a801d7f", "kind": "dns", "frame_number": 15761, "timestamp_epoch": "1723681510.197245000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 62388, "tcp_stream": null, "udp_stream": 136, "fields": { "dns.a": "52.113.194.132", "dns.cname": "ecs.office.trafficmanager.net,s-0005-office.config.skype.com,ecs-office.s-0005.s-msedge.net,s-0005.s-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ecs.office.com", "dns.qry.type": "1" } }, { "event_id": "evt-01be3e7a00095b2cd34be8d0", "kind": "dns", "frame_number": 15762, "timestamp_epoch": "1723681510.197475000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53, "dst_port": 62388, "tcp_stream": null, "udp_stream": 136, "fields": { "dns.a": "52.113.194.132", "dns.cname": "ecs.office.trafficmanager.net,s-0005-office.config.skype.com,ecs-office.s-0005.s-msedge.net,s-0005.s-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ecs.office.com", "dns.qry.type": "1" } }, { "event_id": "evt-6c059c84ab6cd36842740c9a", "kind": "dns", "frame_number": 15865, "timestamp_epoch": "1723681517.318589000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 55916, "dst_port": 53, "tcp_stream": null, "udp_stream": 139, "fields": { "dns.flags.response": "False", "dns.qry.name": "nav.smartscreen.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-dee0c3fe341cf9dfa1f984f9", "kind": "dns", "frame_number": 15866, "timestamp_epoch": "1723681517.377217000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 55916, "tcp_stream": null, "udp_stream": 139, "fields": { "dns.a": "20.25.227.174", "dns.cname": "prod-atm-wds-nav.trafficmanager.net,prod-agic-ncu-3.northcentralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "nav.smartscreen.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-bce45237c14aef7f6e4fb911", "kind": "dns", "frame_number": 15879, "timestamp_epoch": "1723681517.584186000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 55916, "dst_port": 53, "tcp_stream": null, "udp_stream": 139, "fields": { "dns.flags.response": "False", "dns.qry.name": "oneocsp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-c955d69f4791f62e6c70a9a4", "kind": "dns", "frame_number": 15880, "timestamp_epoch": "1723681517.617614000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 55916, "tcp_stream": null, "udp_stream": 139, "fields": { "dns.a": "204.79.197.203", "dns.cname": "oneocsp-microsoft-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "oneocsp.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-43320db812d220df00cbc615", "kind": "dns", "frame_number": 15951, "timestamp_epoch": "1723681540.268049000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 55916, "dst_port": 53, "tcp_stream": null, "udp_stream": 139, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.WIN-JEGJIX7Q9RS.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-c7c004e1b0f4024f8b2038a8", "kind": "dns", "frame_number": 15952, "timestamp_epoch": "1723681540.268308000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 55916, "tcp_stream": null, "udp_stream": 139, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.WIN-JEGJIX7Q9RS.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-7be154004e78bfd2e58f65ca", "kind": "dns", "frame_number": 15953, "timestamp_epoch": "1723681540.268693000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 55916, "dst_port": 53, "tcp_stream": null, "udp_stream": 139, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.WIN-JEGJIX7Q9RS.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-425645f7e42587c67dd08ef0", "kind": "dns", "frame_number": 15954, "timestamp_epoch": "1723681540.268883000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 55916, "tcp_stream": null, "udp_stream": 139, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.WIN-JEGJIX7Q9RS.lafontainebleu.org", "dns.qry.type": "33" } }, { "event_id": "evt-726d5b2e8e50d5a9afc07d5a", "kind": "dns", "frame_number": 15987, "timestamp_epoch": "1723681540.680496000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 55916, "dst_port": 53, "tcp_stream": null, "udp_stream": 139, "fields": { "dns.flags.response": "False", "dns.qry.name": "fd.api.iris.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-8a232000425bb07214f81bf9", "kind": "dns", "frame_number": 15988, "timestamp_epoch": "1723681540.729615000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 55916, "dst_port": 53, "tcp_stream": null, "udp_stream": 139, "fields": { "dns.flags.response": "False", "dns.qry.name": "fd.api.iris.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-dd4a22b971b604e6f246c42d", "kind": "dns", "frame_number": 15989, "timestamp_epoch": "1723681540.736897000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 55916, "tcp_stream": null, "udp_stream": 139, "fields": { "dns.a": "20.96.153.111", "dns.cname": "fd-api-iris.trafficmanager.net,iris-de-prod-azsc-v2-eus2.eastus2.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fd.api.iris.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-52fc624e3c15c7482f7d549c", "kind": "dns", "frame_number": 16265, "timestamp_epoch": "1723681669.530149000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53742, "dst_port": 53, "tcp_stream": null, "udp_stream": 142, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-23d10f9d30b46b2dc03692aa", "kind": "dns", "frame_number": 16266, "timestamp_epoch": "1723681669.591009000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53742, "dst_port": 53, "tcp_stream": null, "udp_stream": 142, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-e3f9033e3ae14d176f09b753", "kind": "dns", "frame_number": 16267, "timestamp_epoch": "1723681670.591287000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53742, "dst_port": 53, "tcp_stream": null, "udp_stream": 142, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-ce2039cf2b883380cabec10a", "kind": "dns", "frame_number": 16279, "timestamp_epoch": "1723681672.605396000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 53742, "dst_port": 53, "tcp_stream": null, "udp_stream": 142, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-441dc4cfc11110492dcc04a9", "kind": "dns", "frame_number": 16280, "timestamp_epoch": "1723681672.618317000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 53742, "tcp_stream": null, "udp_stream": 142, "fields": { "dns.a": "52.168.117.170", "dns.cname": "win-global-asimov-leafs-events-data.trafficmanager.net,onedscolprdeus13.eastus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-a0b4a1918ac6601c2f787106", "kind": "dns", "frame_number": 16700, "timestamp_epoch": "1723681860.124715000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 52477, "dst_port": 53, "tcp_stream": null, "udp_stream": 20, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-33f357797fc8a7abffb7f4df", "kind": "dns", "frame_number": 16701, "timestamp_epoch": "1723681860.125139000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 52477, "tcp_stream": null, "udp_stream": 20, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-c873fceed8f0aea377bf9877", "kind": "dns", "frame_number": 16702, "timestamp_epoch": "1723681860.168429000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 56835, "dst_port": 53, "tcp_stream": null, "udp_stream": 145, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-07b5f4f2e96616768c86d1f8", "kind": "dns", "frame_number": 16703, "timestamp_epoch": "1723681860.169001000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 56835, "tcp_stream": null, "udp_stream": 145, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-cc1d2dbfa5de3b0aa098a31a", "kind": "dns", "frame_number": 16779, "timestamp_epoch": "1723681906.267817000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 56835, "dst_port": 53, "tcp_stream": null, "udp_stream": 145, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-d934f49deeba0b231c531200", "kind": "dns", "frame_number": 16780, "timestamp_epoch": "1723681906.322454000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 56835, "dst_port": 53, "tcp_stream": null, "udp_stream": 145, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-426bb6f8dfb7b19337ba6e51", "kind": "dns", "frame_number": 16781, "timestamp_epoch": "1723681907.322449000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 56835, "dst_port": 53, "tcp_stream": null, "udp_stream": 145, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-2d05ee04fee0497888aea101", "kind": "dns", "frame_number": 16787, "timestamp_epoch": "1723681909.338147000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 56835, "dst_port": 53, "tcp_stream": null, "udp_stream": 145, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-c74d1caa953d1216d354ffad", "kind": "dns", "frame_number": 16792, "timestamp_epoch": "1723681909.536295000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 56835, "tcp_stream": null, "udp_stream": 145, "fields": { "dns.a": "20.189.173.9", "dns.cname": "win-global-asimov-leafs-events-data.trafficmanager.net,onedscolprdwus08.westus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-85a776319d2cea5a35d1abad", "kind": "dns", "frame_number": 17126, "timestamp_epoch": "1723682071.036990000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 65223, "dst_port": 53, "tcp_stream": null, "udp_stream": 148, "fields": { "dns.flags.response": "False", "dns.qry.name": "ecs.office.com", "dns.qry.type": "1" } }, { "event_id": "evt-28c35beeeb1b07c258c11726", "kind": "dns", "frame_number": 17127, "timestamp_epoch": "1723682071.094483000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 65223, "dst_port": 53, "tcp_stream": null, "udp_stream": 148, "fields": { "dns.flags.response": "False", "dns.qry.name": "ecs.office.com", "dns.qry.type": "1" } }, { "event_id": "evt-837323ffa8ee546f515275b7", "kind": "dns", "frame_number": 17128, "timestamp_epoch": "1723682071.184741000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 65223, "tcp_stream": null, "udp_stream": 148, "fields": { "dns.a": "52.113.194.132", "dns.cname": "ecs.office.trafficmanager.net,s-0005-office.config.skype.com,ecs-office.s-0005.s-msedge.net,s-0005.s-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ecs.office.com", "dns.qry.type": "1" } }, { "event_id": "evt-d9a0d6e0c7a712bc181f82d4", "kind": "dns", "frame_number": 17805, "timestamp_epoch": "1723682392.071763000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 52348, "dst_port": 53, "tcp_stream": null, "udp_stream": 151, "fields": { "dns.flags.response": "False", "dns.qry.name": "mobile.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-27a71dd4839a4c7ed355e4af", "kind": "dns", "frame_number": 17806, "timestamp_epoch": "1723682392.121072000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 52348, "tcp_stream": null, "udp_stream": 151, "fields": { "dns.a": "13.70.79.200", "dns.cname": "mobile.events.data.trafficmanager.net,onedscolprdaue01.australiaeast.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "mobile.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-cce65679516def2b18505d84", "kind": "dns", "frame_number": 18010, "timestamp_epoch": "1723682460.198082000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 52348, "dst_port": 53, "tcp_stream": null, "udp_stream": 151, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-630b123b2fae6abf6727b0f1", "kind": "dns", "frame_number": 18011, "timestamp_epoch": "1723682460.198419000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 52348, "tcp_stream": null, "udp_stream": 151, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-5f458e77167745f6e6a426de", "kind": "dns", "frame_number": 18012, "timestamp_epoch": "1723682460.256229000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 52477, "dst_port": 53, "tcp_stream": null, "udp_stream": 20, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } }, { "event_id": "evt-badb9d468b0c0a424e68b99f", "kind": "dns", "frame_number": 18013, "timestamp_epoch": "1723682460.256763000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 53, "dst_port": 52477, "tcp_stream": null, "udp_stream": 20, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.lafontainebleu.org", "dns.qry.type": "1" } } ], "http_request": [ { "event_id": "evt-4321b32f7c911446a05ebd60", "kind": "http_request", "frame_number": 66, "timestamp_epoch": "1723680585.124763000", "src_ip": "10.8.15.133", "dst_ip": "23.205.110.48", "src_port": 49671, "dst_port": 80, "tcp_stream": 2, "udp_stream": null, "fields": { "http.host": "www.msftconnecttest.com", "http.request.full_uri": "http://www.msftconnecttest.com/connecttest.txt", "http.request.method": "GET", "http.request.uri": "/connecttest.txt", "http.response_in": "68", "http.user_agent": "Microsoft NCSI" } }, { "event_id": "evt-50d3328e34c3739b59b1c4de", "kind": "http_request", "frame_number": 2104, "timestamp_epoch": "1723680618.769208000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-df739763efac62c54dd25a3b", "kind": "http_request", "frame_number": 2328, "timestamp_epoch": "1723680619.776640000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-4736e7e30f635b100d040243", "kind": "http_request", "frame_number": 2700, "timestamp_epoch": "1723680620.776682000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-a89d37fad67ee2b07f525317", "kind": "http_request", "frame_number": 2972, "timestamp_epoch": "1723680621.781943000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-b4e119d1313d393f3e074f62", "kind": "http_request", "frame_number": 6418, "timestamp_epoch": "1723680658.536866000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "http.host": "quote.checkfedexexp.com", "http.request.full_uri": "http://quote.checkfedexexp.com/managements?16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215", "http.request.method": "GET", "http.request.uri": "/managements?16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215", "http.response_in": "8659", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0" } }, { "event_id": "evt-459116cfdb89f7aaf6e66f0d", "kind": "http_request", "frame_number": 8977, "timestamp_epoch": "1723680681.507171000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-7cf7f1fa8fb452306147a4af", "kind": "http_request", "frame_number": 8978, "timestamp_epoch": "1723680681.510601000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-5f51ef12a740590590928b3b", "kind": "http_request", "frame_number": 8982, "timestamp_epoch": "1723680681.717085000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-4d9f0811d4ccc0e5d57321d0", "kind": "http_request", "frame_number": 9041, "timestamp_epoch": "1723680684.514513000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-c521b582ff532a4d96fea711", "kind": "http_request", "frame_number": 9042, "timestamp_epoch": "1723680684.514901000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-65d78c6c1ae4061348600996", "kind": "http_request", "frame_number": 9178, "timestamp_epoch": "1723680684.717004000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-cbb63b6cee54fc23acc2ddbb", "kind": "http_request", "frame_number": 10198, "timestamp_epoch": "1723680685.801254000", "src_ip": "10.8.15.133", "dst_ip": "199.232.210.172", "src_port": 49803, "dst_port": 80, "tcp_stream": 127, "udp_stream": null, "fields": { "http.host": "msedge.b.tlu.dl.delivery.mp.microsoft.com", "http.request.full_uri": "http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8f2381c2-652d-48a2-86f6-19cb7757f5dc?P1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d", "http.request.method": "HEAD", "http.request.uri": "/filestreamingservice/files/8f2381c2-652d-48a2-86f6-19cb7757f5dc?P1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d", "http.response_in": "10200", "http.user_agent": "Microsoft BITS/7.8" } }, { "event_id": "evt-e1aa33b143c35bbac0bf892c", "kind": "http_request", "frame_number": 10201, "timestamp_epoch": "1723680685.861043000", "src_ip": "10.8.15.133", "dst_ip": "199.232.210.172", "src_port": 49803, "dst_port": 80, "tcp_stream": 127, "udp_stream": null, "fields": { "http.host": "msedge.b.tlu.dl.delivery.mp.microsoft.com", "http.request.full_uri": "http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8f2381c2-652d-48a2-86f6-19cb7757f5dc?P1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d", "http.request.method": "GET", "http.request.uri": "/filestreamingservice/files/8f2381c2-652d-48a2-86f6-19cb7757f5dc?P1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d", "http.response_in": "10204", "http.user_agent": "Microsoft BITS/7.8" } }, { "event_id": "evt-d5460bd905487cc00d6f1503", "kind": "http_request", "frame_number": 10207, "timestamp_epoch": "1723680687.529821000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-81bc1161df87053c2b82b8e4", "kind": "http_request", "frame_number": 10208, "timestamp_epoch": "1723680687.530376000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-c24121b2a69c1a68f0fecbf7", "kind": "http_request", "frame_number": 10209, "timestamp_epoch": "1723680687.970979000", "src_ip": "10.8.15.133", "dst_ip": "199.232.210.172", "src_port": 49803, "dst_port": 80, "tcp_stream": 127, "udp_stream": null, "fields": { "http.host": "msedge.b.tlu.dl.delivery.mp.microsoft.com", "http.request.full_uri": "http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8f2381c2-652d-48a2-86f6-19cb7757f5dc?P1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d", "http.request.method": "GET", "http.request.uri": "/filestreamingservice/files/8f2381c2-652d-48a2-86f6-19cb7757f5dc?P1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d", "http.response_in": "10212", "http.user_agent": "Microsoft BITS/7.8" } }, { "event_id": "evt-e21245d8002bd00ba7bea751", "kind": "http_request", "frame_number": 10214, "timestamp_epoch": "1723680689.189501000", "src_ip": "10.8.15.133", "dst_ip": "199.232.210.172", "src_port": 49803, "dst_port": 80, "tcp_stream": 127, "udp_stream": null, "fields": { "http.host": "msedge.b.tlu.dl.delivery.mp.microsoft.com", "http.request.full_uri": "http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8f2381c2-652d-48a2-86f6-19cb7757f5dc?P1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d", "http.request.method": "GET", "http.request.uri": "/filestreamingservice/files/8f2381c2-652d-48a2-86f6-19cb7757f5dc?P1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d", "http.response_in": "10219", "http.user_agent": "Microsoft BITS/7.8" } }, { "event_id": "evt-3dccfe0f3953dcfd330b5e31", "kind": "http_request", "frame_number": 10222, "timestamp_epoch": "1723680690.407477000", "src_ip": "10.8.15.133", "dst_ip": "199.232.210.172", "src_port": 49803, "dst_port": 80, "tcp_stream": 127, "udp_stream": null, "fields": { "http.host": "msedge.b.tlu.dl.delivery.mp.microsoft.com", "http.request.full_uri": "http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8f2381c2-652d-48a2-86f6-19cb7757f5dc?P1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d", "http.request.method": "GET", "http.request.uri": "/filestreamingservice/files/8f2381c2-652d-48a2-86f6-19cb7757f5dc?P1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d", "http.response_in": "10232", "http.user_agent": "Microsoft BITS/7.8" } }, { "event_id": "evt-b6a0fcf7893a4d4daa4c02ff", "kind": "http_request", "frame_number": 10278, "timestamp_epoch": "1723680706.416178000", "src_ip": "10.8.15.133", "dst_ip": "199.232.210.172", "src_port": 49803, "dst_port": 80, "tcp_stream": 127, "udp_stream": null, "fields": { "http.host": "msedge.b.tlu.dl.delivery.mp.microsoft.com", "http.request.full_uri": "http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6?P1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d", "http.request.method": "HEAD", "http.request.uri": "/filestreamingservice/files/f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6?P1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d", "http.response_in": "10280", "http.user_agent": "Microsoft BITS/7.8" } }, { "event_id": "evt-6c1fde97b08bec4ac4073721", "kind": "http_request", "frame_number": 10284, "timestamp_epoch": "1723680706.545976000", "src_ip": "10.8.15.133", "dst_ip": "199.232.210.172", "src_port": 49803, "dst_port": 80, "tcp_stream": 127, "udp_stream": null, "fields": { "http.host": "msedge.b.tlu.dl.delivery.mp.microsoft.com", "http.request.full_uri": "http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6?P1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d", "http.request.method": "GET", "http.request.uri": "/filestreamingservice/files/f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6?P1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d", "http.response_in": "10306", "http.user_agent": "Microsoft BITS/7.8" } }, { "event_id": "evt-d08d8274ea2ddc24d47f3b57", "kind": "http_request", "frame_number": 10407, "timestamp_epoch": "1723680708.884758000", "src_ip": "10.8.15.133", "dst_ip": "199.232.210.172", "src_port": 49803, "dst_port": 80, "tcp_stream": 127, "udp_stream": null, "fields": { "http.host": "msedge.b.tlu.dl.delivery.mp.microsoft.com", "http.request.full_uri": "http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6?P1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d", "http.request.method": "GET", "http.request.uri": "/filestreamingservice/files/f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6?P1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d", "http.response_in": "10425", "http.user_agent": "Microsoft BITS/7.8" } }, { "event_id": "evt-0a96a2c16d71cbb98739a781", "kind": "http_request", "frame_number": 10454, "timestamp_epoch": "1723680709.993124000", "src_ip": "10.8.15.133", "dst_ip": "199.232.210.172", "src_port": 49803, "dst_port": 80, "tcp_stream": 127, "udp_stream": null, "fields": { "http.host": "msedge.b.tlu.dl.delivery.mp.microsoft.com", "http.request.full_uri": "http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6?P1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d", "http.request.method": "GET", "http.request.uri": "/filestreamingservice/files/f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6?P1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d", "http.response_in": "10478", "http.user_agent": "Microsoft BITS/7.8" } }, { "event_id": "evt-04978462ccea1f8eaad68089", "kind": "http_request", "frame_number": 10483, "timestamp_epoch": "1723680711.070632000", "src_ip": "10.8.15.133", "dst_ip": "199.232.210.172", "src_port": 49803, "dst_port": 80, "tcp_stream": 127, "udp_stream": null, "fields": { "http.host": "msedge.b.tlu.dl.delivery.mp.microsoft.com", "http.request.full_uri": "http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6?P1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d", "http.request.method": "GET", "http.request.uri": "/filestreamingservice/files/f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6?P1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d", "http.response_in": "10579", "http.user_agent": "Microsoft BITS/7.8" } }, { "event_id": "evt-5d2b935f102e7bc45fad5e2c", "kind": "http_request", "frame_number": 10611, "timestamp_epoch": "1723680719.744428000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49810, "dst_port": 80, "tcp_stream": 134, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/data/0f60a3e7baecf2748b1c8183ed37d1e4", "http.request.method": "HEAD", "http.request.uri": "/data/0f60a3e7baecf2748b1c8183ed37d1e4", "http.response_in": "10613", "http.user_agent": "Microsoft BITS/7.8" } }, { "event_id": "evt-c6c822fc129fec15577d6932", "kind": "http_request", "frame_number": 10614, "timestamp_epoch": "1723680719.960393000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49810, "dst_port": 80, "tcp_stream": 134, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/data/0f60a3e7baecf2748b1c8183ed37d1e4", "http.request.method": "GET", "http.request.uri": "/data/0f60a3e7baecf2748b1c8183ed37d1e4", "http.response_in": "10762", "http.user_agent": "Microsoft BITS/7.8" } }, { "event_id": "evt-3c6819fbd88c410ca308711b", "kind": "http_request", "frame_number": 10886, "timestamp_epoch": "1723680738.774571000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-79ba86f8531a00d8d7cd02cd", "kind": "http_request", "frame_number": 10889, "timestamp_epoch": "1723680739.785805000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-30fdca3e611578358ef0865a", "kind": "http_request", "frame_number": 10890, "timestamp_epoch": "1723680740.801288000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-08d59fcaf3f45d8acfda556b", "kind": "http_request", "frame_number": 10893, "timestamp_epoch": "1723680741.801367000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-96b8ba71c1686f8deb68e152", "kind": "http_request", "frame_number": 11028, "timestamp_epoch": "1723680780.664378000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49818, "dst_port": 80, "tcp_stream": 142, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "11030", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-ab0d505b4a04c20922789804", "kind": "http_request", "frame_number": 11032, "timestamp_epoch": "1723680780.868295000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49818, "dst_port": 80, "tcp_stream": 142, "udp_stream": null, "fields": { "http.content_length": "124", "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "POST", "http.request.uri": "/", "http.response_in": "11034", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-f1a5f8138ec9efafc276d00c", "kind": "http_request", "frame_number": 11463, "timestamp_epoch": "1723680782.262324000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49819, "dst_port": 80, "tcp_stream": 143, "udp_stream": null, "fields": { "http.content_length": "305148", "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "POST", "http.request.uri": "/", "http.response_in": "11485", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-febb982caae127af7dc9eb52", "kind": "http_request", "frame_number": 11496, "timestamp_epoch": "1723680782.865019000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49820, "dst_port": 80, "tcp_stream": 144, "udp_stream": null, "fields": { "http.content_length": "732", "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "POST", "http.request.uri": "/", "http.response_in": "11498", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-3c28ab8fcd821e7ac1680a14", "kind": "http_request", "frame_number": 11505, "timestamp_epoch": "1723680787.999666000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49821, "dst_port": 80, "tcp_stream": 145, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "11507", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-55972fdf9597062da0682241", "kind": "http_request", "frame_number": 11619, "timestamp_epoch": "1723680793.850601000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49827, "dst_port": 80, "tcp_stream": 151, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "11621", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-57e92d22957895a19e71b1d8", "kind": "http_request", "frame_number": 11688, "timestamp_epoch": "1723680797.315577000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49831, "dst_port": 80, "tcp_stream": 155, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "11692", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-4f7e52d28a0fa468286902fa", "kind": "http_request", "frame_number": 11962, "timestamp_epoch": "1723680804.254102000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49840, "dst_port": 80, "tcp_stream": 164, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "11964", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-ca7269cef9e9a0d4137925e6", "kind": "http_request", "frame_number": 11974, "timestamp_epoch": "1723680809.944683000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49841, "dst_port": 80, "tcp_stream": 165, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "11976", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-8b3843e7c6bd27342ff4a33f", "kind": "http_request", "frame_number": 11993, "timestamp_epoch": "1723680817.194861000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49842, "dst_port": 80, "tcp_stream": 166, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "11995", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-73486ac20ddb19b8e943e18c", "kind": "http_request", "frame_number": 12004, "timestamp_epoch": "1723680823.591854000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49843, "dst_port": 80, "tcp_stream": 167, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "12009", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-5cee541bd0719c569cbf91e0", "kind": "http_request", "frame_number": 12017, "timestamp_epoch": "1723680829.193045000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49844, "dst_port": 80, "tcp_stream": 168, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "12023", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-7ab3cb988573c56646929640", "kind": "http_request", "frame_number": 12032, "timestamp_epoch": "1723680835.214191000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49845, "dst_port": 80, "tcp_stream": 169, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "12034", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-552ca02371a3fe569831235f", "kind": "http_request", "frame_number": 12045, "timestamp_epoch": "1723680839.081492000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49846, "dst_port": 80, "tcp_stream": 170, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "12047", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-9c1943045d16799a0d5dd1ce", "kind": "http_request", "frame_number": 12060, "timestamp_epoch": "1723680843.782430000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49847, "dst_port": 80, "tcp_stream": 171, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "12062", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-9627016816cc0f9a6cc1f80e", "kind": "http_request", "frame_number": 12072, "timestamp_epoch": "1723680847.998603000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49848, "dst_port": 80, "tcp_stream": 172, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "12074", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-e5851d4b8f078fb8e184ee29", "kind": "http_request", "frame_number": 12087, "timestamp_epoch": "1723680852.361708000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49849, "dst_port": 80, "tcp_stream": 173, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "12089", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-ca28831f8728db645048ee06", "kind": "http_request", "frame_number": 12096, "timestamp_epoch": "1723680857.007048000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49850, "dst_port": 80, "tcp_stream": 174, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "12098", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-639a4375a1147ed1f48ca4ca", "kind": "http_request", "frame_number": 12132, "timestamp_epoch": "1723680858.790096000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-c75863992fc6fb940af60f30", "kind": "http_request", "frame_number": 12133, "timestamp_epoch": "1723680859.802600000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-7889435d8a5f2af0ccb1710f", "kind": "http_request", "frame_number": 12134, "timestamp_epoch": "1723680860.818073000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-218205cef96d55fc21862411", "kind": "http_request", "frame_number": 12137, "timestamp_epoch": "1723680861.818104000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-4784d1c7781fae29d08288b5", "kind": "http_request", "frame_number": 12141, "timestamp_epoch": "1723680862.196492000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49852, "dst_port": 80, "tcp_stream": 176, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "12147", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-a4f4a2ae8a5242317074eec0", "kind": "http_request", "frame_number": 12154, "timestamp_epoch": "1723680868.478805000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49853, "dst_port": 80, "tcp_stream": 177, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "12156", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-8ff122622c82a63e098e10f5", "kind": "http_request", "frame_number": 12164, "timestamp_epoch": "1723680872.853090000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49854, "dst_port": 80, "tcp_stream": 178, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "12166", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-7703928a426b9bfb56eb86f4", "kind": "http_request", "frame_number": 12175, "timestamp_epoch": "1723680878.604245000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49855, "dst_port": 80, "tcp_stream": 179, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "12177", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-42826ab5d9641d60a29a7ccd", "kind": "http_request", "frame_number": 12186, "timestamp_epoch": "1723680886.067560000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49856, "dst_port": 80, "tcp_stream": 180, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "12188", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-d1bf609de688356734ad33e8", "kind": "http_request", "frame_number": 12200, "timestamp_epoch": "1723680893.807805000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49857, "dst_port": 80, "tcp_stream": 181, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "12202", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-3122df7df41468e057902a42", "kind": "http_request", "frame_number": 12242, "timestamp_epoch": "1723680900.014338000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49859, "dst_port": 80, "tcp_stream": 183, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "12244", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-b013449d109b7b57311c0dac", "kind": "http_request", "frame_number": 12253, "timestamp_epoch": "1723680907.248656000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49860, "dst_port": 80, "tcp_stream": 184, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "12255", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-8f99bd38beb0219ff9f775c0", "kind": "http_request", "frame_number": 13263, "timestamp_epoch": "1723680913.542763000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49882, "dst_port": 80, "tcp_stream": 206, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "13433", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-fa2b1ac940ff96d68a78829c", "kind": "http_request", "frame_number": 13589, "timestamp_epoch": "1723680917.980065000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49883, "dst_port": 80, "tcp_stream": 207, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "13591", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-b92a3fec9336fd77821a3de9", "kind": "http_request", "frame_number": 13609, "timestamp_epoch": "1723680923.254494000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49884, "dst_port": 80, "tcp_stream": 208, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "13626", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-1b52c05fc17a19bae4a87daa", "kind": "http_request", "frame_number": 13635, "timestamp_epoch": "1723680975.818959000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49885, "dst_port": 80, "tcp_stream": 209, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "13637", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-d11f90e766cd72a57038679c", "kind": "http_request", "frame_number": 13641, "timestamp_epoch": "1723680978.797257000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-e86e818e6cf65c3aaa1716ec", "kind": "http_request", "frame_number": 13644, "timestamp_epoch": "1723680979.808885000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-72057f56a6d8f9a9ae515b29", "kind": "http_request", "frame_number": 13645, "timestamp_epoch": "1723680980.809112000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-62f73b168dbd380247d98198", "kind": "http_request", "frame_number": 13647, "timestamp_epoch": "1723680981.824794000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-f3d595b98385cf1af0b514b8", "kind": "http_request", "frame_number": 13655, "timestamp_epoch": "1723680982.660112000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49886, "dst_port": 80, "tcp_stream": 210, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "13657", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-0f14ec4fa56595af12144408", "kind": "http_request", "frame_number": 13739, "timestamp_epoch": "1723680986.523941000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49891, "dst_port": 80, "tcp_stream": 215, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "13741", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-a55575b34cd614faaa06d246", "kind": "http_request", "frame_number": 13911, "timestamp_epoch": "1723680990.391966000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49898, "dst_port": 80, "tcp_stream": 222, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14052", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-9a1ec70fc7fccca2dc8a2ad8", "kind": "http_request", "frame_number": 14070, "timestamp_epoch": "1723680994.843801000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49901, "dst_port": 80, "tcp_stream": 225, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14072", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-d7d061338805ec7343cec1da", "kind": "http_request", "frame_number": 14091, "timestamp_epoch": "1723681000.674471000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49902, "dst_port": 80, "tcp_stream": 226, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14093", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-1396f746241f8417c9756039", "kind": "http_request", "frame_number": 14138, "timestamp_epoch": "1723681006.223359000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49904, "dst_port": 80, "tcp_stream": 228, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14140", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-a05db9b3c27bbb860877eb26", "kind": "http_request", "frame_number": 14178, "timestamp_epoch": "1723681013.189457000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49906, "dst_port": 80, "tcp_stream": 230, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14180", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-4dc76e9396d90bdf6d98029f", "kind": "http_request", "frame_number": 14189, "timestamp_epoch": "1723681018.917530000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49907, "dst_port": 80, "tcp_stream": 231, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14191", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-42a93e106bbce4b60534d4f4", "kind": "http_request", "frame_number": 14201, "timestamp_epoch": "1723681026.263547000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49908, "dst_port": 80, "tcp_stream": 232, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14203", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-b2c9dfaefcdf88bc0fbcdb77", "kind": "http_request", "frame_number": 14210, "timestamp_epoch": "1723681032.790381000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49909, "dst_port": 80, "tcp_stream": 233, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14212", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-d77ba9202a0088d8bed26ce2", "kind": "http_request", "frame_number": 14221, "timestamp_epoch": "1723681037.630532000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49910, "dst_port": 80, "tcp_stream": 234, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14228", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-8312a658d79b2da91c3f46c4", "kind": "http_request", "frame_number": 14254, "timestamp_epoch": "1723681043.230910000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49912, "dst_port": 80, "tcp_stream": 236, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14256", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-7d0ca96158b0356abb0bf67d", "kind": "http_request", "frame_number": 14263, "timestamp_epoch": "1723681050.323085000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49913, "dst_port": 80, "tcp_stream": 237, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14265", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-5cff30fbedf2b458843659cd", "kind": "http_request", "frame_number": 14272, "timestamp_epoch": "1723681056.322087000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49914, "dst_port": 80, "tcp_stream": 238, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14274", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-e22f0024c810e12b94da7a78", "kind": "http_request", "frame_number": 14281, "timestamp_epoch": "1723681060.099936000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49915, "dst_port": 80, "tcp_stream": 239, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14283", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-8d0c899ca9b30e6cd749a367", "kind": "http_request", "frame_number": 14290, "timestamp_epoch": "1723681063.593064000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49916, "dst_port": 80, "tcp_stream": 240, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14292", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-6d6b85fd4923dad4652f832b", "kind": "http_request", "frame_number": 14301, "timestamp_epoch": "1723681070.563338000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49917, "dst_port": 80, "tcp_stream": 241, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14303", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-1597eebfd6e7a4cf954c79d7", "kind": "http_request", "frame_number": 14312, "timestamp_epoch": "1723681076.331728000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49918, "dst_port": 80, "tcp_stream": 242, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14314", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-8a76e3061674b598ee3f2d93", "kind": "http_request", "frame_number": 14324, "timestamp_epoch": "1723681083.743242000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49919, "dst_port": 80, "tcp_stream": 243, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14326", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-24467e7d3b56bbc4c73d4234", "kind": "http_request", "frame_number": 14335, "timestamp_epoch": "1723681090.400183000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49920, "dst_port": 80, "tcp_stream": 244, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14337", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-1eae9adc9ca7bf958d9fdf6a", "kind": "http_request", "frame_number": 14344, "timestamp_epoch": "1723681095.477626000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49921, "dst_port": 80, "tcp_stream": 245, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14346", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-f86e3a9dab6912e546c14ba2", "kind": "http_request", "frame_number": 14352, "timestamp_epoch": "1723681098.811138000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-e94c07d81201db42fd33a54f", "kind": "http_request", "frame_number": 14353, "timestamp_epoch": "1723681099.821200000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-45016c45537152180ea6424c", "kind": "http_request", "frame_number": 14354, "timestamp_epoch": "1723681100.836638000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-f2d5bbded29532e016e123ff", "kind": "http_request", "frame_number": 14358, "timestamp_epoch": "1723681101.539859000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49922, "dst_port": 80, "tcp_stream": 246, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14360", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-4782495357c0ba1b74157133", "kind": "http_request", "frame_number": 14365, "timestamp_epoch": "1723681101.836854000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-1ab6de2dd35a4540cc77b72f", "kind": "http_request", "frame_number": 14373, "timestamp_epoch": "1723681105.503006000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49923, "dst_port": 80, "tcp_stream": 247, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14375", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-bd53ce05823d6d9e08e0ef1d", "kind": "http_request", "frame_number": 14383, "timestamp_epoch": "1723681109.332869000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49924, "dst_port": 80, "tcp_stream": 248, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14385", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-5507149d060d2174a63ff7b6", "kind": "http_request", "frame_number": 14394, "timestamp_epoch": "1723681112.883107000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49925, "dst_port": 80, "tcp_stream": 249, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14396", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-3665fba4d4d784852d8bb3cc", "kind": "http_request", "frame_number": 14406, "timestamp_epoch": "1723681119.999894000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49926, "dst_port": 80, "tcp_stream": 250, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14408", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-991a080bb2ad31bc4544d5da", "kind": "http_request", "frame_number": 14415, "timestamp_epoch": "1723681126.022041000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49927, "dst_port": 80, "tcp_stream": 251, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14417", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-57749a96fd728a189a9770c6", "kind": "http_request", "frame_number": 14424, "timestamp_epoch": "1723681129.862278000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49928, "dst_port": 80, "tcp_stream": 252, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14426", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-7cbc06b235e8bf76d336996f", "kind": "http_request", "frame_number": 14437, "timestamp_epoch": "1723681133.454087000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49929, "dst_port": 80, "tcp_stream": 253, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14439", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-ec8f600d38120a07bfb88c63", "kind": "http_request", "frame_number": 14450, "timestamp_epoch": "1723681140.654390000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49930, "dst_port": 80, "tcp_stream": 254, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14452", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-1c017f2dc9421dc63d81cd1c", "kind": "http_request", "frame_number": 14459, "timestamp_epoch": "1723681146.895398000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49931, "dst_port": 80, "tcp_stream": 255, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14461", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-4f3e488e8a97788f67148b2f", "kind": "http_request", "frame_number": 14466, "timestamp_epoch": "1723681150.148282000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-a2ae8a89ec23b8f68390393f", "kind": "http_request", "frame_number": 14470, "timestamp_epoch": "1723681151.153685000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49934, "dst_port": 80, "tcp_stream": 256, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14472", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-b2bec49fcea206a28ead5ecf", "kind": "http_request", "frame_number": 14476, "timestamp_epoch": "1723681153.134323000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-5ba64f201ed1c67c3ec9201f", "kind": "http_request", "frame_number": 14647, "timestamp_epoch": "1723681155.562098000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49940, "dst_port": 80, "tcp_stream": 261, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14662", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-19fd8a5ec8074740627a047d", "kind": "http_request", "frame_number": 14669, "timestamp_epoch": "1723681156.149768000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-871850df694f4dda9aa3a9b1", "kind": "http_request", "frame_number": 14675, "timestamp_epoch": "1723681160.282703000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49942, "dst_port": 80, "tcp_stream": 263, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14677", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-739c25dc6c9ea43b3bcbfcfa", "kind": "http_request", "frame_number": 14698, "timestamp_epoch": "1723681165.914795000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49943, "dst_port": 80, "tcp_stream": 264, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14700", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-60160a48c1668fd0865a0bbd", "kind": "http_request", "frame_number": 14707, "timestamp_epoch": "1723681172.798210000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49944, "dst_port": 80, "tcp_stream": 265, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14709", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-2e8f4da3f4af7f4b6790bfca", "kind": "http_request", "frame_number": 14719, "timestamp_epoch": "1723681179.882767000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49945, "dst_port": 80, "tcp_stream": 266, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14721", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-8cadd2bfb612663747a22ec9", "kind": "http_request", "frame_number": 14736, "timestamp_epoch": "1723681184.875518000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49946, "dst_port": 80, "tcp_stream": 267, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14738", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-ebd3784f5b0fb51f80e70560", "kind": "http_request", "frame_number": 14760, "timestamp_epoch": "1723681190.222347000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49947, "dst_port": 80, "tcp_stream": 268, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14762", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-81872cae755558fccfc0eb3e", "kind": "http_request", "frame_number": 14792, "timestamp_epoch": "1723681196.830819000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49949, "dst_port": 80, "tcp_stream": 270, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14794", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-19d96a4b2a70ce51994c9723", "kind": "http_request", "frame_number": 14806, "timestamp_epoch": "1723681201.842354000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49950, "dst_port": 80, "tcp_stream": 271, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14808", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-f1ac9f0a47bb95f978d8748a", "kind": "http_request", "frame_number": 14921, "timestamp_epoch": "1723681209.572065000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49951, "dst_port": 80, "tcp_stream": 272, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14923", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-ee4a88195b1259fe44cab4d2", "kind": "http_request", "frame_number": 14962, "timestamp_epoch": "1723681215.076361000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49953, "dst_port": 80, "tcp_stream": 274, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14964", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-78225e16d2f4a2b413d19b48", "kind": "http_request", "frame_number": 14972, "timestamp_epoch": "1723681218.812495000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-578dd4b52a345a9c336ad23b", "kind": "http_request", "frame_number": 14973, "timestamp_epoch": "1723681219.823057000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-23a0e07eaf5adfe6f328d04b", "kind": "http_request", "frame_number": 14974, "timestamp_epoch": "1723681220.838633000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-6911d2d36615267b9731ed34", "kind": "http_request", "frame_number": 14976, "timestamp_epoch": "1723681221.854128000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-14bb39ccd44d1152c535953d", "kind": "http_request", "frame_number": 14979, "timestamp_epoch": "1723681221.962481000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49954, "dst_port": 80, "tcp_stream": 275, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14981", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-be4ad3ca906132617bfccbc3", "kind": "http_request", "frame_number": 14989, "timestamp_epoch": "1723681227.561961000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49955, "dst_port": 80, "tcp_stream": 276, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "14991", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-160fbf76b357ab2bf603063e", "kind": "http_request", "frame_number": 14999, "timestamp_epoch": "1723681234.695176000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49956, "dst_port": 80, "tcp_stream": 277, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15001", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-db5ee58115ec6b7300e7eacf", "kind": "http_request", "frame_number": 15010, "timestamp_epoch": "1723681240.762230000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49957, "dst_port": 80, "tcp_stream": 278, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15012", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-24aaf52582ccd41a1186d008", "kind": "http_request", "frame_number": 15021, "timestamp_epoch": "1723681244.681707000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49958, "dst_port": 80, "tcp_stream": 279, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15023", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-60b627b64f33b64d47119783", "kind": "http_request", "frame_number": 15037, "timestamp_epoch": "1723681250.455053000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49959, "dst_port": 80, "tcp_stream": 280, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15039", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-d967f832f0ebc6fa21be9440", "kind": "http_request", "frame_number": 15047, "timestamp_epoch": "1723681255.848643000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49960, "dst_port": 80, "tcp_stream": 281, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15049", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-0a5e829f3c882eff8781c2dd", "kind": "http_request", "frame_number": 15060, "timestamp_epoch": "1723681262.791423000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49961, "dst_port": 80, "tcp_stream": 282, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15062", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-89c5519387c3aac8e482fec9", "kind": "http_request", "frame_number": 15078, "timestamp_epoch": "1723681269.649464000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49962, "dst_port": 80, "tcp_stream": 283, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15080", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-4c7f24759fdd6693857c202d", "kind": "http_request", "frame_number": 15089, "timestamp_epoch": "1723681273.870863000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49963, "dst_port": 80, "tcp_stream": 284, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15091", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-e1d67c373eb6a4692a1c5dab", "kind": "http_request", "frame_number": 15098, "timestamp_epoch": "1723681278.112448000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49964, "dst_port": 80, "tcp_stream": 285, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15100", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-0727a9282b6b2cb8c49cf8f9", "kind": "http_request", "frame_number": 15122, "timestamp_epoch": "1723681282.733454000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49965, "dst_port": 80, "tcp_stream": 286, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15140", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-f04adf1c2f15388d6cbff089", "kind": "http_request", "frame_number": 15170, "timestamp_epoch": "1723681287.618414000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49967, "dst_port": 80, "tcp_stream": 288, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15172", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-6f88f29e3cac3a962dc6afda", "kind": "http_request", "frame_number": 15206, "timestamp_epoch": "1723681294.874856000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49969, "dst_port": 80, "tcp_stream": 290, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15208", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-41b4a2fc98f3db215d654114", "kind": "http_request", "frame_number": 15212, "timestamp_epoch": "1723681296.026586000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-c73956bcdfd627436f479bfa", "kind": "http_request", "frame_number": 15213, "timestamp_epoch": "1723681299.027221000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-34f4ca16b6c0f37606ed966f", "kind": "http_request", "frame_number": 15217, "timestamp_epoch": "1723681299.634243000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49973, "dst_port": 80, "tcp_stream": 291, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15219", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-0953f2bc5e50d676a0c6326b", "kind": "http_request", "frame_number": 15244, "timestamp_epoch": "1723681302.037079000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*" } }, { "event_id": "evt-bd63c1d5c7944d93a9f053db", "kind": "http_request", "frame_number": 15250, "timestamp_epoch": "1723681305.055347000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49976, "dst_port": 80, "tcp_stream": 294, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15252", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-949762089ab1a34ffd61040d", "kind": "http_request", "frame_number": 15260, "timestamp_epoch": "1723681311.776154000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49977, "dst_port": 80, "tcp_stream": 295, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15262", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-2d2e03ac1613fdd4a1f23e4d", "kind": "http_request", "frame_number": 15311, "timestamp_epoch": "1723681318.536068000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49979, "dst_port": 80, "tcp_stream": 297, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15313", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-7158409e38b3339536089435", "kind": "http_request", "frame_number": 15320, "timestamp_epoch": "1723681322.887261000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49980, "dst_port": 80, "tcp_stream": 298, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15322", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-44c1bcae015ec73f5bd84770", "kind": "http_request", "frame_number": 15332, "timestamp_epoch": "1723681328.595654000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49981, "dst_port": 80, "tcp_stream": 299, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15334", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-720a6532067506494d375035", "kind": "http_request", "frame_number": 15345, "timestamp_epoch": "1723681329.890743000", "src_ip": "10.8.15.133", "dst_ip": "23.220.251.208", "src_port": 49982, "dst_port": 80, "tcp_stream": 300, "udp_stream": null, "fields": { "http.host": "acroipm2.adobe.com", "http.request.full_uri": "http://acroipm2.adobe.com/assets/Owner/arm/ProcessMAU.txt", "http.request.method": "GET", "http.request.uri": "/assets/Owner/arm/ProcessMAU.txt", "http.response_in": "15347", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E)" } }, { "event_id": "evt-63960d08ad2312c54f97ca3b", "kind": "http_request", "frame_number": 15375, "timestamp_epoch": "1723681334.274261000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49984, "dst_port": 80, "tcp_stream": 302, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15377", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-8c5f20866151339ddbe19408", "kind": "http_request", "frame_number": 15383, "timestamp_epoch": "1723681338.859354000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-73cff041bb28690d39c268a7", "kind": "http_request", "frame_number": 15386, "timestamp_epoch": "1723681339.864082000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-d5c7c4624476548ffbc14bd2", "kind": "http_request", "frame_number": 15387, "timestamp_epoch": "1723681340.879765000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-3ef0648266d125b8396abc69", "kind": "http_request", "frame_number": 15391, "timestamp_epoch": "1723681341.576410000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49985, "dst_port": 80, "tcp_stream": 303, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15393", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-fa77b5381267fbebf4673c23", "kind": "http_request", "frame_number": 15397, "timestamp_epoch": "1723681341.895357000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-67fd8bda0c2d903f3221bde9", "kind": "http_request", "frame_number": 15405, "timestamp_epoch": "1723681347.954525000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49986, "dst_port": 80, "tcp_stream": 304, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15407", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-5be40ffa4519965bde658681", "kind": "http_request", "frame_number": 15414, "timestamp_epoch": "1723681352.496784000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49987, "dst_port": 80, "tcp_stream": 305, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15416", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-8e9645df9656043f3252f676", "kind": "http_request", "frame_number": 15423, "timestamp_epoch": "1723681357.516311000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49988, "dst_port": 80, "tcp_stream": 306, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15425", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-efec14ef3b1702e1adb71440", "kind": "http_request", "frame_number": 15434, "timestamp_epoch": "1723681363.438478000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49989, "dst_port": 80, "tcp_stream": 307, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15436", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-4dd7a8b11cd7a7503b9e399d", "kind": "http_request", "frame_number": 15443, "timestamp_epoch": "1723681367.610722000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49990, "dst_port": 80, "tcp_stream": 308, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15445", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-7c9ba219a8bbeb2a5d1d74f3", "kind": "http_request", "frame_number": 15454, "timestamp_epoch": "1723681372.837324000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49991, "dst_port": 80, "tcp_stream": 309, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15456", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-36e1c325b5c57a809b13e7b1", "kind": "http_request", "frame_number": 15463, "timestamp_epoch": "1723681377.723785000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49992, "dst_port": 80, "tcp_stream": 310, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15465", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-15f7e8b107d4ed58f3acb1aa", "kind": "http_request", "frame_number": 15492, "timestamp_epoch": "1723681383.397047000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49994, "dst_port": 80, "tcp_stream": 312, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15494", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-a5c1f3cf4899d3683cfccd25", "kind": "http_request", "frame_number": 15508, "timestamp_epoch": "1723681390.625881000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49995, "dst_port": 80, "tcp_stream": 313, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15510", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-563a89c445cec25ed9024aea", "kind": "http_request", "frame_number": 15517, "timestamp_epoch": "1723681396.876347000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49996, "dst_port": 80, "tcp_stream": 314, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15519", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-a9cbf5f65ed90ecebaf87078", "kind": "http_request", "frame_number": 15526, "timestamp_epoch": "1723681401.210379000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49997, "dst_port": 80, "tcp_stream": 315, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15528", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-e2c2a46561cd8d737e915d63", "kind": "http_request", "frame_number": 15536, "timestamp_epoch": "1723681405.776708000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49998, "dst_port": 80, "tcp_stream": 316, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15538", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-ed2dfd9c41906e8fa3155d8f", "kind": "http_request", "frame_number": 15549, "timestamp_epoch": "1723681410.787676000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 49999, "dst_port": 80, "tcp_stream": 317, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15551", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-5f16890ee72a055e7a63f842", "kind": "http_request", "frame_number": 15558, "timestamp_epoch": "1723681416.727710000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50000, "dst_port": 80, "tcp_stream": 318, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15560", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-2c7f71ae39b0094af30bef9a", "kind": "http_request", "frame_number": 15569, "timestamp_epoch": "1723681420.436193000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50001, "dst_port": 80, "tcp_stream": 319, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15571", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-acefcc5a0f0294933031b047", "kind": "http_request", "frame_number": 15580, "timestamp_epoch": "1723681427.849948000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50002, "dst_port": 80, "tcp_stream": 320, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15582", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-16c7593e87cc4c6b8c4b7f59", "kind": "http_request", "frame_number": 15593, "timestamp_epoch": "1723681435.677809000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50003, "dst_port": 80, "tcp_stream": 321, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15595", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-1ec11ae1826c7cc44568ca75", "kind": "http_request", "frame_number": 15608, "timestamp_epoch": "1723681441.957543000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50004, "dst_port": 80, "tcp_stream": 322, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15610", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-1accdbf23e610fc16e50fe05", "kind": "http_request", "frame_number": 15617, "timestamp_epoch": "1723681446.314450000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50005, "dst_port": 80, "tcp_stream": 323, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15619", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-e9caaa741956aaa10fff02d1", "kind": "http_request", "frame_number": 15628, "timestamp_epoch": "1723681450.937402000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50006, "dst_port": 80, "tcp_stream": 324, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15630", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-66723c7c4c4f4f4cd50e5b1e", "kind": "http_request", "frame_number": 15639, "timestamp_epoch": "1723681456.370729000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50007, "dst_port": 80, "tcp_stream": 325, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15641", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-af025c61d5afd8a2244a3f3b", "kind": "http_request", "frame_number": 15645, "timestamp_epoch": "1723681458.876450000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-eb8091a5300fae03dde6e3bf", "kind": "http_request", "frame_number": 15646, "timestamp_epoch": "1723681459.883394000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-9b139763437dd0f2b830599e", "kind": "http_request", "frame_number": 15647, "timestamp_epoch": "1723681460.885285000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-af9bfa9e676e1f52fa87071d", "kind": "http_request", "frame_number": 15648, "timestamp_epoch": "1723681461.899983000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-6f05fa5d393b7d2e07658489", "kind": "http_request", "frame_number": 15653, "timestamp_epoch": "1723681463.896631000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50008, "dst_port": 80, "tcp_stream": 326, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15655", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-7a12852bd4ba7bbefef014c6", "kind": "http_request", "frame_number": 15662, "timestamp_epoch": "1723681469.716730000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50009, "dst_port": 80, "tcp_stream": 327, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15664", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-cbf2e27b0d54dc0750616f58", "kind": "http_request", "frame_number": 15672, "timestamp_epoch": "1723681473.191934000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50010, "dst_port": 80, "tcp_stream": 328, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15674", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-4836b32e49d3fd178ddc3b20", "kind": "http_request", "frame_number": 15686, "timestamp_epoch": "1723681481.788984000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50011, "dst_port": 80, "tcp_stream": 329, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15688", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-00542895cbc037f2dca87f2a", "kind": "http_request", "frame_number": 15716, "timestamp_epoch": "1723681489.131896000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50013, "dst_port": 80, "tcp_stream": 331, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15718", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-d545d8684eb03626efb89423", "kind": "http_request", "frame_number": 15727, "timestamp_epoch": "1723681495.617234000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50014, "dst_port": 80, "tcp_stream": 332, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15729", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-f0cba039566a83af9d4fb6a8", "kind": "http_request", "frame_number": 15743, "timestamp_epoch": "1723681501.657638000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50015, "dst_port": 80, "tcp_stream": 333, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15745", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-c93e70d993feece2c802ac07", "kind": "http_request", "frame_number": 15752, "timestamp_epoch": "1723681508.387919000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50016, "dst_port": 80, "tcp_stream": 334, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15754", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-9a815d07f73e6feab07ad4bb", "kind": "http_request", "frame_number": 15859, "timestamp_epoch": "1723681513.632836000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50019, "dst_port": 80, "tcp_stream": 337, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15861", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-840303ec7c2af1f6608eb705", "kind": "http_request", "frame_number": 15884, "timestamp_epoch": "1723681517.670816000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 50021, "dst_port": 80, "tcp_stream": 339, "udp_stream": null, "fields": { "http.host": "oneocsp.microsoft.com", "http.request.full_uri": "http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBR2JNtr0JxEvYySpbyBWaqBmealCgQUzhUWO%2BoCo6Zr2tkr%2FeWMUr56UKgCEzMAPnPpacmgFoSqVQMAAAA%2Bc%2Bk%3D", "http.request.method": "GET", "http.request.uri": "/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBR2JNtr0JxEvYySpbyBWaqBmealCgQUzhUWO%2BoCo6Zr2tkr%2FeWMUr56UKgCEzMAPnPpacmgFoSqVQMAAAA%2Bc%2Bk%3D", "http.response_in": "15887", "http.user_agent": "Microsoft-CryptoAPI/10.0" } }, { "event_id": "evt-ee033ab4a31b9a0fef49b7bb", "kind": "http_request", "frame_number": 15906, "timestamp_epoch": "1723681520.029833000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50022, "dst_port": 80, "tcp_stream": 340, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15908", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-2920fda4e2237ab72bf6c3c4", "kind": "http_request", "frame_number": 15915, "timestamp_epoch": "1723681524.634868000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50023, "dst_port": 80, "tcp_stream": 341, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15917", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-05b47b7468525c1a1473e605", "kind": "http_request", "frame_number": 15925, "timestamp_epoch": "1723681529.768230000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50024, "dst_port": 80, "tcp_stream": 342, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15927", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-56fa70c4cd0e45363511ebe5", "kind": "http_request", "frame_number": 15936, "timestamp_epoch": "1723681535.917948000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50025, "dst_port": 80, "tcp_stream": 343, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15938", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-e94d2a06bba3cd8bbf79d087", "kind": "http_request", "frame_number": 15945, "timestamp_epoch": "1723681540.016648000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50026, "dst_port": 80, "tcp_stream": 344, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "15947", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-d26702643fd0da04bd258922", "kind": "http_request", "frame_number": 16023, "timestamp_epoch": "1723681544.136124000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50030, "dst_port": 80, "tcp_stream": 348, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16025", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-9780345995baf9646c24e499", "kind": "http_request", "frame_number": 16034, "timestamp_epoch": "1723681548.317594000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50031, "dst_port": 80, "tcp_stream": 349, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16036", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-04a62181d0770d54691d31ce", "kind": "http_request", "frame_number": 16047, "timestamp_epoch": "1723681552.538644000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50032, "dst_port": 80, "tcp_stream": 350, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16049", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-cea8a5e51cbfd04fdfb43b8d", "kind": "http_request", "frame_number": 16056, "timestamp_epoch": "1723681556.868505000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50033, "dst_port": 80, "tcp_stream": 351, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16058", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-d2d4816790d6a6410b263dcf", "kind": "http_request", "frame_number": 16065, "timestamp_epoch": "1723681561.457667000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50034, "dst_port": 80, "tcp_stream": 352, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16067", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-1aefd493e3db9724d295ccf0", "kind": "http_request", "frame_number": 16076, "timestamp_epoch": "1723681566.516076000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50035, "dst_port": 80, "tcp_stream": 353, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16078", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-f4cebbe76a75c36b53f3db72", "kind": "http_request", "frame_number": 16087, "timestamp_epoch": "1723681574.266309000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50036, "dst_port": 80, "tcp_stream": 354, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16089", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-4aaaa0414da045493dbcbf57", "kind": "http_request", "frame_number": 16097, "timestamp_epoch": "1723681578.889568000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-4992f93f223b3bf486255c7b", "kind": "http_request", "frame_number": 16099, "timestamp_epoch": "1723681579.901606000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-0a51f4b7164ccca9dd5d170a", "kind": "http_request", "frame_number": 16102, "timestamp_epoch": "1723681579.941890000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50037, "dst_port": 80, "tcp_stream": 355, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16106", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-d8ec6ce65ebe13b8e0122e5a", "kind": "http_request", "frame_number": 16104, "timestamp_epoch": "1723681580.917229000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-b50d280d96c69267132834ed", "kind": "http_request", "frame_number": 16105, "timestamp_epoch": "1723681581.917327000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-a6bab64e66340a34fd283335", "kind": "http_request", "frame_number": 16115, "timestamp_epoch": "1723681587.520351000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50038, "dst_port": 80, "tcp_stream": 356, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16117", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-85c7dbec5e77b5a25ddf1253", "kind": "http_request", "frame_number": 16124, "timestamp_epoch": "1723681594.187241000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50039, "dst_port": 80, "tcp_stream": 357, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16126", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-e8e1672a1995acd09f52b86b", "kind": "http_request", "frame_number": 16133, "timestamp_epoch": "1723681600.553865000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50040, "dst_port": 80, "tcp_stream": 358, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16135", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-33d5faa43d9f46a336d167d0", "kind": "http_request", "frame_number": 16143, "timestamp_epoch": "1723681608.917699000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50041, "dst_port": 80, "tcp_stream": 359, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16145", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-7c0e2756e5f5771214aef202", "kind": "http_request", "frame_number": 16154, "timestamp_epoch": "1723681616.935705000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50042, "dst_port": 80, "tcp_stream": 360, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16156", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-210b733703f29d855cceff8f", "kind": "http_request", "frame_number": 16167, "timestamp_epoch": "1723681624.217277000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50043, "dst_port": 80, "tcp_stream": 361, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16171", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-a38e96a0899f9b6cfde56256", "kind": "http_request", "frame_number": 16180, "timestamp_epoch": "1723681630.610414000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50044, "dst_port": 80, "tcp_stream": 362, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16182", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-11f93252a4c081ce7d0a02d5", "kind": "http_request", "frame_number": 16191, "timestamp_epoch": "1723681635.206604000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50045, "dst_port": 80, "tcp_stream": 363, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16193", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-b8846390285d07ac11fd21b3", "kind": "http_request", "frame_number": 16202, "timestamp_epoch": "1723681640.293908000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50046, "dst_port": 80, "tcp_stream": 364, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16204", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-95d750953660c19cce276cd8", "kind": "http_request", "frame_number": 16211, "timestamp_epoch": "1723681646.356386000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50047, "dst_port": 80, "tcp_stream": 365, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16213", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-e816323cd7223bd6796cf9c4", "kind": "http_request", "frame_number": 16222, "timestamp_epoch": "1723681650.296189000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50048, "dst_port": 80, "tcp_stream": 366, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16224", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-be14a946d2c81bb6793f1314", "kind": "http_request", "frame_number": 16231, "timestamp_epoch": "1723681654.107188000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50049, "dst_port": 80, "tcp_stream": 367, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16233", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-f41252c13f0cfe7690149472", "kind": "http_request", "frame_number": 16244, "timestamp_epoch": "1723681657.618080000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50050, "dst_port": 80, "tcp_stream": 368, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16246", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-2c5b4eea6e474aab1f4e3254", "kind": "http_request", "frame_number": 16254, "timestamp_epoch": "1723681664.742020000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50051, "dst_port": 80, "tcp_stream": 369, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16258", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-81e0c49af2aeab59b706580a", "kind": "http_request", "frame_number": 16271, "timestamp_epoch": "1723681670.799294000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50052, "dst_port": 80, "tcp_stream": 370, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16273", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-686ea63b00bf840c979a8fa1", "kind": "http_request", "frame_number": 16322, "timestamp_epoch": "1723681675.393303000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50054, "dst_port": 80, "tcp_stream": 372, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16324", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-45bd02ac8f9a3315bfaec634", "kind": "http_request", "frame_number": 16334, "timestamp_epoch": "1723681681.369706000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50055, "dst_port": 80, "tcp_stream": 373, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16336", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-6439c033ba71b7c2efdf559e", "kind": "http_request", "frame_number": 16350, "timestamp_epoch": "1723681687.584682000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50056, "dst_port": 80, "tcp_stream": 374, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16352", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-fa721e920352e2b9b41594b8", "kind": "http_request", "frame_number": 16360, "timestamp_epoch": "1723681691.829346000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50057, "dst_port": 80, "tcp_stream": 375, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16362", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-fdd3591c8a8df1db3dffaf26", "kind": "http_request", "frame_number": 16370, "timestamp_epoch": "1723681696.254551000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50058, "dst_port": 80, "tcp_stream": 376, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16372", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-099d469c2b1c6d1669c56817", "kind": "http_request", "frame_number": 16376, "timestamp_epoch": "1723681698.893814000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-caa74120237c995d3690f763", "kind": "http_request", "frame_number": 16379, "timestamp_epoch": "1723681699.905455000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-3929f1b82ab3403f982120d5", "kind": "http_request", "frame_number": 16381, "timestamp_epoch": "1723681700.920192000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-1659f3f9cf071e26f8ef5e36", "kind": "http_request", "frame_number": 16383, "timestamp_epoch": "1723681701.929794000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-5a871a862026293b2f9611a8", "kind": "http_request", "frame_number": 16386, "timestamp_epoch": "1723681702.667726000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50059, "dst_port": 80, "tcp_stream": 377, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16388", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-14de4ccef01a1c19974a85e7", "kind": "http_request", "frame_number": 16397, "timestamp_epoch": "1723681710.749581000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50060, "dst_port": 80, "tcp_stream": 378, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16399", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-ce98f687d8934d0751d4f459", "kind": "http_request", "frame_number": 16406, "timestamp_epoch": "1723681717.643812000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50061, "dst_port": 80, "tcp_stream": 379, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16408", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-143cdb0f1f15c7f04b8e8e0a", "kind": "http_request", "frame_number": 16417, "timestamp_epoch": "1723681723.262765000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50062, "dst_port": 80, "tcp_stream": 380, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16419", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-11da32ea0bcc5045dd09e948", "kind": "http_request", "frame_number": 16427, "timestamp_epoch": "1723681731.670553000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50063, "dst_port": 80, "tcp_stream": 381, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16429", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-1ae8de80c9598b6e689d2c0f", "kind": "http_request", "frame_number": 16436, "timestamp_epoch": "1723681738.975921000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50064, "dst_port": 80, "tcp_stream": 382, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16438", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-6d56176c667df8a941570753", "kind": "http_request", "frame_number": 16447, "timestamp_epoch": "1723681745.469182000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50065, "dst_port": 80, "tcp_stream": 383, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16449", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-02a91ec1d1901625795bece3", "kind": "http_request", "frame_number": 16456, "timestamp_epoch": "1723681750.224666000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50066, "dst_port": 80, "tcp_stream": 384, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16458", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-658d0f27d801b068f127026d", "kind": "http_request", "frame_number": 16465, "timestamp_epoch": "1723681755.632754000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50067, "dst_port": 80, "tcp_stream": 385, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16467", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-0cdce6d12d0c8646e2d6a100", "kind": "http_request", "frame_number": 16474, "timestamp_epoch": "1723681762.353916000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50068, "dst_port": 80, "tcp_stream": 386, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16476", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-e0d65925ffd430ddfcd901d4", "kind": "http_request", "frame_number": 16485, "timestamp_epoch": "1723681768.898790000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50069, "dst_port": 80, "tcp_stream": 387, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16487", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-59b1e308b9d64cd2cecdceee", "kind": "http_request", "frame_number": 16494, "timestamp_epoch": "1723681772.497756000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50070, "dst_port": 80, "tcp_stream": 388, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16496", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-983235c6ca94988fb2845371", "kind": "http_request", "frame_number": 16503, "timestamp_epoch": "1723681779.691153000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50071, "dst_port": 80, "tcp_stream": 389, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16505", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-fb6f974c4c278c5e7d69288c", "kind": "http_request", "frame_number": 16517, "timestamp_epoch": "1723681785.898824000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50072, "dst_port": 80, "tcp_stream": 390, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16519", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-4905829fc6a7b35333b9b7ed", "kind": "http_request", "frame_number": 16530, "timestamp_epoch": "1723681790.119024000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50073, "dst_port": 80, "tcp_stream": 391, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16532", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-7dbcb0b6e4a700a6209c6e0b", "kind": "http_request", "frame_number": 16539, "timestamp_epoch": "1723681794.450869000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50074, "dst_port": 80, "tcp_stream": 392, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16541", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-9c96064e1e9ec0a088a2f9bb", "kind": "http_request", "frame_number": 16549, "timestamp_epoch": "1723681799.092307000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50075, "dst_port": 80, "tcp_stream": 393, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16551", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-23d272cb7491b5a72f96fc23", "kind": "http_request", "frame_number": 16560, "timestamp_epoch": "1723681804.230088000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50076, "dst_port": 80, "tcp_stream": 394, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16562", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-b5ba0f418fc98f90f81dba6b", "kind": "http_request", "frame_number": 16569, "timestamp_epoch": "1723681810.414148000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50077, "dst_port": 80, "tcp_stream": 395, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16571", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-7f851cb04f9cdf611ddde4ac", "kind": "http_request", "frame_number": 16611, "timestamp_epoch": "1723681814.596872000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50079, "dst_port": 80, "tcp_stream": 397, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16613", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-c36fa23a222fe75811326ef8", "kind": "http_request", "frame_number": 16622, "timestamp_epoch": "1723681818.903653000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-8cbb06010aa6f56f4ecc7d0f", "kind": "http_request", "frame_number": 16625, "timestamp_epoch": "1723681818.952088000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50080, "dst_port": 80, "tcp_stream": 398, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16627", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-ef20f2df1c892b3ce4ef994a", "kind": "http_request", "frame_number": 16633, "timestamp_epoch": "1723681819.914630000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-d09d72111f5d93d9485d9767", "kind": "http_request", "frame_number": 16634, "timestamp_epoch": "1723681820.930097000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-d8e8b7bdd1d386fa1b92b81f", "kind": "http_request", "frame_number": 16635, "timestamp_epoch": "1723681821.930353000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-def8708c635a5cb3610f5b7e", "kind": "http_request", "frame_number": 16640, "timestamp_epoch": "1723681824.758748000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50081, "dst_port": 80, "tcp_stream": 399, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16642", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-9b422f8b9d97970e88306eab", "kind": "http_request", "frame_number": 16649, "timestamp_epoch": "1723681830.958593000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50082, "dst_port": 80, "tcp_stream": 400, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16651", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-19aafa0142f122549960d856", "kind": "http_request", "frame_number": 16660, "timestamp_epoch": "1723681835.189983000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50083, "dst_port": 80, "tcp_stream": 401, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16662", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-43811c2488cb475aa08f5cb8", "kind": "http_request", "frame_number": 16669, "timestamp_epoch": "1723681840.076991000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50084, "dst_port": 80, "tcp_stream": 402, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16671", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-d8d7e5fcde54432ed7b94098", "kind": "http_request", "frame_number": 16680, "timestamp_epoch": "1723681845.798637000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50085, "dst_port": 80, "tcp_stream": 403, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16682", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-64dc4a66dafb4bc3012cfa01", "kind": "http_request", "frame_number": 16692, "timestamp_epoch": "1723681854.632258000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50086, "dst_port": 80, "tcp_stream": 404, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16694", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-6e5ed238bfe3fae252b653bf", "kind": "http_request", "frame_number": 16707, "timestamp_epoch": "1723681862.036589000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50087, "dst_port": 80, "tcp_stream": 405, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16709", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-8abe96325a02b5e4323bd15f", "kind": "http_request", "frame_number": 16716, "timestamp_epoch": "1723681868.689310000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50088, "dst_port": 80, "tcp_stream": 406, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16718", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-72fbe6009a17af1cebd99f14", "kind": "http_request", "frame_number": 16726, "timestamp_epoch": "1723681875.096311000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50089, "dst_port": 80, "tcp_stream": 407, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16728", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-1335879c700145c3cc0f48ab", "kind": "http_request", "frame_number": 16738, "timestamp_epoch": "1723681884.226126000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50090, "dst_port": 80, "tcp_stream": 408, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16740", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-d9f28920701555d6bb1afb42", "kind": "http_request", "frame_number": 16749, "timestamp_epoch": "1723681889.237532000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50091, "dst_port": 80, "tcp_stream": 409, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16751", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-076f2ace37c2e14b010cd41c", "kind": "http_request", "frame_number": 16758, "timestamp_epoch": "1723681894.466394000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50092, "dst_port": 80, "tcp_stream": 410, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16760", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-bd9bf792e07c76bb088128fc", "kind": "http_request", "frame_number": 16771, "timestamp_epoch": "1723681902.739302000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50093, "dst_port": 80, "tcp_stream": 411, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16773", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-de81d424e731703934193276", "kind": "http_request", "frame_number": 16785, "timestamp_epoch": "1723681909.216025000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50094, "dst_port": 80, "tcp_stream": 412, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16788", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-15b8a699d7158cb8afb60cf4", "kind": "http_request", "frame_number": 16825, "timestamp_epoch": "1723681914.529384000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50096, "dst_port": 80, "tcp_stream": 414, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16827", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-e7d6af2d110c3853dada4494", "kind": "http_request", "frame_number": 16836, "timestamp_epoch": "1723681920.458246000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50097, "dst_port": 80, "tcp_stream": 415, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16840", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-6e83ef87b7890bdbedcaba4a", "kind": "http_request", "frame_number": 16851, "timestamp_epoch": "1723681924.856993000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50098, "dst_port": 80, "tcp_stream": 416, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16853", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-910b8269f6781e27d6b5cfbb", "kind": "http_request", "frame_number": 16860, "timestamp_epoch": "1723681928.785109000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50099, "dst_port": 80, "tcp_stream": 417, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16862", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-86efcecd14273f91594cd5c6", "kind": "http_request", "frame_number": 16869, "timestamp_epoch": "1723681932.564919000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50100, "dst_port": 80, "tcp_stream": 418, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16871", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-3c4bf7152a3dd7a5de6835a4", "kind": "http_request", "frame_number": 16878, "timestamp_epoch": "1723681936.017862000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50101, "dst_port": 80, "tcp_stream": 419, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16880", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-765a116ff278f663511dedae", "kind": "http_request", "frame_number": 16884, "timestamp_epoch": "1723681938.914620000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-890716187a0cbbc73e14847f", "kind": "http_request", "frame_number": 16885, "timestamp_epoch": "1723681939.918097000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-493e993fbba191e63273c313", "kind": "http_request", "frame_number": 16886, "timestamp_epoch": "1723681940.933496000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-9924e69212f82836ab798013", "kind": "http_request", "frame_number": 16887, "timestamp_epoch": "1723681941.949202000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-f212e072662650ad0041ca28", "kind": "http_request", "frame_number": 16891, "timestamp_epoch": "1723681943.879448000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50102, "dst_port": 80, "tcp_stream": 420, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16893", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-018f0a45a82cf3bbb8597cee", "kind": "http_request", "frame_number": 16902, "timestamp_epoch": "1723681950.419888000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50103, "dst_port": 80, "tcp_stream": 421, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16904", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-0e98927389a9b5fe8fef224a", "kind": "http_request", "frame_number": 16911, "timestamp_epoch": "1723681955.312384000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50104, "dst_port": 80, "tcp_stream": 422, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16913", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-571ff6eedda0daec39addd1a", "kind": "http_request", "frame_number": 16920, "timestamp_epoch": "1723681961.413526000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50105, "dst_port": 80, "tcp_stream": 423, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16922", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-8009063859a5b35e99a299f7", "kind": "http_request", "frame_number": 16931, "timestamp_epoch": "1723681965.019559000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50106, "dst_port": 80, "tcp_stream": 424, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16933", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-19fc37050382bbdc918dd8ae", "kind": "http_request", "frame_number": 16943, "timestamp_epoch": "1723681972.207636000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50107, "dst_port": 80, "tcp_stream": 425, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16945", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-08bd0d4886b2833c49a0fbcb", "kind": "http_request", "frame_number": 16952, "timestamp_epoch": "1723681978.419497000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50108, "dst_port": 80, "tcp_stream": 426, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16954", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-c5f255c204c701babf2e532c", "kind": "http_request", "frame_number": 16961, "timestamp_epoch": "1723681982.687176000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50109, "dst_port": 80, "tcp_stream": 427, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16963", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-8ded70c28e912b49f90720a8", "kind": "http_request", "frame_number": 16972, "timestamp_epoch": "1723681987.079345000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50110, "dst_port": 80, "tcp_stream": 428, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16974", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-ff911d2e9c78c3de9aeadf07", "kind": "http_request", "frame_number": 16981, "timestamp_epoch": "1723681991.758233000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50111, "dst_port": 80, "tcp_stream": 429, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16985", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-45efc77ab7d69aa4ea3a0e02", "kind": "http_request", "frame_number": 16994, "timestamp_epoch": "1723681997.056594000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50112, "dst_port": 80, "tcp_stream": 430, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "16996", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-b1e7579898dd613022da6ea4", "kind": "http_request", "frame_number": 17003, "timestamp_epoch": "1723682003.558593000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50113, "dst_port": 80, "tcp_stream": 431, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17005", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-8cce315aae9af0be6ca81495", "kind": "http_request", "frame_number": 17012, "timestamp_epoch": "1723682008.379631000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50114, "dst_port": 80, "tcp_stream": 432, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17014", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-003e94059fe9652451cde836", "kind": "http_request", "frame_number": 17021, "timestamp_epoch": "1723682013.914557000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50115, "dst_port": 80, "tcp_stream": 433, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17023", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-c551bc5e35a5074dcc304013", "kind": "http_request", "frame_number": 17034, "timestamp_epoch": "1723682020.872172000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50116, "dst_port": 80, "tcp_stream": 434, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17036", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-3802b11224c27750eb20fd9d", "kind": "http_request", "frame_number": 17045, "timestamp_epoch": "1723682026.602674000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50117, "dst_port": 80, "tcp_stream": 435, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17048", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-510cc054e8a6863e75ab984e", "kind": "http_request", "frame_number": 17057, "timestamp_epoch": "1723682033.958993000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50118, "dst_port": 80, "tcp_stream": 436, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17059", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-bd08afa78090ead873cd7d15", "kind": "http_request", "frame_number": 17068, "timestamp_epoch": "1723682040.479487000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50119, "dst_port": 80, "tcp_stream": 437, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17070", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-4c32504ac83b52203e33a874", "kind": "http_request", "frame_number": 17081, "timestamp_epoch": "1723682045.359201000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50120, "dst_port": 80, "tcp_stream": 438, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17083", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-9252b369789a6cce14b92ae9", "kind": "http_request", "frame_number": 17090, "timestamp_epoch": "1723682050.992776000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50121, "dst_port": 80, "tcp_stream": 439, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17092", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-0167b4dbf2d6d9907f1a9b8a", "kind": "http_request", "frame_number": 17101, "timestamp_epoch": "1723682058.923035000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-ff82e659557abfdaaaadc31c", "kind": "http_request", "frame_number": 17105, "timestamp_epoch": "1723682059.472115000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50122, "dst_port": 80, "tcp_stream": 440, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17109", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-a380a9e9327dbd30a686b55c", "kind": "http_request", "frame_number": 17113, "timestamp_epoch": "1723682059.934823000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-b4116ae2b09134d401890cfe", "kind": "http_request", "frame_number": 17114, "timestamp_epoch": "1723682060.950848000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-12a4f5d6e453936b6ef3f007", "kind": "http_request", "frame_number": 17115, "timestamp_epoch": "1723682061.966193000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-4893f96ff15a3b30806cfed3", "kind": "http_request", "frame_number": 17120, "timestamp_epoch": "1723682068.459192000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50123, "dst_port": 80, "tcp_stream": 441, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17122", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-5b2c7018c604cfbc7f072db6", "kind": "http_request", "frame_number": 17156, "timestamp_epoch": "1723682072.597532000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50125, "dst_port": 80, "tcp_stream": 443, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17158", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-a898332d47ffc9ab316ed083", "kind": "http_request", "frame_number": 17169, "timestamp_epoch": "1723682076.799444000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50126, "dst_port": 80, "tcp_stream": 444, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17171", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-da1a1342734f933b44440d01", "kind": "http_request", "frame_number": 17185, "timestamp_epoch": "1723682082.679872000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50127, "dst_port": 80, "tcp_stream": 445, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17187", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-e78db60bcfd15b7b174286f7", "kind": "http_request", "frame_number": 17196, "timestamp_epoch": "1723682089.761336000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50128, "dst_port": 80, "tcp_stream": 446, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17198", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-2d320dddbf496905c0466064", "kind": "http_request", "frame_number": 17205, "timestamp_epoch": "1723682094.729979000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50129, "dst_port": 80, "tcp_stream": 447, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17207", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-eaba9a6bd84b0a8e94c6d256", "kind": "http_request", "frame_number": 17214, "timestamp_epoch": "1723682100.651328000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50130, "dst_port": 80, "tcp_stream": 448, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17216", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-c8c4a31f96c5793a6000eb33", "kind": "http_request", "frame_number": 17225, "timestamp_epoch": "1723682105.539955000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50131, "dst_port": 80, "tcp_stream": 449, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17227", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-da4fa32bd2dfef85b895e2d8", "kind": "http_request", "frame_number": 17235, "timestamp_epoch": "1723682111.563883000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50132, "dst_port": 80, "tcp_stream": 450, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17237", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-0f794cb9d32b859439571790", "kind": "http_request", "frame_number": 17244, "timestamp_epoch": "1723682117.878103000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50133, "dst_port": 80, "tcp_stream": 451, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17246", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-934b8b85cf916805fae1b93e", "kind": "http_request", "frame_number": 17254, "timestamp_epoch": "1723682122.706729000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50134, "dst_port": 80, "tcp_stream": 452, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17256", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-ed475071cd16f3d3afdb8199", "kind": "http_request", "frame_number": 17265, "timestamp_epoch": "1723682130.379263000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50135, "dst_port": 80, "tcp_stream": 453, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17267", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-3a91e81ee63c828126967159", "kind": "http_request", "frame_number": 17274, "timestamp_epoch": "1723682135.026017000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50136, "dst_port": 80, "tcp_stream": 454, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17276", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-705dd1f16b9c59d306e9bcfa", "kind": "http_request", "frame_number": 17283, "timestamp_epoch": "1723682140.233919000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50137, "dst_port": 80, "tcp_stream": 455, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17285", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-bc49f2e9fecaea4054cfb1f5", "kind": "http_request", "frame_number": 17317, "timestamp_epoch": "1723682148.602576000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50139, "dst_port": 80, "tcp_stream": 457, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17319", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-b6aa57511c0513806592fdba", "kind": "http_request", "frame_number": 17330, "timestamp_epoch": "1723682155.087271000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50140, "dst_port": 80, "tcp_stream": 458, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17332", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-541a9b991ca9cf3a1c44fde1", "kind": "http_request", "frame_number": 17339, "timestamp_epoch": "1723682159.870870000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50141, "dst_port": 80, "tcp_stream": 459, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17341", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-427acbcdc426cdadfec344f5", "kind": "http_request", "frame_number": 17348, "timestamp_epoch": "1723682165.340066000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50142, "dst_port": 80, "tcp_stream": 460, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17350", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-c79d36540b9e6e83c4013f08", "kind": "http_request", "frame_number": 17360, "timestamp_epoch": "1723682173.499436000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50143, "dst_port": 80, "tcp_stream": 461, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17362", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-f8c4b93bdaac3a2c0f5f7927", "kind": "http_request", "frame_number": 17366, "timestamp_epoch": "1723682178.941562000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-863ce814993168285e778307", "kind": "http_request", "frame_number": 17367, "timestamp_epoch": "1723682179.952772000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-09acc77d47838f96b5e87b18", "kind": "http_request", "frame_number": 17371, "timestamp_epoch": "1723682180.291397000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50144, "dst_port": 80, "tcp_stream": 462, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17373", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-0d5c7441262026b67540aa7b", "kind": "http_request", "frame_number": 17377, "timestamp_epoch": "1723682180.968517000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-e4b5b759897cf6f10fe7085b", "kind": "http_request", "frame_number": 17378, "timestamp_epoch": "1723682181.983964000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-4f1c5516a4f1b3cd6338638a", "kind": "http_request", "frame_number": 17383, "timestamp_epoch": "1723682186.753419000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50145, "dst_port": 80, "tcp_stream": 463, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17385", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-a1ad1bd7923404c132e38112", "kind": "http_request", "frame_number": 17392, "timestamp_epoch": "1723682190.436416000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50146, "dst_port": 80, "tcp_stream": 464, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17394", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-f71233fdd710002dbfa66023", "kind": "http_request", "frame_number": 17405, "timestamp_epoch": "1723682197.780325000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50147, "dst_port": 80, "tcp_stream": 465, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17407", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-4c213d1e7f2f304e8a2206a3", "kind": "http_request", "frame_number": 17414, "timestamp_epoch": "1723682204.296634000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50148, "dst_port": 80, "tcp_stream": 466, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17416", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-7d527517af14e6191ee2f8e6", "kind": "http_request", "frame_number": 17423, "timestamp_epoch": "1723682209.112411000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50149, "dst_port": 80, "tcp_stream": 467, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17425", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-f2cbd026caa6f34b049a1175", "kind": "http_request", "frame_number": 17433, "timestamp_epoch": "1723682214.708840000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50150, "dst_port": 80, "tcp_stream": 468, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17435", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-bc1c39c97fd9df92ea7bd345", "kind": "http_request", "frame_number": 17445, "timestamp_epoch": "1723682218.780429000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50151, "dst_port": 80, "tcp_stream": 469, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17447", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-4801bb2ecbfdd1fff977d292", "kind": "http_request", "frame_number": 17454, "timestamp_epoch": "1723682225.832822000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50152, "dst_port": 80, "tcp_stream": 470, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17456", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-902ffce278654282028fda99", "kind": "http_request", "frame_number": 17463, "timestamp_epoch": "1723682231.710170000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50153, "dst_port": 80, "tcp_stream": 471, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17465", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-cdd3253a5dbdfb22cd591b9e", "kind": "http_request", "frame_number": 17472, "timestamp_epoch": "1723682235.280736000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50154, "dst_port": 80, "tcp_stream": 472, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17474", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-082a5ef7add03a9f34e1689e", "kind": "http_request", "frame_number": 17483, "timestamp_epoch": "1723682242.418751000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50155, "dst_port": 80, "tcp_stream": 473, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17485", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-86bed9e99ebf424c1a18e6d2", "kind": "http_request", "frame_number": 17492, "timestamp_epoch": "1723682248.498013000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50156, "dst_port": 80, "tcp_stream": 474, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17494", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-18a5b98521aaa82c421dd80e", "kind": "http_request", "frame_number": 17501, "timestamp_epoch": "1723682252.481153000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50157, "dst_port": 80, "tcp_stream": 475, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17503", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-d657e7e1467ff67494ade757", "kind": "http_request", "frame_number": 17510, "timestamp_epoch": "1723682256.323119000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50158, "dst_port": 80, "tcp_stream": 476, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17512", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-c6d781e1207771bc3cd6119a", "kind": "http_request", "frame_number": 17519, "timestamp_epoch": "1723682259.921474000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50159, "dst_port": 80, "tcp_stream": 477, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17521", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-c47cda64f88a8b49ecf0a676", "kind": "http_request", "frame_number": 17532, "timestamp_epoch": "1723682267.145921000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50160, "dst_port": 80, "tcp_stream": 478, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17534", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-bba459872e1fa8da15c050ea", "kind": "http_request", "frame_number": 17543, "timestamp_epoch": "1723682273.417986000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50161, "dst_port": 80, "tcp_stream": 479, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17545", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-83fee6f3eea6af148dbd88b0", "kind": "http_request", "frame_number": 17553, "timestamp_epoch": "1723682277.751806000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50162, "dst_port": 80, "tcp_stream": 480, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17555", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-a10ec67035a996900304614e", "kind": "http_request", "frame_number": 17562, "timestamp_epoch": "1723682282.320868000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50163, "dst_port": 80, "tcp_stream": 481, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17564", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-fcf6b55eb911b881394703e8", "kind": "http_request", "frame_number": 17573, "timestamp_epoch": "1723682287.340850000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50164, "dst_port": 80, "tcp_stream": 482, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17575", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-a3c6c47247c9dab1ca25e455", "kind": "http_request", "frame_number": 17584, "timestamp_epoch": "1723682293.300124000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50165, "dst_port": 80, "tcp_stream": 483, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17586", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-352740a223fd150653b88b08", "kind": "http_request", "frame_number": 17593, "timestamp_epoch": "1723682297.045516000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50166, "dst_port": 80, "tcp_stream": 484, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17595", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-2721b7ddc2bd76110baace76", "kind": "http_request", "frame_number": 17600, "timestamp_epoch": "1723682298.943814000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-4288a57fe9d3f60cdedba13b", "kind": "http_request", "frame_number": 17602, "timestamp_epoch": "1723682299.955334000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-10fc9fb1ea515dc6609f71e5", "kind": "http_request", "frame_number": 17603, "timestamp_epoch": "1723682300.970985000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-76a43083c2afb199ecf03dac", "kind": "http_request", "frame_number": 17604, "timestamp_epoch": "1723682301.986852000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-d58e5a13d628a998a8c6e121", "kind": "http_request", "frame_number": 17610, "timestamp_epoch": "1723682304.500372000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50167, "dst_port": 80, "tcp_stream": 485, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17612", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-35f75af7c4bb87965bebfde7", "kind": "http_request", "frame_number": 17621, "timestamp_epoch": "1723682311.240790000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50168, "dst_port": 80, "tcp_stream": 486, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17623", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-d20307403883c598008a0abe", "kind": "http_request", "frame_number": 17630, "timestamp_epoch": "1723682316.481060000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50169, "dst_port": 80, "tcp_stream": 487, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17632", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-5511f8983f0e837c1841b9d4", "kind": "http_request", "frame_number": 17639, "timestamp_epoch": "1723682322.889211000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50170, "dst_port": 80, "tcp_stream": 488, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17641", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-f55795f752ba3ee5b3ea004c", "kind": "http_request", "frame_number": 17648, "timestamp_epoch": "1723682327.541126000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50171, "dst_port": 80, "tcp_stream": 489, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17650", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-3e714478a2f31c406b4f052d", "kind": "http_request", "frame_number": 17660, "timestamp_epoch": "1723682332.764136000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50172, "dst_port": 80, "tcp_stream": 490, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17662", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-5eb274a536376bfdc5bdf2ec", "kind": "http_request", "frame_number": 17669, "timestamp_epoch": "1723682339.281827000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50173, "dst_port": 80, "tcp_stream": 491, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17671", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-bc7218aaa35ea38c6d61b553", "kind": "http_request", "frame_number": 17678, "timestamp_epoch": "1723682343.921736000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50174, "dst_port": 80, "tcp_stream": 492, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17680", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-c0dbe9f7107f5859b80cebfb", "kind": "http_request", "frame_number": 17687, "timestamp_epoch": "1723682349.121280000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50175, "dst_port": 80, "tcp_stream": 493, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17689", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-3ca4a0c26d0959be0e3c2ca4", "kind": "http_request", "frame_number": 17698, "timestamp_epoch": "1723682355.400238000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50176, "dst_port": 80, "tcp_stream": 494, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17700", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-c7753018b7d00196fd5ea8f1", "kind": "http_request", "frame_number": 17707, "timestamp_epoch": "1723682359.754395000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50177, "dst_port": 80, "tcp_stream": 495, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17709", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-5c151d14c2116c07df9af08f", "kind": "http_request", "frame_number": 17716, "timestamp_epoch": "1723682364.402262000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50178, "dst_port": 80, "tcp_stream": 496, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17718", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-c376f99e3e2bb4e96df2de82", "kind": "http_request", "frame_number": 17725, "timestamp_epoch": "1723682369.604245000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50179, "dst_port": 80, "tcp_stream": 497, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17727", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-2d11c24e7d8ebe7f27151825", "kind": "http_request", "frame_number": 17736, "timestamp_epoch": "1723682375.900194000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50180, "dst_port": 80, "tcp_stream": 498, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17738", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-a443c0b8296d309f14fe8baa", "kind": "http_request", "frame_number": 17746, "timestamp_epoch": "1723682380.294329000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50181, "dst_port": 80, "tcp_stream": 499, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17748", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-eb3852d51512e7a4035b9883", "kind": "http_request", "frame_number": 17757, "timestamp_epoch": "1723682384.994168000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50182, "dst_port": 80, "tcp_stream": 500, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17761", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-381cafad0fca56598ed12145", "kind": "http_request", "frame_number": 17793, "timestamp_epoch": "1723682390.282152000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50184, "dst_port": 80, "tcp_stream": 502, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17795", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-90a6dfdb66a74a48923cb552", "kind": "http_request", "frame_number": 17838, "timestamp_epoch": "1723682396.790974000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50186, "dst_port": 80, "tcp_stream": 504, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17842", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-8cd3b95c6ce341f214f77673", "kind": "http_request", "frame_number": 17864, "timestamp_epoch": "1723682401.620993000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50188, "dst_port": 80, "tcp_stream": 506, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17868", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-115618433ad391d27a5128a9", "kind": "http_request", "frame_number": 17890, "timestamp_epoch": "1723682407.136373000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50189, "dst_port": 80, "tcp_stream": 507, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17892", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-19468d6bb401db35ccbb8456", "kind": "http_request", "frame_number": 17899, "timestamp_epoch": "1723682414.093166000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50190, "dst_port": 80, "tcp_stream": 508, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17901", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-a261287b1493a5b305d4951d", "kind": "http_request", "frame_number": 17908, "timestamp_epoch": "1723682418.947637000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-60eea937a09e4cd454375698", "kind": "http_request", "frame_number": 17914, "timestamp_epoch": "1723682419.821206000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50191, "dst_port": 80, "tcp_stream": 509, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17917", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-b360e3b6b6ed00d080c469d5", "kind": "http_request", "frame_number": 17916, "timestamp_epoch": "1723682419.958110000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-7892873fd0416cd58c4b79bc", "kind": "http_request", "frame_number": 17921, "timestamp_epoch": "1723682420.974095000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-4e5855a194a0bde979042173", "kind": "http_request", "frame_number": 17922, "timestamp_epoch": "1723682421.984333000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-68042d18d64fa3cbe32b7191", "kind": "http_request", "frame_number": 17926, "timestamp_epoch": "1723682427.181388000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50192, "dst_port": 80, "tcp_stream": 510, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17928", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-f3816021d7749744cb1e8b6f", "kind": "http_request", "frame_number": 17935, "timestamp_epoch": "1723682433.714150000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50193, "dst_port": 80, "tcp_stream": 511, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17937", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-4812b93ff9b9fcc60809309b", "kind": "http_request", "frame_number": 17944, "timestamp_epoch": "1723682438.581743000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50194, "dst_port": 80, "tcp_stream": 512, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17946", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-e911fd6f3c207fb46433e22d", "kind": "http_request", "frame_number": 17955, "timestamp_epoch": "1723682444.230371000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50195, "dst_port": 80, "tcp_stream": 513, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17957", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-e16514fbbee325aab14e76e5", "kind": "http_request", "frame_number": 17993, "timestamp_epoch": "1723682451.419344000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50197, "dst_port": 80, "tcp_stream": 515, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "17995", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-86d22f8280aba4c5400aac9f", "kind": "http_request", "frame_number": 18004, "timestamp_epoch": "1723682457.601683000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50198, "dst_port": 80, "tcp_stream": 516, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "18006", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-007f0609841ce6ecc5acbdff", "kind": "http_request", "frame_number": 18017, "timestamp_epoch": "1723682461.800041000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50199, "dst_port": 80, "tcp_stream": 517, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "18019", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-2e192b1eb86f2226f5303c1c", "kind": "http_request", "frame_number": 18028, "timestamp_epoch": "1723682466.075763000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50200, "dst_port": 80, "tcp_stream": 518, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "18030", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-d16c23b5bd3f55bd2275928c", "kind": "http_request", "frame_number": 18038, "timestamp_epoch": "1723682471.499851000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50201, "dst_port": 80, "tcp_stream": 519, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "18040", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-57abe1ad77868376f18e3ba7", "kind": "http_request", "frame_number": 18047, "timestamp_epoch": "1723682477.261050000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50202, "dst_port": 80, "tcp_stream": 520, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "18049", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-346032aef35b860e3d830f74", "kind": "http_request", "frame_number": 18056, "timestamp_epoch": "1723682484.720888000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50203, "dst_port": 80, "tcp_stream": 521, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "18058", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-a4a7dc74aca9963a9b31b0d2", "kind": "http_request", "frame_number": 18067, "timestamp_epoch": "1723682491.461884000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50204, "dst_port": 80, "tcp_stream": 522, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "18069", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-c23ca78fa6310d2a5f63ebe7", "kind": "http_request", "frame_number": 18077, "timestamp_epoch": "1723682498.660716000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50205, "dst_port": 80, "tcp_stream": 523, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "18079", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-85dd10d04da59bd5f8b34148", "kind": "http_request", "frame_number": 18090, "timestamp_epoch": "1723682502.933765000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50206, "dst_port": 80, "tcp_stream": 524, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "18092", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-e39f28883f20a7451071e7d3", "kind": "http_request", "frame_number": 18103, "timestamp_epoch": "1723682507.396013000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50207, "dst_port": 80, "tcp_stream": 525, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "18105", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-798adbe8b00f3e801257dbd5", "kind": "http_request", "frame_number": 18117, "timestamp_epoch": "1723682512.588980000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50208, "dst_port": 80, "tcp_stream": 526, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "18119", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-c9a5a8732901923f1d3aa3ce", "kind": "http_request", "frame_number": 18126, "timestamp_epoch": "1723682518.536320000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50209, "dst_port": 80, "tcp_stream": 527, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "18128", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-c51de1ee7d56301f1dd962b0", "kind": "http_request", "frame_number": 18140, "timestamp_epoch": "1723682522.570400000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50210, "dst_port": 80, "tcp_stream": 528, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "18142", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-ea97be18ce62724bfbcf8ed3", "kind": "http_request", "frame_number": 18149, "timestamp_epoch": "1723682528.381376000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50211, "dst_port": 80, "tcp_stream": 529, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "18151", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-5edcee9e80bfe9345b2f0383", "kind": "http_request", "frame_number": 18162, "timestamp_epoch": "1723682535.293005000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50212, "dst_port": 80, "tcp_stream": 530, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "18164", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-e88c5d57e34a08355a98bfd5", "kind": "http_request", "frame_number": 18168, "timestamp_epoch": "1723682538.950589000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-f3f8086689a2f2a91ffd316b", "kind": "http_request", "frame_number": 18169, "timestamp_epoch": "1723682539.960922000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-f0038fa8161e5d90016723b6", "kind": "http_request", "frame_number": 18173, "timestamp_epoch": "1723682540.339964000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50213, "dst_port": 80, "tcp_stream": 531, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "18175", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } }, { "event_id": "evt-2028645e5307a8b7fa154cf5", "kind": "http_request", "frame_number": 18179, "timestamp_epoch": "1723682540.961052000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-39809c07556664f7255b72eb", "kind": "http_request", "frame_number": 18180, "timestamp_epoch": "1723682541.976598000", "src_ip": "10.8.15.133", "dst_ip": "239.255.255.250", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "http.host": "239.255.255.250:1900", "http.request.full_uri": "http://239.255.255.250:1900*", "http.request.method": "M-SEARCH", "http.request.uri": "*", "http.user_agent": "Microsoft Edge/127.0.2651.98 Windows" } }, { "event_id": "evt-a915ad5887a6819c63631ec1", "kind": "http_request", "frame_number": 18184, "timestamp_epoch": "1723682545.821716000", "src_ip": "10.8.15.133", "dst_ip": "72.5.43.29", "src_port": 50214, "dst_port": 80, "tcp_stream": 532, "udp_stream": null, "fields": { "http.host": "72.5.43.29", "http.request.full_uri": "http://72.5.43.29/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "18186", "http.user_agent": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" } } ], "http_response": [ { "event_id": "evt-193bd4771b6a520635621bfc", "kind": "http_response", "frame_number": 68, "timestamp_epoch": "1723680585.165344000", "src_ip": "23.205.110.48", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49671, "tcp_stream": 2, "udp_stream": null, "fields": { "http.content_length": "22", "http.content_type": "text/plain", "http.request_in": "66", "http.response.code": "200" } }, { "event_id": "evt-028e35d54d53b93f8013217e", "kind": "http_response", "frame_number": 8659, "timestamp_epoch": "1723680664.072398000", "src_ip": "104.21.55.70", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49785, "tcp_stream": 112, "udp_stream": null, "fields": { "http.content_type": "application/octet-stream", "http.request_in": "6418", "http.response.code": "200" } }, { "event_id": "evt-570130ad98b7675fc2d715ca", "kind": "http_response", "frame_number": 10200, "timestamp_epoch": "1723680685.833079000", "src_ip": "199.232.210.172", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49803, "tcp_stream": 127, "udp_stream": null, "fields": { "http.content_length": "15020", "http.content_type": "application/x-chrome-extension", "http.request_in": "10198", "http.response.code": "200" } }, { "event_id": "evt-8acbbcaa6cbd78bebb558518", "kind": "http_response", "frame_number": 10204, "timestamp_epoch": "1723680685.892703000", "src_ip": "199.232.210.172", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49803, "tcp_stream": 127, "udp_stream": null, "fields": { "http.content_length": "1120", "http.content_type": "application/x-chrome-extension", "http.request_in": "10201", "http.response.code": "206" } }, { "event_id": "evt-35de06346fafaf97e61f6158", "kind": "http_response", "frame_number": 10212, "timestamp_epoch": "1723680688.192857000", "src_ip": "199.232.210.172", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49803, "tcp_stream": 127, "udp_stream": null, "fields": { "http.content_length": "1340", "http.content_type": "application/x-chrome-extension", "http.request_in": "10209", "http.response.code": "206" } }, { "event_id": "evt-ff017c5da13a74fefd4134e6", "kind": "http_response", "frame_number": 10219, "timestamp_epoch": "1723680689.222985000", "src_ip": "199.232.210.172", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49803, "tcp_stream": 127, "udp_stream": null, "fields": { "http.content_length": "4630", "http.content_type": "application/x-chrome-extension", "http.request_in": "10214", "http.response.code": "206" } }, { "event_id": "evt-e6f2bab93e263b32750caeeb", "kind": "http_response", "frame_number": 10232, "timestamp_epoch": "1723680690.450285000", "src_ip": "199.232.210.172", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49803, "tcp_stream": 127, "udp_stream": null, "fields": { "http.content_length": "7930", "http.content_type": "application/x-chrome-extension", "http.request_in": "10222", "http.response.code": "206" } }, { "event_id": "evt-964ea1c3d652987072306c1b", "kind": "http_response", "frame_number": 10280, "timestamp_epoch": "1723680706.461505000", "src_ip": "199.232.210.172", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49803, "tcp_stream": 127, "udp_stream": null, "fields": { "http.content_length": "171224", "http.content_type": "application/x-chrome-extension", "http.request_in": "10278", "http.response.code": "200" } }, { "event_id": "evt-5b20ab1e76bc7f59053de4a6", "kind": "http_response", "frame_number": 10306, "timestamp_epoch": "1723680706.583793000", "src_ip": "199.232.210.172", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49803, "tcp_stream": 127, "udp_stream": null, "fields": { "http.content_length": "18882", "http.content_type": "application/x-chrome-extension", "http.request_in": "10284", "http.response.code": "206" } }, { "event_id": "evt-726e6497a5d95a21649205ee", "kind": "http_response", "frame_number": 10425, "timestamp_epoch": "1723680708.926647000", "src_ip": "199.232.210.172", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49803, "tcp_stream": 127, "udp_stream": null, "fields": { "http.content_length": "13809", "http.content_type": "application/x-chrome-extension", "http.request_in": "10407", "http.response.code": "206" } }, { "event_id": "evt-f55c3b2d7ff832e8087b52f6", "kind": "http_response", "frame_number": 10478, "timestamp_epoch": "1723680710.037906000", "src_ip": "199.232.210.172", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49803, "tcp_stream": 127, "udp_stream": null, "fields": { "http.content_length": "29990", "http.content_type": "application/x-chrome-extension", "http.request_in": "10454", "http.response.code": "206" } }, { "event_id": "evt-38e31542127875b62db8980a", "kind": "http_response", "frame_number": 10579, "timestamp_epoch": "1723680711.138422000", "src_ip": "199.232.210.172", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49803, "tcp_stream": 127, "udp_stream": null, "fields": { "http.content_length": "108543", "http.content_type": "application/x-chrome-extension", "http.request_in": "10483", "http.response.code": "206" } }, { "event_id": "evt-0c5397dee6ff2c0a9c1f9b35", "kind": "http_response", "frame_number": 10613, "timestamp_epoch": "1723680719.937220000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49810, "tcp_stream": 134, "udp_stream": null, "fields": { "http.content_length": "159232", "http.request_in": "10611", "http.response.code": "200" } }, { "event_id": "evt-57ffb81413fe3610be0d0612", "kind": "http_response", "frame_number": 10762, "timestamp_epoch": "1723680720.702573000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49810, "tcp_stream": 134, "udp_stream": null, "fields": { "http.content_length": "159232", "http.content_type": "text/html; charset=ISO-8859-1", "http.request_in": "10614", "http.response.code": "200" } }, { "event_id": "evt-0cc6219bc461f543309aba34", "kind": "http_response", "frame_number": 11030, "timestamp_epoch": "1723680780.857459000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49818, "tcp_stream": 142, "udp_stream": null, "fields": { "http.content_length": "32", "http.content_type": "text/html; charset=ISO-8859-1", "http.request_in": "11028", "http.response.code": "200" } }, { "event_id": "evt-8e0df75d99c760ca383789b8", "kind": "http_response", "frame_number": 11034, "timestamp_epoch": "1723680781.053740000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49818, "tcp_stream": 142, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "11032", "http.response.code": "400" } }, { "event_id": "evt-aa9074641b6f03223b27d03a", "kind": "http_response", "frame_number": 11485, "timestamp_epoch": "1723680782.677557000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49819, "tcp_stream": 143, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "11463", "http.response.code": "400" } }, { "event_id": "evt-a026d36ed7b20a5c010b2316", "kind": "http_response", "frame_number": 11498, "timestamp_epoch": "1723680783.233521000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49820, "tcp_stream": 144, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "11496", "http.response.code": "400" } }, { "event_id": "evt-756c9474ae066d26f2b22e24", "kind": "http_response", "frame_number": 11507, "timestamp_epoch": "1723680788.203139000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49821, "tcp_stream": 145, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "11505", "http.response.code": "400" } }, { "event_id": "evt-f6cca5930a15907207b3ac11", "kind": "http_response", "frame_number": 11621, "timestamp_epoch": "1723680794.043693000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49827, "tcp_stream": 151, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "11619", "http.response.code": "400" } }, { "event_id": "evt-0425d789978a7653e55bec7f", "kind": "http_response", "frame_number": 11692, "timestamp_epoch": "1723680797.503433000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49831, "tcp_stream": 155, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "11688", "http.response.code": "400" } }, { "event_id": "evt-40f073067e59a5540a7ec56a", "kind": "http_response", "frame_number": 11964, "timestamp_epoch": "1723680804.443018000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49840, "tcp_stream": 164, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "11962", "http.response.code": "400" } }, { "event_id": "evt-3e8442410ad6746c8ce9d6af", "kind": "http_response", "frame_number": 11976, "timestamp_epoch": "1723680810.131518000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49841, "tcp_stream": 165, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "11974", "http.response.code": "400" } }, { "event_id": "evt-434c2d3d91570ffa219ec773", "kind": "http_response", "frame_number": 11995, "timestamp_epoch": "1723680817.374759000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49842, "tcp_stream": 166, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "11993", "http.response.code": "400" } }, { "event_id": "evt-31db5c474304d2a6bf3ebdae", "kind": "http_response", "frame_number": 12009, "timestamp_epoch": "1723680824.298520000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49843, "tcp_stream": 167, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "12004", "http.response.code": "400" } }, { "event_id": "evt-5fc5ceb1aeeaf8da0bf3db84", "kind": "http_response", "frame_number": 12023, "timestamp_epoch": "1723680829.378776000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49844, "tcp_stream": 168, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "12017", "http.response.code": "400" } }, { "event_id": "evt-3c6ffdc7406676a9b24b38f0", "kind": "http_response", "frame_number": 12034, "timestamp_epoch": "1723680835.403245000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49845, "tcp_stream": 169, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "12032", "http.response.code": "400" } }, { "event_id": "evt-7f4759579f60469a9a36c5c0", "kind": "http_response", "frame_number": 12047, "timestamp_epoch": "1723680839.278919000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49846, "tcp_stream": 170, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "12045", "http.response.code": "400" } }, { "event_id": "evt-5dc80e7d746e96e634030297", "kind": "http_response", "frame_number": 12062, "timestamp_epoch": "1723680843.962310000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49847, "tcp_stream": 171, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "12060", "http.response.code": "400" } }, { "event_id": "evt-841a65a5d81ce98373e37fb8", "kind": "http_response", "frame_number": 12074, "timestamp_epoch": "1723680848.182985000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49848, "tcp_stream": 172, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "12072", "http.response.code": "400" } }, { "event_id": "evt-5ba416a87d1f7b20e2bf5158", "kind": "http_response", "frame_number": 12089, "timestamp_epoch": "1723680852.558584000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49849, "tcp_stream": 173, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "12087", "http.response.code": "400" } }, { "event_id": "evt-768b3893de7848632b04f32d", "kind": "http_response", "frame_number": 12098, "timestamp_epoch": "1723680857.196692000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49850, "tcp_stream": 174, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "12096", "http.response.code": "400" } }, { "event_id": "evt-5d3030fe68fe86160cfe2af7", "kind": "http_response", "frame_number": 12147, "timestamp_epoch": "1723680862.383609000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49852, "tcp_stream": 176, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "12141", "http.response.code": "400" } }, { "event_id": "evt-d0d156efb213f2ee34d8eca7", "kind": "http_response", "frame_number": 12156, "timestamp_epoch": "1723680868.673845000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49853, "tcp_stream": 177, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "12154", "http.response.code": "400" } }, { "event_id": "evt-ca788fc4290bd0c788f853fa", "kind": "http_response", "frame_number": 12166, "timestamp_epoch": "1723680873.595387000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49854, "tcp_stream": 178, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "12164", "http.response.code": "400" } }, { "event_id": "evt-41ef0486719914af9b24707e", "kind": "http_response", "frame_number": 12177, "timestamp_epoch": "1723680879.329734000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49855, "tcp_stream": 179, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "12175", "http.response.code": "400" } }, { "event_id": "evt-b2dbb318ac17f48ab3ae8fda", "kind": "http_response", "frame_number": 12188, "timestamp_epoch": "1723680886.773069000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49856, "tcp_stream": 180, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "12186", "http.response.code": "400" } }, { "event_id": "evt-1dceabaa81d98045d94e1896", "kind": "http_response", "frame_number": 12202, "timestamp_epoch": "1723680894.535924000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49857, "tcp_stream": 181, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "12200", "http.response.code": "400" } }, { "event_id": "evt-680d78c30235e2be11556990", "kind": "http_response", "frame_number": 12244, "timestamp_epoch": "1723680900.203975000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49859, "tcp_stream": 183, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "12242", "http.response.code": "400" } }, { "event_id": "evt-ca9fd0d264f3489e0cbc87f5", "kind": "http_response", "frame_number": 12255, "timestamp_epoch": "1723680907.450663000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49860, "tcp_stream": 184, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "12253", "http.response.code": "400" } }, { "event_id": "evt-370a8b36b7c7064ce4140488", "kind": "http_response", "frame_number": 13433, "timestamp_epoch": "1723680913.766964000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49882, "tcp_stream": 206, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "13263", "http.response.code": "400" } }, { "event_id": "evt-2694402e7fec8de521277f07", "kind": "http_response", "frame_number": 13591, "timestamp_epoch": "1723680918.182761000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49883, "tcp_stream": 207, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "13589", "http.response.code": "400" } }, { "event_id": "evt-8615912e2dcff746855165dc", "kind": "http_response", "frame_number": 13626, "timestamp_epoch": "1723680969.308860000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49884, "tcp_stream": 208, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "13609", "http.response.code": "400" } }, { "event_id": "evt-2463eee47c0becc2095443ac", "kind": "http_response", "frame_number": 13637, "timestamp_epoch": "1723680976.002389000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49885, "tcp_stream": 209, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "13635", "http.response.code": "400" } }, { "event_id": "evt-8e0fabdef17d71db0704805f", "kind": "http_response", "frame_number": 13657, "timestamp_epoch": "1723680982.854454000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49886, "tcp_stream": 210, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "13655", "http.response.code": "400" } }, { "event_id": "evt-4fdc614df706c2811434b262", "kind": "http_response", "frame_number": 13741, "timestamp_epoch": "1723680986.713240000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49891, "tcp_stream": 215, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "13739", "http.response.code": "400" } }, { "event_id": "evt-3fc572615223608261f61f83", "kind": "http_response", "frame_number": 14052, "timestamp_epoch": "1723680990.584062000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49898, "tcp_stream": 222, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "13911", "http.response.code": "400" } }, { "event_id": "evt-c19b675e45b24218876dfdee", "kind": "http_response", "frame_number": 14072, "timestamp_epoch": "1723680995.031857000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49901, "tcp_stream": 225, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14070", "http.response.code": "400" } }, { "event_id": "evt-4707502d5e2af104e8fa7c80", "kind": "http_response", "frame_number": 14093, "timestamp_epoch": "1723681000.887154000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49902, "tcp_stream": 226, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14091", "http.response.code": "400" } }, { "event_id": "evt-61e5aa122ffd16e737086476", "kind": "http_response", "frame_number": 14140, "timestamp_epoch": "1723681006.417701000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49904, "tcp_stream": 228, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14138", "http.response.code": "400" } }, { "event_id": "evt-516b8f4474c30c8e02d23460", "kind": "http_response", "frame_number": 14180, "timestamp_epoch": "1723681013.382683000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49906, "tcp_stream": 230, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14178", "http.response.code": "400" } }, { "event_id": "evt-5ca69cb697be9531055bdc9a", "kind": "http_response", "frame_number": 14191, "timestamp_epoch": "1723681019.104220000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49907, "tcp_stream": 231, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14189", "http.response.code": "400" } }, { "event_id": "evt-583948a05fc801ae7394888d", "kind": "http_response", "frame_number": 14203, "timestamp_epoch": "1723681026.460848000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49908, "tcp_stream": 232, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14201", "http.response.code": "400" } }, { "event_id": "evt-2793369a2fcdd03d0f29de1e", "kind": "http_response", "frame_number": 14212, "timestamp_epoch": "1723681032.981942000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49909, "tcp_stream": 233, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14210", "http.response.code": "400" } }, { "event_id": "evt-de4af993845bc513bc163b26", "kind": "http_response", "frame_number": 14228, "timestamp_epoch": "1723681037.820370000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49910, "tcp_stream": 234, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14221", "http.response.code": "400" } }, { "event_id": "evt-f4977ba63976faae23a059cc", "kind": "http_response", "frame_number": 14256, "timestamp_epoch": "1723681043.418467000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49912, "tcp_stream": 236, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14254", "http.response.code": "400" } }, { "event_id": "evt-6ff0029c0f5c98be9c90368f", "kind": "http_response", "frame_number": 14265, "timestamp_epoch": "1723681050.519859000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49913, "tcp_stream": 237, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14263", "http.response.code": "400" } }, { "event_id": "evt-2450c63331f6e6de037e3f82", "kind": "http_response", "frame_number": 14274, "timestamp_epoch": "1723681056.502680000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49914, "tcp_stream": 238, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14272", "http.response.code": "400" } }, { "event_id": "evt-a04e9320e5123e9f9370ac0d", "kind": "http_response", "frame_number": 14283, "timestamp_epoch": "1723681060.291788000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49915, "tcp_stream": 239, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14281", "http.response.code": "400" } }, { "event_id": "evt-5c0c9a091e4d3905d2e707af", "kind": "http_response", "frame_number": 14292, "timestamp_epoch": "1723681063.781368000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49916, "tcp_stream": 240, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14290", "http.response.code": "400" } }, { "event_id": "evt-5b7a22c94074d38d293be1f0", "kind": "http_response", "frame_number": 14303, "timestamp_epoch": "1723681070.759075000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49917, "tcp_stream": 241, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14301", "http.response.code": "400" } }, { "event_id": "evt-40ab46e92862c3c577ba0283", "kind": "http_response", "frame_number": 14314, "timestamp_epoch": "1723681076.519712000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49918, "tcp_stream": 242, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14312", "http.response.code": "400" } }, { "event_id": "evt-002177564521de62570e986e", "kind": "http_response", "frame_number": 14326, "timestamp_epoch": "1723681083.943483000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49919, "tcp_stream": 243, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14324", "http.response.code": "400" } }, { "event_id": "evt-fae65a481c9352fe107a401d", "kind": "http_response", "frame_number": 14337, "timestamp_epoch": "1723681090.582384000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49920, "tcp_stream": 244, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14335", "http.response.code": "400" } }, { "event_id": "evt-7595e64efef26511e59aec55", "kind": "http_response", "frame_number": 14346, "timestamp_epoch": "1723681095.661712000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49921, "tcp_stream": 245, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14344", "http.response.code": "400" } }, { "event_id": "evt-852463f7afd95361726d2759", "kind": "http_response", "frame_number": 14360, "timestamp_epoch": "1723681101.733547000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49922, "tcp_stream": 246, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14358", "http.response.code": "400" } }, { "event_id": "evt-5980651433dc546a4f4e0660", "kind": "http_response", "frame_number": 14375, "timestamp_epoch": "1723681105.691928000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49923, "tcp_stream": 247, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14373", "http.response.code": "400" } }, { "event_id": "evt-8abfedb381c5cb9b5b99f9f6", "kind": "http_response", "frame_number": 14385, "timestamp_epoch": "1723681109.521795000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49924, "tcp_stream": 248, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14383", "http.response.code": "400" } }, { "event_id": "evt-1b4ff0410dceaad2b5b63b58", "kind": "http_response", "frame_number": 14396, "timestamp_epoch": "1723681113.071669000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49925, "tcp_stream": 249, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14394", "http.response.code": "400" } }, { "event_id": "evt-85ff13bf0b6c172a6ae34d3d", "kind": "http_response", "frame_number": 14408, "timestamp_epoch": "1723681120.182396000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49926, "tcp_stream": 250, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14406", "http.response.code": "400" } }, { "event_id": "evt-9c58ebbde1af4333d5c7ca0c", "kind": "http_response", "frame_number": 14417, "timestamp_epoch": "1723681126.210109000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49927, "tcp_stream": 251, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14415", "http.response.code": "400" } }, { "event_id": "evt-44589f5e781a8a4b3b0e2109", "kind": "http_response", "frame_number": 14426, "timestamp_epoch": "1723681130.050609000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49928, "tcp_stream": 252, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14424", "http.response.code": "400" } }, { "event_id": "evt-e84d0d6f2c280d2e34b80bd0", "kind": "http_response", "frame_number": 14439, "timestamp_epoch": "1723681133.641909000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49929, "tcp_stream": 253, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14437", "http.response.code": "400" } }, { "event_id": "evt-b0e958e581852657e8d95b13", "kind": "http_response", "frame_number": 14452, "timestamp_epoch": "1723681140.854822000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49930, "tcp_stream": 254, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14450", "http.response.code": "400" } }, { "event_id": "evt-bb65270397ab1702edb15fd2", "kind": "http_response", "frame_number": 14461, "timestamp_epoch": "1723681147.087316000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49931, "tcp_stream": 255, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14459", "http.response.code": "400" } }, { "event_id": "evt-e3c49b6220a1da4790722d61", "kind": "http_response", "frame_number": 14472, "timestamp_epoch": "1723681151.342089000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49934, "tcp_stream": 256, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14470", "http.response.code": "400" } }, { "event_id": "evt-bbd0bd9d49f4ce750cc8d7b5", "kind": "http_response", "frame_number": 14662, "timestamp_epoch": "1723681155.751257000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49940, "tcp_stream": 261, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14647", "http.response.code": "400" } }, { "event_id": "evt-ea66abff15f5803d04929123", "kind": "http_response", "frame_number": 14677, "timestamp_epoch": "1723681160.485157000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49942, "tcp_stream": 263, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14675", "http.response.code": "400" } }, { "event_id": "evt-40ac188db9ae65eec445e9ba", "kind": "http_response", "frame_number": 14700, "timestamp_epoch": "1723681166.102021000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49943, "tcp_stream": 264, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14698", "http.response.code": "400" } }, { "event_id": "evt-ab49e35f4759a790e8e5d688", "kind": "http_response", "frame_number": 14709, "timestamp_epoch": "1723681172.983916000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49944, "tcp_stream": 265, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14707", "http.response.code": "400" } }, { "event_id": "evt-82eff0486ad36c0619a6f907", "kind": "http_response", "frame_number": 14721, "timestamp_epoch": "1723681180.071949000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49945, "tcp_stream": 266, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14719", "http.response.code": "400" } }, { "event_id": "evt-3ce2d12fa3967cc2792eeb53", "kind": "http_response", "frame_number": 14738, "timestamp_epoch": "1723681185.058349000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49946, "tcp_stream": 267, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14736", "http.response.code": "400" } }, { "event_id": "evt-9125bc488faaa80a041a4709", "kind": "http_response", "frame_number": 14762, "timestamp_epoch": "1723681190.401162000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49947, "tcp_stream": 268, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14760", "http.response.code": "400" } }, { "event_id": "evt-7c479b435200c2045d32b328", "kind": "http_response", "frame_number": 14794, "timestamp_epoch": "1723681197.020885000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49949, "tcp_stream": 270, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14792", "http.response.code": "400" } }, { "event_id": "evt-3d09d62bf559528c7fea8fa6", "kind": "http_response", "frame_number": 14808, "timestamp_epoch": "1723681202.096593000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49950, "tcp_stream": 271, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14806", "http.response.code": "400" } }, { "event_id": "evt-50849c4b88d9784301d350ee", "kind": "http_response", "frame_number": 14923, "timestamp_epoch": "1723681209.769590000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49951, "tcp_stream": 272, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14921", "http.response.code": "400" } }, { "event_id": "evt-349766d2cbb4e5f09856936b", "kind": "http_response", "frame_number": 14964, "timestamp_epoch": "1723681215.261715000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49953, "tcp_stream": 274, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14962", "http.response.code": "400" } }, { "event_id": "evt-afc5cce0fb920b0ea9c9f09d", "kind": "http_response", "frame_number": 14981, "timestamp_epoch": "1723681222.150730000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49954, "tcp_stream": 275, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14979", "http.response.code": "400" } }, { "event_id": "evt-5396c25ce95f3805dbca8d87", "kind": "http_response", "frame_number": 14991, "timestamp_epoch": "1723681227.763927000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49955, "tcp_stream": 276, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14989", "http.response.code": "400" } }, { "event_id": "evt-bde63a67c250b0c957c12197", "kind": "http_response", "frame_number": 15001, "timestamp_epoch": "1723681234.901210000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49956, "tcp_stream": 277, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "14999", "http.response.code": "400" } }, { "event_id": "evt-c361188b7f4965f91e4da615", "kind": "http_response", "frame_number": 15012, "timestamp_epoch": "1723681240.955386000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49957, "tcp_stream": 278, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15010", "http.response.code": "400" } }, { "event_id": "evt-771859fc3f8df3afe8c54bbe", "kind": "http_response", "frame_number": 15023, "timestamp_epoch": "1723681244.871167000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49958, "tcp_stream": 279, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15021", "http.response.code": "400" } }, { "event_id": "evt-575ba9de3c8e86d1f8c0dfbf", "kind": "http_response", "frame_number": 15039, "timestamp_epoch": "1723681250.642103000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49959, "tcp_stream": 280, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15037", "http.response.code": "400" } }, { "event_id": "evt-3acbf67652e1cc27d29a17bd", "kind": "http_response", "frame_number": 15049, "timestamp_epoch": "1723681256.031105000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49960, "tcp_stream": 281, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15047", "http.response.code": "400" } }, { "event_id": "evt-4ecc7f91b0cc186137c3f621", "kind": "http_response", "frame_number": 15062, "timestamp_epoch": "1723681262.979285000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49961, "tcp_stream": 282, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15060", "http.response.code": "400" } }, { "event_id": "evt-f1bb5a6cd366c3909be49028", "kind": "http_response", "frame_number": 15080, "timestamp_epoch": "1723681269.840824000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49962, "tcp_stream": 283, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15078", "http.response.code": "400" } }, { "event_id": "evt-3a6185fe4d29accf7b8f515d", "kind": "http_response", "frame_number": 15091, "timestamp_epoch": "1723681274.069891000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49963, "tcp_stream": 284, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15089", "http.response.code": "400" } }, { "event_id": "evt-eac0d9ccbd58eac8e78e7666", "kind": "http_response", "frame_number": 15100, "timestamp_epoch": "1723681278.301800000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49964, "tcp_stream": 285, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15098", "http.response.code": "400" } }, { "event_id": "evt-2c68dc69deca5b0c1384343c", "kind": "http_response", "frame_number": 15140, "timestamp_epoch": "1723681282.912793000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49965, "tcp_stream": 286, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15122", "http.response.code": "400" } }, { "event_id": "evt-c1c1dfd989015661682116a9", "kind": "http_response", "frame_number": 15172, "timestamp_epoch": "1723681287.813573000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49967, "tcp_stream": 288, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15170", "http.response.code": "400" } }, { "event_id": "evt-413a8c57acedd9242f06e6b3", "kind": "http_response", "frame_number": 15208, "timestamp_epoch": "1723681295.066428000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49969, "tcp_stream": 290, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15206", "http.response.code": "400" } }, { "event_id": "evt-2c317fbb67dfa3566b255b0c", "kind": "http_response", "frame_number": 15219, "timestamp_epoch": "1723681299.829262000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49973, "tcp_stream": 291, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15217", "http.response.code": "400" } }, { "event_id": "evt-3e9ecc4e01166d83e9158d15", "kind": "http_response", "frame_number": 15252, "timestamp_epoch": "1723681305.234882000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49976, "tcp_stream": 294, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15250", "http.response.code": "400" } }, { "event_id": "evt-254eb8b65a80564b1e658c80", "kind": "http_response", "frame_number": 15262, "timestamp_epoch": "1723681311.971756000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49977, "tcp_stream": 295, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15260", "http.response.code": "400" } }, { "event_id": "evt-ae6e2ef9918bde23152dc879", "kind": "http_response", "frame_number": 15313, "timestamp_epoch": "1723681318.728684000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49979, "tcp_stream": 297, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15311", "http.response.code": "400" } }, { "event_id": "evt-422d729c2df4df27a35b05e3", "kind": "http_response", "frame_number": 15322, "timestamp_epoch": "1723681323.081957000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49980, "tcp_stream": 298, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15320", "http.response.code": "400" } }, { "event_id": "evt-2438f5612c61d8daea02ce10", "kind": "http_response", "frame_number": 15334, "timestamp_epoch": "1723681328.787404000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49981, "tcp_stream": 299, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15332", "http.response.code": "400" } }, { "event_id": "evt-08823f5d818a524c9632a625", "kind": "http_response", "frame_number": 15347, "timestamp_epoch": "1723681329.928739000", "src_ip": "23.220.251.208", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49982, "tcp_stream": 300, "udp_stream": null, "fields": { "http.content_length": "4", "http.content_type": "text/plain; charset=UTF-8", "http.request_in": "15345", "http.response.code": "200" } }, { "event_id": "evt-7e994bea5465eeaee682bcea", "kind": "http_response", "frame_number": 15377, "timestamp_epoch": "1723681334.469282000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49984, "tcp_stream": 302, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15375", "http.response.code": "400" } }, { "event_id": "evt-dd06919bdfe810cac7d51fdc", "kind": "http_response", "frame_number": 15393, "timestamp_epoch": "1723681341.762156000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49985, "tcp_stream": 303, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15391", "http.response.code": "400" } }, { "event_id": "evt-6a11f097b6f0aa10223ecda2", "kind": "http_response", "frame_number": 15407, "timestamp_epoch": "1723681348.135930000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49986, "tcp_stream": 304, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15405", "http.response.code": "400" } }, { "event_id": "evt-4f49d353199bc86f66236d36", "kind": "http_response", "frame_number": 15416, "timestamp_epoch": "1723681352.677441000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49987, "tcp_stream": 305, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15414", "http.response.code": "400" } }, { "event_id": "evt-1fbfdeab32643b9aeafcec92", "kind": "http_response", "frame_number": 15425, "timestamp_epoch": "1723681357.703887000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49988, "tcp_stream": 306, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15423", "http.response.code": "400" } }, { "event_id": "evt-1d4c87be02fb8aa6d0581d85", "kind": "http_response", "frame_number": 15436, "timestamp_epoch": "1723681363.616774000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49989, "tcp_stream": 307, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15434", "http.response.code": "400" } }, { "event_id": "evt-b0c117befbc97f8bfa781323", "kind": "http_response", "frame_number": 15445, "timestamp_epoch": "1723681367.807486000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49990, "tcp_stream": 308, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15443", "http.response.code": "400" } }, { "event_id": "evt-d1cf995de01d571dd4e6f829", "kind": "http_response", "frame_number": 15456, "timestamp_epoch": "1723681373.025453000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49991, "tcp_stream": 309, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15454", "http.response.code": "400" } }, { "event_id": "evt-7701f7ea150a2035ca0c89f2", "kind": "http_response", "frame_number": 15465, "timestamp_epoch": "1723681377.922147000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49992, "tcp_stream": 310, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15463", "http.response.code": "400" } }, { "event_id": "evt-6c5cb03f409b717c4bd3c9a1", "kind": "http_response", "frame_number": 15494, "timestamp_epoch": "1723681383.576103000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49994, "tcp_stream": 312, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15492", "http.response.code": "400" } }, { "event_id": "evt-f2b0cf0eeb2758a9b4a546e8", "kind": "http_response", "frame_number": 15510, "timestamp_epoch": "1723681390.811527000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49995, "tcp_stream": 313, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15508", "http.response.code": "400" } }, { "event_id": "evt-07c1cf0483fd9c1dc865f8c4", "kind": "http_response", "frame_number": 15519, "timestamp_epoch": "1723681397.056100000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49996, "tcp_stream": 314, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15517", "http.response.code": "400" } }, { "event_id": "evt-12395b1aee3eec9c5b89cf1f", "kind": "http_response", "frame_number": 15528, "timestamp_epoch": "1723681401.405016000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49997, "tcp_stream": 315, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15526", "http.response.code": "400" } }, { "event_id": "evt-c476de8aece4d62fb84d152d", "kind": "http_response", "frame_number": 15538, "timestamp_epoch": "1723681405.953902000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49998, "tcp_stream": 316, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15536", "http.response.code": "400" } }, { "event_id": "evt-3ca57d9998e476432d2c88cb", "kind": "http_response", "frame_number": 15551, "timestamp_epoch": "1723681410.967012000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 49999, "tcp_stream": 317, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15549", "http.response.code": "400" } }, { "event_id": "evt-62cb5a0f2a88261baafe1573", "kind": "http_response", "frame_number": 15560, "timestamp_epoch": "1723681416.915933000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50000, "tcp_stream": 318, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15558", "http.response.code": "400" } }, { "event_id": "evt-0f0c2d005be120f554a75213", "kind": "http_response", "frame_number": 15571, "timestamp_epoch": "1723681420.622574000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50001, "tcp_stream": 319, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15569", "http.response.code": "400" } }, { "event_id": "evt-b9bff3245813859db62db074", "kind": "http_response", "frame_number": 15582, "timestamp_epoch": "1723681428.641582000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50002, "tcp_stream": 320, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15580", "http.response.code": "400" } }, { "event_id": "evt-81fdb379772531a0d03175c1", "kind": "http_response", "frame_number": 15595, "timestamp_epoch": "1723681435.868923000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50003, "tcp_stream": 321, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15593", "http.response.code": "400" } }, { "event_id": "evt-4c94723637f40030e6eef5c1", "kind": "http_response", "frame_number": 15610, "timestamp_epoch": "1723681442.146497000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50004, "tcp_stream": 322, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15608", "http.response.code": "400" } }, { "event_id": "evt-0124ace22218a84bb76c6610", "kind": "http_response", "frame_number": 15619, "timestamp_epoch": "1723681446.504768000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50005, "tcp_stream": 323, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15617", "http.response.code": "400" } }, { "event_id": "evt-3540d85d74793d292c732ee5", "kind": "http_response", "frame_number": 15630, "timestamp_epoch": "1723681451.134293000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50006, "tcp_stream": 324, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15628", "http.response.code": "400" } }, { "event_id": "evt-9f87e283c18fcccb16a3e1b1", "kind": "http_response", "frame_number": 15641, "timestamp_epoch": "1723681456.556006000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50007, "tcp_stream": 325, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15639", "http.response.code": "400" } }, { "event_id": "evt-8e94f8546f3b5e938e91a3cd", "kind": "http_response", "frame_number": 15655, "timestamp_epoch": "1723681464.087498000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50008, "tcp_stream": 326, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15653", "http.response.code": "400" } }, { "event_id": "evt-a69e7f0add8577a25aa966e2", "kind": "http_response", "frame_number": 15664, "timestamp_epoch": "1723681469.913401000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50009, "tcp_stream": 327, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15662", "http.response.code": "400" } }, { "event_id": "evt-a292611f39aa8a44f199247e", "kind": "http_response", "frame_number": 15674, "timestamp_epoch": "1723681473.376877000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50010, "tcp_stream": 328, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15672", "http.response.code": "400" } }, { "event_id": "evt-b18f1a0637511eb1e0dd99eb", "kind": "http_response", "frame_number": 15688, "timestamp_epoch": "1723681481.989408000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50011, "tcp_stream": 329, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15686", "http.response.code": "400" } }, { "event_id": "evt-0af8216d31ba20a073bb8b6b", "kind": "http_response", "frame_number": 15718, "timestamp_epoch": "1723681489.324880000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50013, "tcp_stream": 331, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15716", "http.response.code": "400" } }, { "event_id": "evt-b45ab67c296c58ea63e6bc4a", "kind": "http_response", "frame_number": 15729, "timestamp_epoch": "1723681496.431377000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50014, "tcp_stream": 332, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15727", "http.response.code": "400" } }, { "event_id": "evt-9a572357cc53abab16000745", "kind": "http_response", "frame_number": 15745, "timestamp_epoch": "1723681501.856496000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50015, "tcp_stream": 333, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15743", "http.response.code": "400" } }, { "event_id": "evt-fb6b9e37362b3e3bf7a42bb3", "kind": "http_response", "frame_number": 15754, "timestamp_epoch": "1723681508.578282000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50016, "tcp_stream": 334, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15752", "http.response.code": "400" } }, { "event_id": "evt-c95b2436106952b47da71915", "kind": "http_response", "frame_number": 15861, "timestamp_epoch": "1723681513.831719000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50019, "tcp_stream": 337, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15859", "http.response.code": "400" } }, { "event_id": "evt-f54ebc3377d848161c18615f", "kind": "http_response", "frame_number": 15887, "timestamp_epoch": "1723681517.732902000", "src_ip": "204.79.197.203", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50021, "tcp_stream": 339, "udp_stream": null, "fields": { "http.content_length": "1782", "http.content_type": "application/ocsp-response", "http.request_in": "15884", "http.response.code": "200" } }, { "event_id": "evt-53b176fe783cde4891936a89", "kind": "http_response", "frame_number": 15908, "timestamp_epoch": "1723681520.220827000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50022, "tcp_stream": 340, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15906", "http.response.code": "400" } }, { "event_id": "evt-7c3b38009522c4330f2b82bd", "kind": "http_response", "frame_number": 15917, "timestamp_epoch": "1723681524.825413000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50023, "tcp_stream": 341, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15915", "http.response.code": "400" } }, { "event_id": "evt-fbedb0cd7017a7c4d101766f", "kind": "http_response", "frame_number": 15927, "timestamp_epoch": "1723681529.949598000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50024, "tcp_stream": 342, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15925", "http.response.code": "400" } }, { "event_id": "evt-57628536dd2503e35e351365", "kind": "http_response", "frame_number": 15938, "timestamp_epoch": "1723681536.106507000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50025, "tcp_stream": 343, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15936", "http.response.code": "400" } }, { "event_id": "evt-7755f0ecfca67b50542e4f9e", "kind": "http_response", "frame_number": 15947, "timestamp_epoch": "1723681540.204598000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50026, "tcp_stream": 344, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "15945", "http.response.code": "400" } }, { "event_id": "evt-0686dd69d64eaf4b0766ab64", "kind": "http_response", "frame_number": 16025, "timestamp_epoch": "1723681544.346361000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50030, "tcp_stream": 348, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16023", "http.response.code": "400" } }, { "event_id": "evt-0562c123691ec90e49f4b7da", "kind": "http_response", "frame_number": 16036, "timestamp_epoch": "1723681548.507379000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50031, "tcp_stream": 349, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16034", "http.response.code": "400" } }, { "event_id": "evt-e5e5f6406cb960c0bf17adeb", "kind": "http_response", "frame_number": 16049, "timestamp_epoch": "1723681552.716856000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50032, "tcp_stream": 350, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16047", "http.response.code": "400" } }, { "event_id": "evt-798329a8c00154635594007e", "kind": "http_response", "frame_number": 16058, "timestamp_epoch": "1723681557.057147000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50033, "tcp_stream": 351, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16056", "http.response.code": "400" } }, { "event_id": "evt-d9287624e22bdf3ff7f9eba4", "kind": "http_response", "frame_number": 16067, "timestamp_epoch": "1723681561.637397000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50034, "tcp_stream": 352, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16065", "http.response.code": "400" } }, { "event_id": "evt-364cd6479a0ebd64cbe657fc", "kind": "http_response", "frame_number": 16078, "timestamp_epoch": "1723681566.709851000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50035, "tcp_stream": 353, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16076", "http.response.code": "400" } }, { "event_id": "evt-1c404f4cbd5bc31f8de011ef", "kind": "http_response", "frame_number": 16089, "timestamp_epoch": "1723681574.456510000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50036, "tcp_stream": 354, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16087", "http.response.code": "400" } }, { "event_id": "evt-f70958e743a6a382177d8e4d", "kind": "http_response", "frame_number": 16106, "timestamp_epoch": "1723681581.989892000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50037, "tcp_stream": 355, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16102", "http.response.code": "400" } }, { "event_id": "evt-2ccf845f4cd29faf1dca7d1a", "kind": "http_response", "frame_number": 16117, "timestamp_epoch": "1723681587.714531000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50038, "tcp_stream": 356, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16115", "http.response.code": "400" } }, { "event_id": "evt-160cfaae457f8ae73bc9901b", "kind": "http_response", "frame_number": 16126, "timestamp_epoch": "1723681595.050845000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50039, "tcp_stream": 357, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16124", "http.response.code": "400" } }, { "event_id": "evt-7d7758ab49ddaf5b2c75d099", "kind": "http_response", "frame_number": 16135, "timestamp_epoch": "1723681600.744962000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50040, "tcp_stream": 358, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16133", "http.response.code": "400" } }, { "event_id": "evt-f1dc49c11f8190ec70f13035", "kind": "http_response", "frame_number": 16145, "timestamp_epoch": "1723681609.113363000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50041, "tcp_stream": 359, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16143", "http.response.code": "400" } }, { "event_id": "evt-a9750ea1b2a26ad108f8cc18", "kind": "http_response", "frame_number": 16156, "timestamp_epoch": "1723681617.115287000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50042, "tcp_stream": 360, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16154", "http.response.code": "400" } }, { "event_id": "evt-b6c20ac343ba029ee5a4f43e", "kind": "http_response", "frame_number": 16171, "timestamp_epoch": "1723681624.410838000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50043, "tcp_stream": 361, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16167", "http.response.code": "400" } }, { "event_id": "evt-55985d7d6d3ac78d1913eab4", "kind": "http_response", "frame_number": 16182, "timestamp_epoch": "1723681630.796674000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50044, "tcp_stream": 362, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16180", "http.response.code": "400" } }, { "event_id": "evt-8788f3182a99c73589fe8e67", "kind": "http_response", "frame_number": 16193, "timestamp_epoch": "1723681635.391518000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50045, "tcp_stream": 363, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16191", "http.response.code": "400" } }, { "event_id": "evt-0f15733feea9366fb93e810d", "kind": "http_response", "frame_number": 16204, "timestamp_epoch": "1723681640.477216000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50046, "tcp_stream": 364, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16202", "http.response.code": "400" } }, { "event_id": "evt-f5f13cdd6819bc8213c0b18d", "kind": "http_response", "frame_number": 16213, "timestamp_epoch": "1723681646.536811000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50047, "tcp_stream": 365, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16211", "http.response.code": "400" } }, { "event_id": "evt-0af2d5dd856845fb2878620b", "kind": "http_response", "frame_number": 16224, "timestamp_epoch": "1723681650.489843000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50048, "tcp_stream": 366, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16222", "http.response.code": "400" } }, { "event_id": "evt-410a9b2eeb093f8c95865ef8", "kind": "http_response", "frame_number": 16233, "timestamp_epoch": "1723681654.297144000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50049, "tcp_stream": 367, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16231", "http.response.code": "400" } }, { "event_id": "evt-08b661052c71482d745474c4", "kind": "http_response", "frame_number": 16246, "timestamp_epoch": "1723681657.808369000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50050, "tcp_stream": 368, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16244", "http.response.code": "400" } }, { "event_id": "evt-d8134752aad8dce60c71ce08", "kind": "http_response", "frame_number": 16258, "timestamp_epoch": "1723681664.990195000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50051, "tcp_stream": 369, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16254", "http.response.code": "400" } }, { "event_id": "evt-efa153513e40838b07a74ca5", "kind": "http_response", "frame_number": 16273, "timestamp_epoch": "1723681670.980631000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50052, "tcp_stream": 370, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16271", "http.response.code": "400" } }, { "event_id": "evt-774bf61a2965db92f2e2b76e", "kind": "http_response", "frame_number": 16324, "timestamp_epoch": "1723681675.577375000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50054, "tcp_stream": 372, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16322", "http.response.code": "400" } }, { "event_id": "evt-3d0c365677b8f5c88f3822e6", "kind": "http_response", "frame_number": 16336, "timestamp_epoch": "1723681681.566421000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50055, "tcp_stream": 373, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16334", "http.response.code": "400" } }, { "event_id": "evt-05b477caa172e9c5ad4d8e3b", "kind": "http_response", "frame_number": 16352, "timestamp_epoch": "1723681687.783553000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50056, "tcp_stream": 374, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16350", "http.response.code": "400" } }, { "event_id": "evt-276c8b87823e418ea38fbfcb", "kind": "http_response", "frame_number": 16362, "timestamp_epoch": "1723681692.043003000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50057, "tcp_stream": 375, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16360", "http.response.code": "400" } }, { "event_id": "evt-14ed2646384c330ba9eefe9f", "kind": "http_response", "frame_number": 16372, "timestamp_epoch": "1723681696.453157000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50058, "tcp_stream": 376, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16370", "http.response.code": "400" } }, { "event_id": "evt-1d27ef6b0f2e1524031af5e3", "kind": "http_response", "frame_number": 16388, "timestamp_epoch": "1723681702.865748000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50059, "tcp_stream": 377, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16386", "http.response.code": "400" } }, { "event_id": "evt-3cdd020d1992b2d40b2bb269", "kind": "http_response", "frame_number": 16399, "timestamp_epoch": "1723681710.934455000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50060, "tcp_stream": 378, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16397", "http.response.code": "400" } }, { "event_id": "evt-24448d3ec257a97800ed38f0", "kind": "http_response", "frame_number": 16408, "timestamp_epoch": "1723681717.840995000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50061, "tcp_stream": 379, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16406", "http.response.code": "400" } }, { "event_id": "evt-a487b86de553f9f9b1817d41", "kind": "http_response", "frame_number": 16419, "timestamp_epoch": "1723681723.443097000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50062, "tcp_stream": 380, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16417", "http.response.code": "400" } }, { "event_id": "evt-960f361caed2ceaa351e7142", "kind": "http_response", "frame_number": 16429, "timestamp_epoch": "1723681731.846152000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50063, "tcp_stream": 381, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16427", "http.response.code": "400" } }, { "event_id": "evt-9451eb04ac4e4aa1049b9d12", "kind": "http_response", "frame_number": 16438, "timestamp_epoch": "1723681739.173984000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50064, "tcp_stream": 382, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16436", "http.response.code": "400" } }, { "event_id": "evt-d60a6b5983dbf4ed16d6a9e4", "kind": "http_response", "frame_number": 16449, "timestamp_epoch": "1723681745.665708000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50065, "tcp_stream": 383, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16447", "http.response.code": "400" } }, { "event_id": "evt-a3107fd8dbd76c4375326f94", "kind": "http_response", "frame_number": 16458, "timestamp_epoch": "1723681750.412350000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50066, "tcp_stream": 384, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16456", "http.response.code": "400" } }, { "event_id": "evt-24b4a4d08db55144ca28561d", "kind": "http_response", "frame_number": 16467, "timestamp_epoch": "1723681755.817391000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50067, "tcp_stream": 385, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16465", "http.response.code": "400" } }, { "event_id": "evt-b49ecd275647f9d6bc5aa9c0", "kind": "http_response", "frame_number": 16476, "timestamp_epoch": "1723681763.186808000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50068, "tcp_stream": 386, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16474", "http.response.code": "400" } }, { "event_id": "evt-e10960beedb0ff191c69fbc1", "kind": "http_response", "frame_number": 16487, "timestamp_epoch": "1723681769.079671000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50069, "tcp_stream": 387, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16485", "http.response.code": "400" } }, { "event_id": "evt-e1e4a950f6a97913432e2f08", "kind": "http_response", "frame_number": 16496, "timestamp_epoch": "1723681772.677191000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50070, "tcp_stream": 388, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16494", "http.response.code": "400" } }, { "event_id": "evt-dea3870f67e53755623f1bd3", "kind": "http_response", "frame_number": 16505, "timestamp_epoch": "1723681779.873952000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50071, "tcp_stream": 389, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16503", "http.response.code": "400" } }, { "event_id": "evt-943dfc7495e698d1e04bae20", "kind": "http_response", "frame_number": 16519, "timestamp_epoch": "1723681786.088419000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50072, "tcp_stream": 390, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16517", "http.response.code": "400" } }, { "event_id": "evt-74577c649b7872734dcd8fd0", "kind": "http_response", "frame_number": 16532, "timestamp_epoch": "1723681790.297631000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50073, "tcp_stream": 391, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16530", "http.response.code": "400" } }, { "event_id": "evt-47ac6ff55aa07203d0afa37c", "kind": "http_response", "frame_number": 16541, "timestamp_epoch": "1723681794.651728000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50074, "tcp_stream": 392, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16539", "http.response.code": "400" } }, { "event_id": "evt-73bc068ab4081213a27154d0", "kind": "http_response", "frame_number": 16551, "timestamp_epoch": "1723681799.285860000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50075, "tcp_stream": 393, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16549", "http.response.code": "400" } }, { "event_id": "evt-24ecd33451010b718b101624", "kind": "http_response", "frame_number": 16562, "timestamp_epoch": "1723681804.417925000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50076, "tcp_stream": 394, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16560", "http.response.code": "400" } }, { "event_id": "evt-e2fe2d4679200a86f8a581b9", "kind": "http_response", "frame_number": 16571, "timestamp_epoch": "1723681810.603731000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50077, "tcp_stream": 395, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16569", "http.response.code": "400" } }, { "event_id": "evt-5a7af64c533c0a4534b6367f", "kind": "http_response", "frame_number": 16613, "timestamp_epoch": "1723681814.789617000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50079, "tcp_stream": 397, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16611", "http.response.code": "400" } }, { "event_id": "evt-e42625012b56e1289621ad50", "kind": "http_response", "frame_number": 16627, "timestamp_epoch": "1723681819.138144000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50080, "tcp_stream": 398, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16625", "http.response.code": "400" } }, { "event_id": "evt-f846508afdd7b3176d388d15", "kind": "http_response", "frame_number": 16642, "timestamp_epoch": "1723681824.938250000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50081, "tcp_stream": 399, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16640", "http.response.code": "400" } }, { "event_id": "evt-469a63a9875e50ca85fd744e", "kind": "http_response", "frame_number": 16651, "timestamp_epoch": "1723681831.147496000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50082, "tcp_stream": 400, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16649", "http.response.code": "400" } }, { "event_id": "evt-4651c085a8e41847e09a0dc0", "kind": "http_response", "frame_number": 16662, "timestamp_epoch": "1723681835.378039000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50083, "tcp_stream": 401, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16660", "http.response.code": "400" } }, { "event_id": "evt-a5b476bfa10474b0a3b6e8e6", "kind": "http_response", "frame_number": 16671, "timestamp_epoch": "1723681840.271153000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50084, "tcp_stream": 402, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16669", "http.response.code": "400" } }, { "event_id": "evt-c3558d1b1a833b9274915257", "kind": "http_response", "frame_number": 16682, "timestamp_epoch": "1723681845.978255000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50085, "tcp_stream": 403, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16680", "http.response.code": "400" } }, { "event_id": "evt-70fead001ff75b35a69dd2a2", "kind": "http_response", "frame_number": 16694, "timestamp_epoch": "1723681854.817328000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50086, "tcp_stream": 404, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16692", "http.response.code": "400" } }, { "event_id": "evt-244d5789567c939a8cbe31e6", "kind": "http_response", "frame_number": 16709, "timestamp_epoch": "1723681862.227790000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50087, "tcp_stream": 405, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16707", "http.response.code": "400" } }, { "event_id": "evt-5f3b09b719d12cae08fb0c37", "kind": "http_response", "frame_number": 16718, "timestamp_epoch": "1723681868.877767000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50088, "tcp_stream": 406, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16716", "http.response.code": "400" } }, { "event_id": "evt-355ea47b32c20535a79ec4f7", "kind": "http_response", "frame_number": 16728, "timestamp_epoch": "1723681875.293789000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50089, "tcp_stream": 407, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16726", "http.response.code": "400" } }, { "event_id": "evt-d27d31437671cf5e7edbff2d", "kind": "http_response", "frame_number": 16740, "timestamp_epoch": "1723681884.411897000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50090, "tcp_stream": 408, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16738", "http.response.code": "400" } }, { "event_id": "evt-9b6346a2c60736bc95a8db0f", "kind": "http_response", "frame_number": 16751, "timestamp_epoch": "1723681889.418499000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50091, "tcp_stream": 409, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16749", "http.response.code": "400" } }, { "event_id": "evt-9f1e7e063faea529809374cc", "kind": "http_response", "frame_number": 16760, "timestamp_epoch": "1723681895.637868000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50092, "tcp_stream": 410, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16758", "http.response.code": "400" } }, { "event_id": "evt-4e3303dd001cdb3762f60be9", "kind": "http_response", "frame_number": 16773, "timestamp_epoch": "1723681902.918183000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50093, "tcp_stream": 411, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16771", "http.response.code": "400" } }, { "event_id": "evt-2c0176926734967659b14f11", "kind": "http_response", "frame_number": 16788, "timestamp_epoch": "1723681909.406835000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50094, "tcp_stream": 412, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16785", "http.response.code": "400" } }, { "event_id": "evt-b29ca90bbc4352c6a1f40d4d", "kind": "http_response", "frame_number": 16827, "timestamp_epoch": "1723681914.730088000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50096, "tcp_stream": 414, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16825", "http.response.code": "400" } }, { "event_id": "evt-df8e23f901201d0506dcd309", "kind": "http_response", "frame_number": 16840, "timestamp_epoch": "1723681920.652403000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50097, "tcp_stream": 415, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16836", "http.response.code": "400" } }, { "event_id": "evt-944e891e1ddf09800328a0d4", "kind": "http_response", "frame_number": 16853, "timestamp_epoch": "1723681925.044391000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50098, "tcp_stream": 416, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16851", "http.response.code": "400" } }, { "event_id": "evt-712161f5673ee5963c8720d1", "kind": "http_response", "frame_number": 16862, "timestamp_epoch": "1723681928.978542000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50099, "tcp_stream": 417, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16860", "http.response.code": "400" } }, { "event_id": "evt-5c4bbf41c773230c7464e98a", "kind": "http_response", "frame_number": 16871, "timestamp_epoch": "1723681932.758195000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50100, "tcp_stream": 418, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16869", "http.response.code": "400" } }, { "event_id": "evt-9107a38c9070a5c068259b90", "kind": "http_response", "frame_number": 16880, "timestamp_epoch": "1723681936.683489000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50101, "tcp_stream": 419, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16878", "http.response.code": "400" } }, { "event_id": "evt-b455024bdff94c36e797e7c6", "kind": "http_response", "frame_number": 16893, "timestamp_epoch": "1723681944.070669000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50102, "tcp_stream": 420, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16891", "http.response.code": "400" } }, { "event_id": "evt-23fcb2b9e2c80313448ed91d", "kind": "http_response", "frame_number": 16904, "timestamp_epoch": "1723681950.607050000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50103, "tcp_stream": 421, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16902", "http.response.code": "400" } }, { "event_id": "evt-2f5734a252b4ee826a5ae588", "kind": "http_response", "frame_number": 16913, "timestamp_epoch": "1723681955.701189000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50104, "tcp_stream": 422, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16911", "http.response.code": "400" } }, { "event_id": "evt-ad4cac7aa24dbcdbfda03cf8", "kind": "http_response", "frame_number": 16922, "timestamp_epoch": "1723681961.597442000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50105, "tcp_stream": 423, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16920", "http.response.code": "400" } }, { "event_id": "evt-62cfe8fd7b791932fa8e8e0e", "kind": "http_response", "frame_number": 16933, "timestamp_epoch": "1723681965.203772000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50106, "tcp_stream": 424, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16931", "http.response.code": "400" } }, { "event_id": "evt-32b319aa67012379050b03c6", "kind": "http_response", "frame_number": 16945, "timestamp_epoch": "1723681972.397054000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50107, "tcp_stream": 425, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16943", "http.response.code": "400" } }, { "event_id": "evt-97121d9bba237dd78a5a1793", "kind": "http_response", "frame_number": 16954, "timestamp_epoch": "1723681978.619032000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50108, "tcp_stream": 426, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16952", "http.response.code": "400" } }, { "event_id": "evt-d4d33322ca0d1e45024575af", "kind": "http_response", "frame_number": 16963, "timestamp_epoch": "1723681982.867480000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50109, "tcp_stream": 427, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16961", "http.response.code": "400" } }, { "event_id": "evt-8dcbe4b549001a7e3d5a6bef", "kind": "http_response", "frame_number": 16974, "timestamp_epoch": "1723681987.258361000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50110, "tcp_stream": 428, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16972", "http.response.code": "400" } }, { "event_id": "evt-3b31a85c80920490f04def73", "kind": "http_response", "frame_number": 16985, "timestamp_epoch": "1723681991.957483000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50111, "tcp_stream": 429, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16981", "http.response.code": "400" } }, { "event_id": "evt-0995e7532a374074c77c64c6", "kind": "http_response", "frame_number": 16996, "timestamp_epoch": "1723681997.247675000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50112, "tcp_stream": 430, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "16994", "http.response.code": "400" } }, { "event_id": "evt-2046683c6e12f6dd622438a9", "kind": "http_response", "frame_number": 17005, "timestamp_epoch": "1723682003.751159000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50113, "tcp_stream": 431, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17003", "http.response.code": "400" } }, { "event_id": "evt-e359cb02b79af089ae8df318", "kind": "http_response", "frame_number": 17014, "timestamp_epoch": "1723682008.567308000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50114, "tcp_stream": 432, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17012", "http.response.code": "400" } }, { "event_id": "evt-b394f91c0edb901e9c4748da", "kind": "http_response", "frame_number": 17023, "timestamp_epoch": "1723682014.096566000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50115, "tcp_stream": 433, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17021", "http.response.code": "400" } }, { "event_id": "evt-47905739c18109208651857e", "kind": "http_response", "frame_number": 17036, "timestamp_epoch": "1723682021.058267000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50116, "tcp_stream": 434, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17034", "http.response.code": "400" } }, { "event_id": "evt-65d4554915cac99455afa3fe", "kind": "http_response", "frame_number": 17048, "timestamp_epoch": "1723682026.788522000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50117, "tcp_stream": 435, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17045", "http.response.code": "400" } }, { "event_id": "evt-a90aeb36bee241ed310a191e", "kind": "http_response", "frame_number": 17059, "timestamp_epoch": "1723682034.147115000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50118, "tcp_stream": 436, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17057", "http.response.code": "400" } }, { "event_id": "evt-d1d41cadfbfea2092fffacba", "kind": "http_response", "frame_number": 17070, "timestamp_epoch": "1723682040.670207000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50119, "tcp_stream": 437, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17068", "http.response.code": "400" } }, { "event_id": "evt-92f27931f1be863cba2be520", "kind": "http_response", "frame_number": 17083, "timestamp_epoch": "1723682045.538506000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50120, "tcp_stream": 438, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17081", "http.response.code": "400" } }, { "event_id": "evt-da6bd2400879170c1257a154", "kind": "http_response", "frame_number": 17092, "timestamp_epoch": "1723682051.178904000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50121, "tcp_stream": 439, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17090", "http.response.code": "400" } }, { "event_id": "evt-a1705e9916cd5a0b86dc9e6e", "kind": "http_response", "frame_number": 17109, "timestamp_epoch": "1723682059.656798000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50122, "tcp_stream": 440, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17105", "http.response.code": "400" } }, { "event_id": "evt-754d5c3ecc0be2094207463a", "kind": "http_response", "frame_number": 17122, "timestamp_epoch": "1723682068.639137000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50123, "tcp_stream": 441, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17120", "http.response.code": "400" } }, { "event_id": "evt-7eb35642332ab0f8657b1731", "kind": "http_response", "frame_number": 17158, "timestamp_epoch": "1723682072.781693000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50125, "tcp_stream": 443, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17156", "http.response.code": "400" } }, { "event_id": "evt-d580ab5f3eeb80bce01b001a", "kind": "http_response", "frame_number": 17171, "timestamp_epoch": "1723682076.987430000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50126, "tcp_stream": 444, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17169", "http.response.code": "400" } }, { "event_id": "evt-7c8d6a1e53d99138b3f38420", "kind": "http_response", "frame_number": 17187, "timestamp_epoch": "1723682083.367721000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50127, "tcp_stream": 445, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17185", "http.response.code": "400" } }, { "event_id": "evt-fbfde2d93c621560993f6460", "kind": "http_response", "frame_number": 17198, "timestamp_epoch": "1723682089.951436000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50128, "tcp_stream": 446, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17196", "http.response.code": "400" } }, { "event_id": "evt-5fd4028495bbbe67d51ccdd1", "kind": "http_response", "frame_number": 17207, "timestamp_epoch": "1723682094.909568000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50129, "tcp_stream": 447, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17205", "http.response.code": "400" } }, { "event_id": "evt-001d6eb0304023f4b3c63dae", "kind": "http_response", "frame_number": 17216, "timestamp_epoch": "1723682101.357872000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50130, "tcp_stream": 448, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17214", "http.response.code": "400" } }, { "event_id": "evt-da97c207a911e10f525581b8", "kind": "http_response", "frame_number": 17227, "timestamp_epoch": "1723682105.719822000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50131, "tcp_stream": 449, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17225", "http.response.code": "400" } }, { "event_id": "evt-b597eafbc956be8541b50a32", "kind": "http_response", "frame_number": 17237, "timestamp_epoch": "1723682111.754747000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50132, "tcp_stream": 450, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17235", "http.response.code": "400" } }, { "event_id": "evt-d2f02c55d074be14106ab6b3", "kind": "http_response", "frame_number": 17246, "timestamp_epoch": "1723682118.066366000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50133, "tcp_stream": 451, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17244", "http.response.code": "400" } }, { "event_id": "evt-42a0394fd03749e43adc3e71", "kind": "http_response", "frame_number": 17256, "timestamp_epoch": "1723682124.151380000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50134, "tcp_stream": 452, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17254", "http.response.code": "400" } }, { "event_id": "evt-7470560def382fbb4fa84cfe", "kind": "http_response", "frame_number": 17267, "timestamp_epoch": "1723682130.564442000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50135, "tcp_stream": 453, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17265", "http.response.code": "400" } }, { "event_id": "evt-c0583cef13eff0bf5505ddd7", "kind": "http_response", "frame_number": 17276, "timestamp_epoch": "1723682135.218921000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50136, "tcp_stream": 454, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17274", "http.response.code": "400" } }, { "event_id": "evt-5687ec205f5e5b6778e65dd4", "kind": "http_response", "frame_number": 17285, "timestamp_epoch": "1723682140.430205000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50137, "tcp_stream": 455, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17283", "http.response.code": "400" } }, { "event_id": "evt-cc97454c48425230540622eb", "kind": "http_response", "frame_number": 17319, "timestamp_epoch": "1723682148.799170000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50139, "tcp_stream": 457, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17317", "http.response.code": "400" } }, { "event_id": "evt-83aa8ea55d9d58a4ca4c9f44", "kind": "http_response", "frame_number": 17332, "timestamp_epoch": "1723682155.272654000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50140, "tcp_stream": 458, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17330", "http.response.code": "400" } }, { "event_id": "evt-59642e2c49f3d175b3b2690b", "kind": "http_response", "frame_number": 17341, "timestamp_epoch": "1723682160.058824000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50141, "tcp_stream": 459, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17339", "http.response.code": "400" } }, { "event_id": "evt-153dd62b59c1ce464b3ea2b7", "kind": "http_response", "frame_number": 17350, "timestamp_epoch": "1723682165.537622000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50142, "tcp_stream": 460, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17348", "http.response.code": "400" } }, { "event_id": "evt-0a0b18e83d0f78f1a591777a", "kind": "http_response", "frame_number": 17362, "timestamp_epoch": "1723682173.680116000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50143, "tcp_stream": 461, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17360", "http.response.code": "400" } }, { "event_id": "evt-fd595e941ea074bedd43403e", "kind": "http_response", "frame_number": 17373, "timestamp_epoch": "1723682180.486922000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50144, "tcp_stream": 462, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17371", "http.response.code": "400" } }, { "event_id": "evt-5c4e9ed380d21597d5e28ea8", "kind": "http_response", "frame_number": 17385, "timestamp_epoch": "1723682186.937999000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50145, "tcp_stream": 463, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17383", "http.response.code": "400" } }, { "event_id": "evt-7e53a68cd9e14abe854fd9f4", "kind": "http_response", "frame_number": 17394, "timestamp_epoch": "1723682190.619301000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50146, "tcp_stream": 464, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17392", "http.response.code": "400" } }, { "event_id": "evt-a4199163337e1d24eeb00729", "kind": "http_response", "frame_number": 17407, "timestamp_epoch": "1723682197.978897000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50147, "tcp_stream": 465, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17405", "http.response.code": "400" } }, { "event_id": "evt-c4c4aa5574ea4fa7d0b4e0b5", "kind": "http_response", "frame_number": 17416, "timestamp_epoch": "1723682204.478741000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50148, "tcp_stream": 466, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17414", "http.response.code": "400" } }, { "event_id": "evt-4b0075879464df66eedd6e63", "kind": "http_response", "frame_number": 17425, "timestamp_epoch": "1723682209.312045000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50149, "tcp_stream": 467, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17423", "http.response.code": "400" } }, { "event_id": "evt-6573acc3a603ba04cfd33a69", "kind": "http_response", "frame_number": 17435, "timestamp_epoch": "1723682215.456452000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50150, "tcp_stream": 468, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17433", "http.response.code": "400" } }, { "event_id": "evt-ede35a81d3dbf999c78f28c2", "kind": "http_response", "frame_number": 17447, "timestamp_epoch": "1723682218.979052000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50151, "tcp_stream": 469, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17445", "http.response.code": "400" } }, { "event_id": "evt-fef544803c86cbd4b118d4b3", "kind": "http_response", "frame_number": 17456, "timestamp_epoch": "1723682226.019468000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50152, "tcp_stream": 470, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17454", "http.response.code": "400" } }, { "event_id": "evt-cb1fa05bfeacf33495918c48", "kind": "http_response", "frame_number": 17465, "timestamp_epoch": "1723682231.898418000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50153, "tcp_stream": 471, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17463", "http.response.code": "400" } }, { "event_id": "evt-588bc66b85b8889acdb441f8", "kind": "http_response", "frame_number": 17474, "timestamp_epoch": "1723682235.468513000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50154, "tcp_stream": 472, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17472", "http.response.code": "400" } }, { "event_id": "evt-f6049dddcdc7a21c4b738a56", "kind": "http_response", "frame_number": 17485, "timestamp_epoch": "1723682242.599792000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50155, "tcp_stream": 473, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17483", "http.response.code": "400" } }, { "event_id": "evt-ce256b98e59d571bf893023c", "kind": "http_response", "frame_number": 17494, "timestamp_epoch": "1723682248.690309000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50156, "tcp_stream": 474, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17492", "http.response.code": "400" } }, { "event_id": "evt-b98a8b5bd9e3a5ce7ad5127e", "kind": "http_response", "frame_number": 17503, "timestamp_epoch": "1723682252.662374000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50157, "tcp_stream": 475, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17501", "http.response.code": "400" } }, { "event_id": "evt-5b847980b82ec08e4c379df9", "kind": "http_response", "frame_number": 17512, "timestamp_epoch": "1723682256.512814000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50158, "tcp_stream": 476, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17510", "http.response.code": "400" } }, { "event_id": "evt-495daf71e4b98cdc5ffd7cf0", "kind": "http_response", "frame_number": 17521, "timestamp_epoch": "1723682260.112575000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50159, "tcp_stream": 477, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17519", "http.response.code": "400" } }, { "event_id": "evt-204dfadddf5b4036c5d6c7c3", "kind": "http_response", "frame_number": 17534, "timestamp_epoch": "1723682267.349947000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50160, "tcp_stream": 478, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17532", "http.response.code": "400" } }, { "event_id": "evt-f130becf7a2328880fd3a029", "kind": "http_response", "frame_number": 17545, "timestamp_epoch": "1723682273.611305000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50161, "tcp_stream": 479, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17543", "http.response.code": "400" } }, { "event_id": "evt-e337071ad25970b2f12955ce", "kind": "http_response", "frame_number": 17555, "timestamp_epoch": "1723682277.938136000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50162, "tcp_stream": 480, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17553", "http.response.code": "400" } }, { "event_id": "evt-0b6318801f2caf513ea42c4c", "kind": "http_response", "frame_number": 17564, "timestamp_epoch": "1723682282.502767000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50163, "tcp_stream": 481, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17562", "http.response.code": "400" } }, { "event_id": "evt-4893cc0d7b11453793dfbf64", "kind": "http_response", "frame_number": 17575, "timestamp_epoch": "1723682287.533068000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50164, "tcp_stream": 482, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17573", "http.response.code": "400" } }, { "event_id": "evt-07343e186e9ab098c87ea9f0", "kind": "http_response", "frame_number": 17586, "timestamp_epoch": "1723682293.492209000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50165, "tcp_stream": 483, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17584", "http.response.code": "400" } }, { "event_id": "evt-2404fe134e8b0ff3d2845035", "kind": "http_response", "frame_number": 17595, "timestamp_epoch": "1723682297.239462000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50166, "tcp_stream": 484, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17593", "http.response.code": "400" } }, { "event_id": "evt-28a3a6abe9c842a69db39b54", "kind": "http_response", "frame_number": 17612, "timestamp_epoch": "1723682304.692142000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50167, "tcp_stream": 485, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17610", "http.response.code": "400" } }, { "event_id": "evt-fd5feedbc64645ccb149e067", "kind": "http_response", "frame_number": 17623, "timestamp_epoch": "1723682311.421445000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50168, "tcp_stream": 486, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17621", "http.response.code": "400" } }, { "event_id": "evt-5fa002de03ea60a7be7291be", "kind": "http_response", "frame_number": 17632, "timestamp_epoch": "1723682316.659792000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50169, "tcp_stream": 487, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17630", "http.response.code": "400" } }, { "event_id": "evt-f88ea17b6f95e7b8e3aa520a", "kind": "http_response", "frame_number": 17641, "timestamp_epoch": "1723682323.079992000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50170, "tcp_stream": 488, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17639", "http.response.code": "400" } }, { "event_id": "evt-27034c3c2fe473789c960cb5", "kind": "http_response", "frame_number": 17650, "timestamp_epoch": "1723682327.735987000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50171, "tcp_stream": 489, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17648", "http.response.code": "400" } }, { "event_id": "evt-4e5dab75d711c88b02eb11f4", "kind": "http_response", "frame_number": 17662, "timestamp_epoch": "1723682333.050332000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50172, "tcp_stream": 490, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17660", "http.response.code": "400" } }, { "event_id": "evt-2863b0e3b0c5e0bdfb948383", "kind": "http_response", "frame_number": 17671, "timestamp_epoch": "1723682339.471031000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50173, "tcp_stream": 491, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17669", "http.response.code": "400" } }, { "event_id": "evt-64db8fd7bf1729b66eb3623e", "kind": "http_response", "frame_number": 17680, "timestamp_epoch": "1723682344.114631000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50174, "tcp_stream": 492, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17678", "http.response.code": "400" } }, { "event_id": "evt-6c8c7d7b75753b5146693436", "kind": "http_response", "frame_number": 17689, "timestamp_epoch": "1723682349.301671000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50175, "tcp_stream": 493, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17687", "http.response.code": "400" } }, { "event_id": "evt-44b6b88066ba0611bfa9bc51", "kind": "http_response", "frame_number": 17700, "timestamp_epoch": "1723682355.580476000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50176, "tcp_stream": 494, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17698", "http.response.code": "400" } }, { "event_id": "evt-ea1449fb2696fb13d68b3221", "kind": "http_response", "frame_number": 17709, "timestamp_epoch": "1723682359.940068000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50177, "tcp_stream": 495, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17707", "http.response.code": "400" } }, { "event_id": "evt-114c39a4f49a953b08209301", "kind": "http_response", "frame_number": 17718, "timestamp_epoch": "1723682364.596222000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50178, "tcp_stream": 496, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17716", "http.response.code": "400" } }, { "event_id": "evt-4dc4c73a3e4940791b653602", "kind": "http_response", "frame_number": 17727, "timestamp_epoch": "1723682369.793429000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50179, "tcp_stream": 497, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17725", "http.response.code": "400" } }, { "event_id": "evt-400f6507c8cb02742257f8dc", "kind": "http_response", "frame_number": 17738, "timestamp_epoch": "1723682376.079927000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50180, "tcp_stream": 498, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17736", "http.response.code": "400" } }, { "event_id": "evt-daf89c7453bf6a64233fe1ca", "kind": "http_response", "frame_number": 17748, "timestamp_epoch": "1723682380.480085000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50181, "tcp_stream": 499, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17746", "http.response.code": "400" } }, { "event_id": "evt-b65d2dfc26b6da670f895a1f", "kind": "http_response", "frame_number": 17761, "timestamp_epoch": "1723682385.178142000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50182, "tcp_stream": 500, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17757", "http.response.code": "400" } }, { "event_id": "evt-9e75717a4a16d2d57cd1a92c", "kind": "http_response", "frame_number": 17795, "timestamp_epoch": "1723682390.466535000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50184, "tcp_stream": 502, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17793", "http.response.code": "400" } }, { "event_id": "evt-73026555cc59e84aad490580", "kind": "http_response", "frame_number": 17842, "timestamp_epoch": "1723682396.983970000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50186, "tcp_stream": 504, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17838", "http.response.code": "400" } }, { "event_id": "evt-51f14455297baa33f53bcee8", "kind": "http_response", "frame_number": 17868, "timestamp_epoch": "1723682401.800116000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50188, "tcp_stream": 506, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17864", "http.response.code": "400" } }, { "event_id": "evt-e1b38e2ef0b30f58675c8020", "kind": "http_response", "frame_number": 17892, "timestamp_epoch": "1723682407.320104000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50189, "tcp_stream": 507, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17890", "http.response.code": "400" } }, { "event_id": "evt-712d49c5a02b3a7774b01b11", "kind": "http_response", "frame_number": 17901, "timestamp_epoch": "1723682414.280800000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50190, "tcp_stream": 508, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17899", "http.response.code": "400" } }, { "event_id": "evt-4720f69d225f00058e58271c", "kind": "http_response", "frame_number": 17917, "timestamp_epoch": "1723682420.011166000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50191, "tcp_stream": 509, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17914", "http.response.code": "400" } }, { "event_id": "evt-7501ad95c58af24852720717", "kind": "http_response", "frame_number": 17928, "timestamp_epoch": "1723682427.374154000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50192, "tcp_stream": 510, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17926", "http.response.code": "400" } }, { "event_id": "evt-123c704e3f38eee8d9b5f60d", "kind": "http_response", "frame_number": 17937, "timestamp_epoch": "1723682433.900694000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50193, "tcp_stream": 511, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17935", "http.response.code": "400" } }, { "event_id": "evt-c33c70dc67bd869b9705d04b", "kind": "http_response", "frame_number": 17946, "timestamp_epoch": "1723682438.774562000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50194, "tcp_stream": 512, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17944", "http.response.code": "400" } }, { "event_id": "evt-21264db3b6bcf1a28dfeba6c", "kind": "http_response", "frame_number": 17957, "timestamp_epoch": "1723682444.415654000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50195, "tcp_stream": 513, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17955", "http.response.code": "400" } }, { "event_id": "evt-be54477bcabd2db41b72df63", "kind": "http_response", "frame_number": 17995, "timestamp_epoch": "1723682451.600022000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50197, "tcp_stream": 515, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "17993", "http.response.code": "400" } }, { "event_id": "evt-37f5b9c3548197182554516b", "kind": "http_response", "frame_number": 18006, "timestamp_epoch": "1723682457.791259000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50198, "tcp_stream": 516, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "18004", "http.response.code": "400" } }, { "event_id": "evt-1f9fe3438c7c744d2a143a05", "kind": "http_response", "frame_number": 18019, "timestamp_epoch": "1723682461.980059000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50199, "tcp_stream": 517, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "18017", "http.response.code": "400" } }, { "event_id": "evt-434588e4e74825981a352965", "kind": "http_response", "frame_number": 18030, "timestamp_epoch": "1723682466.280963000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50200, "tcp_stream": 518, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "18028", "http.response.code": "400" } }, { "event_id": "evt-2d4fe3f24286d266c33e77c4", "kind": "http_response", "frame_number": 18040, "timestamp_epoch": "1723682471.680787000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50201, "tcp_stream": 519, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "18038", "http.response.code": "400" } }, { "event_id": "evt-d60ac91ac043891c33eb74c2", "kind": "http_response", "frame_number": 18049, "timestamp_epoch": "1723682477.452817000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50202, "tcp_stream": 520, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "18047", "http.response.code": "400" } }, { "event_id": "evt-113bd8160a913f4716d4e581", "kind": "http_response", "frame_number": 18058, "timestamp_epoch": "1723682484.913983000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50203, "tcp_stream": 521, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "18056", "http.response.code": "400" } }, { "event_id": "evt-2178e922640880448c582296", "kind": "http_response", "frame_number": 18069, "timestamp_epoch": "1723682491.652733000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50204, "tcp_stream": 522, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "18067", "http.response.code": "400" } }, { "event_id": "evt-d0015fa62742935df4e03a15", "kind": "http_response", "frame_number": 18079, "timestamp_epoch": "1723682498.847273000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50205, "tcp_stream": 523, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "18077", "http.response.code": "400" } }, { "event_id": "evt-6f9937d5191eead5ffdb68fa", "kind": "http_response", "frame_number": 18092, "timestamp_epoch": "1723682503.119131000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50206, "tcp_stream": 524, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "18090", "http.response.code": "400" } }, { "event_id": "evt-3cf01afe1e76fc1e273738c9", "kind": "http_response", "frame_number": 18105, "timestamp_epoch": "1723682507.580538000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50207, "tcp_stream": 525, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "18103", "http.response.code": "400" } }, { "event_id": "evt-031f90672452a75e9b601f8b", "kind": "http_response", "frame_number": 18119, "timestamp_epoch": "1723682512.792806000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50208, "tcp_stream": 526, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "18117", "http.response.code": "400" } }, { "event_id": "evt-d708f7642f6b238562b56dc8", "kind": "http_response", "frame_number": 18128, "timestamp_epoch": "1723682518.719915000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50209, "tcp_stream": 527, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "18126", "http.response.code": "400" } }, { "event_id": "evt-363403a7ef7e3b17778c2d2f", "kind": "http_response", "frame_number": 18142, "timestamp_epoch": "1723682523.861254000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50210, "tcp_stream": 528, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "18140", "http.response.code": "400" } }, { "event_id": "evt-51867f4674c73c42a1848a4d", "kind": "http_response", "frame_number": 18151, "timestamp_epoch": "1723682528.575256000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50211, "tcp_stream": 529, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "18149", "http.response.code": "400" } }, { "event_id": "evt-8980379724bd0a7893b3558c", "kind": "http_response", "frame_number": 18164, "timestamp_epoch": "1723682535.980471000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50212, "tcp_stream": 530, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "18162", "http.response.code": "400" } }, { "event_id": "evt-27c30529b1c295533c7d3cde", "kind": "http_response", "frame_number": 18175, "timestamp_epoch": "1723682540.521077000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50213, "tcp_stream": 531, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "18173", "http.response.code": "400" } }, { "event_id": "evt-9c1c2e89c75c6935725ccc32", "kind": "http_response", "frame_number": 18186, "timestamp_epoch": "1723682546.008632000", "src_ip": "72.5.43.29", "dst_ip": "10.8.15.133", "src_port": 80, "dst_port": 50214, "tcp_stream": 532, "udp_stream": null, "fields": { "http.content_length": "94", "http.content_type": "text/html", "http.request_in": "18184", "http.response.code": "400" } } ], "tls_client_hello": [ { "event_id": "evt-557e89ea418b71e6fdc768ef", "kind": "tls_client_hello", "frame_number": 77, "timestamp_epoch": "1723680585.479612000", "src_ip": "10.8.15.133", "dst_ip": "23.33.138.184", "src_port": 49672, "dst_port": 443, "tcp_stream": 3, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "go.microsoft.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-2096b2ebc742f9bb9afac793", "kind": "tls_client_hello", "frame_number": 107, "timestamp_epoch": "1723680585.799589000", "src_ip": "10.8.15.133", "dst_ip": "23.33.138.184", "src_port": 49673, "dst_port": 443, "tcp_stream": 4, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "go.microsoft.com", "tls.handshake.ja3": "46f5131e766d248db0248a86c494b71c" } }, { "event_id": "evt-e217d5e26cd9cfe52613d7c1", "kind": "tls_client_hello", "frame_number": 671, "timestamp_epoch": "1723680587.233268000", "src_ip": "10.8.15.133", "dst_ip": "52.109.20.38", "src_port": 49704, "dst_port": 443, "tcp_stream": 32, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "officeclient.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-dc6379cf302fbb7680d99268", "kind": "tls_client_hello", "frame_number": 733, "timestamp_epoch": "1723680588.207325000", "src_ip": "10.8.15.133", "dst_ip": "13.89.179.13", "src_port": 49706, "dst_port": 443, "tcp_stream": 33, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "mobile.events.data.microsoft.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-16f9b7262133311d8f5e2758", "kind": "tls_client_hello", "frame_number": 737, "timestamp_epoch": "1723680588.293463000", "src_ip": "10.8.15.133", "dst_ip": "13.89.179.13", "src_port": 49706, "dst_port": 443, "tcp_stream": 33, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "mobile.events.data.microsoft.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-fb4f87946c1373d536de2bc7", "kind": "tls_client_hello", "frame_number": 847, "timestamp_epoch": "1723680591.605442000", "src_ip": "10.8.15.133", "dst_ip": "13.89.179.13", "src_port": 49711, "dst_port": 443, "tcp_stream": 38, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "mobile.events.data.microsoft.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-fee156bec418b742def22201", "kind": "tls_client_hello", "frame_number": 851, "timestamp_epoch": "1723680591.688217000", "src_ip": "10.8.15.133", "dst_ip": "13.89.179.13", "src_port": 49711, "dst_port": 443, "tcp_stream": 38, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "mobile.events.data.microsoft.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-7a7c0452d3fbf0a161eabc5b", "kind": "tls_client_hello", "frame_number": 1164, "timestamp_epoch": "1723680609.434827000", "src_ip": "10.8.15.133", "dst_ip": "23.220.103.18", "src_port": 49727, "dst_port": 443, "tcp_stream": 54, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-8baba3e3bd6d2843cd59a712", "kind": "tls_client_hello", "frame_number": 1198, "timestamp_epoch": "1723680609.708445000", "src_ip": "10.8.15.133", "dst_ip": "23.33.138.184", "src_port": 49728, "dst_port": 443, "tcp_stream": 55, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "go.microsoft.com", "tls.handshake.ja3": "46f5131e766d248db0248a86c494b71c" } }, { "event_id": "evt-4d402960070ca1d6291e038f", "kind": "tls_client_hello", "frame_number": 1217, "timestamp_epoch": "1723680609.858336000", "src_ip": "10.8.15.133", "dst_ip": "51.116.253.170", "src_port": 49729, "dst_port": 443, "tcp_stream": 56, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v20.events.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-c1ea603e963ab979590e7150", "kind": "tls_client_hello", "frame_number": 1250, "timestamp_epoch": "1723680610.664449000", "src_ip": "10.8.15.133", "dst_ip": "20.96.153.111", "src_port": 49730, "dst_port": 443, "tcp_stream": 57, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fd.api.iris.microsoft.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-6156e18d5fbd25270377f926", "kind": "tls_client_hello", "frame_number": 1252, "timestamp_epoch": "1723680610.667382000", "src_ip": "10.8.15.133", "dst_ip": "20.10.31.115", "src_port": 49731, "dst_port": 443, "tcp_stream": 58, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "client.wns.windows.com", "tls.handshake.ja3": "6a5d235ee78c6aede6a61448b4e9ff1e" } }, { "event_id": "evt-f50cbb84e465296e2b1d9aa2", "kind": "tls_client_hello", "frame_number": 1308, "timestamp_epoch": "1723680611.061775000", "src_ip": "10.8.15.133", "dst_ip": "23.53.13.203", "src_port": 49732, "dst_port": 443, "tcp_stream": 59, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-7ab6dbcac25bb3081fd00970", "kind": "tls_client_hello", "frame_number": 1333, "timestamp_epoch": "1723680613.103739000", "src_ip": "10.8.15.133", "dst_ip": "23.220.103.18", "src_port": 49733, "dst_port": 443, "tcp_stream": 60, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-81904cb1416628021388a71b", "kind": "tls_client_hello", "frame_number": 1441, "timestamp_epoch": "1723680613.362451000", "src_ip": "10.8.15.133", "dst_ip": "52.109.20.38", "src_port": 49734, "dst_port": 443, "tcp_stream": 61, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "officeclient.microsoft.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-0e7d2124723eba0a7f0b928f", "kind": "tls_client_hello", "frame_number": 1494, "timestamp_epoch": "1723680613.709107000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 49735, "dst_port": 443, "tcp_stream": 62, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "windows.msn.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-4a01b9f4bfb58115dfc2d711", "kind": "tls_client_hello", "frame_number": 1510, "timestamp_epoch": "1723680613.768959000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 49735, "dst_port": 443, "tcp_stream": 62, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "windows.msn.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-7978fece7dba0af9fd4595a0", "kind": "tls_client_hello", "frame_number": 1585, "timestamp_epoch": "1723680613.969136000", "src_ip": "10.8.15.133", "dst_ip": "52.109.0.142", "src_port": 49736, "dst_port": 443, "tcp_stream": 63, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "odc.officeapps.live.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-2e8c0788146fb5d99700b078", "kind": "tls_client_hello", "frame_number": 1615, "timestamp_epoch": "1723680614.062603000", "src_ip": "10.8.15.133", "dst_ip": "23.220.103.8", "src_port": 49738, "dst_port": 443, "tcp_stream": 65, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "th.bing.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-0f40bb5f211bc332591003e9", "kind": "tls_client_hello", "frame_number": 1627, "timestamp_epoch": "1723680614.071134000", "src_ip": "10.8.15.133", "dst_ip": "23.220.103.8", "src_port": 49742, "dst_port": 443, "tcp_stream": 69, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "th.bing.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-32ff3b80545a7d401a136a3b", "kind": "tls_client_hello", "frame_number": 1629, "timestamp_epoch": "1723680614.072320000", "src_ip": "10.8.15.133", "dst_ip": "23.220.103.8", "src_port": 49740, "dst_port": 443, "tcp_stream": 67, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "th.bing.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-87e47ef5d42e8db609630824", "kind": "tls_client_hello", "frame_number": 1633, "timestamp_epoch": "1723680614.073430000", "src_ip": "10.8.15.133", "dst_ip": "23.220.103.8", "src_port": 49741, "dst_port": 443, "tcp_stream": 68, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "th.bing.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-8fc0aae56ad4941f1293e956", "kind": "tls_client_hello", "frame_number": 1635, "timestamp_epoch": "1723680614.074372000", "src_ip": "10.8.15.133", "dst_ip": "23.220.103.8", "src_port": 49739, "dst_port": 443, "tcp_stream": 66, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "th.bing.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-a992de900dde79fa04ccef4a", "kind": "tls_client_hello", "frame_number": 1637, "timestamp_epoch": "1723680614.075259000", "src_ip": "10.8.15.133", "dst_ip": "23.220.103.8", "src_port": 49743, "dst_port": 443, "tcp_stream": 70, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "th.bing.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-44141df5ea91686946e79030", "kind": "tls_client_hello", "frame_number": 1639, "timestamp_epoch": "1723680614.076070000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 49737, "dst_port": 443, "tcp_stream": 64, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.msn.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-197d9b7ba682890ea074d2c6", "kind": "tls_client_hello", "frame_number": 1807, "timestamp_epoch": "1723680614.147548000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 49737, "dst_port": 443, "tcp_stream": 64, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.msn.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-1d1ed785e1dc69cd1b7e4bba", "kind": "tls_client_hello", "frame_number": 2025, "timestamp_epoch": "1723680616.146838000", "src_ip": "10.8.15.133", "dst_ip": "23.53.13.203", "src_port": 49744, "dst_port": 443, "tcp_stream": 71, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-eddccff935a52716b8699774", "kind": "tls_client_hello", "frame_number": 2121, "timestamp_epoch": "1723680619.036309000", "src_ip": "10.8.15.133", "dst_ip": "23.220.103.18", "src_port": 49745, "dst_port": 443, "tcp_stream": 72, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "f0a0d117d2207afbb65df9114a8c6321" } }, { "event_id": "evt-598fbd0d72987846c268dd08", "kind": "tls_client_hello", "frame_number": 2147, "timestamp_epoch": "1723680619.054936000", "src_ip": "10.8.15.133", "dst_ip": "13.107.21.239", "src_port": 49746, "dst_port": 443, "tcp_stream": 73, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "edge.microsoft.com", "tls.handshake.ja3": "48ae6b908317f4f14e23cfd06798d78a" } }, { "event_id": "evt-8fc75ddeb7891b8c25b11f46", "kind": "tls_client_hello", "frame_number": 2256, "timestamp_epoch": "1723680619.247242000", "src_ip": "10.8.15.133", "dst_ip": "40.126.29.13", "src_port": 49751, "dst_port": 443, "tcp_stream": 78, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.microsoftonline.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-55a6618a099d6cfa6a9e4c70", "kind": "tls_client_hello", "frame_number": 2263, "timestamp_epoch": "1723680619.286862000", "src_ip": "10.8.15.133", "dst_ip": "40.126.29.13", "src_port": 49751, "dst_port": 443, "tcp_stream": 78, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.microsoftonline.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-aec22070760d3e6e5f33e26f", "kind": "tls_client_hello", "frame_number": 2293, "timestamp_epoch": "1723680619.424890000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.239", "src_port": 49752, "dst_port": 443, "tcp_stream": 79, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "edge.microsoft.com", "tls.handshake.ja3": "d108c2f321a2af5781ed4b63b5b28472" } }, { "event_id": "evt-65968ef6341df91a914f1aba", "kind": "tls_client_hello", "frame_number": 2325, "timestamp_epoch": "1723680619.755866000", "src_ip": "10.8.15.133", "dst_ip": "23.220.103.8", "src_port": 49753, "dst_port": 443, "tcp_stream": 80, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "edgeservices.bing.com", "tls.handshake.ja3": "736a3b58b94abd6c394392ae94f501c3" } }, { "event_id": "evt-d3c6bd85a8383e9aeaaa23d2", "kind": "tls_client_hello", "frame_number": 2345, "timestamp_epoch": "1723680619.855497000", "src_ip": "10.8.15.133", "dst_ip": "23.220.103.18", "src_port": 49754, "dst_port": 443, "tcp_stream": 81, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "edgeservices.bing.com", "tls.handshake.ja3": "5c576ee905a82c07ad7987fce4f39cfe" } }, { "event_id": "evt-56200259efafb15e9cbf9b4b", "kind": "tls_client_hello", "frame_number": 2512, "timestamp_epoch": "1723680620.721662000", "src_ip": "10.8.15.133", "dst_ip": "23.220.103.18", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "38ff17125ac547fdaf43cbc78d13056e" } }, { "event_id": "evt-e18e209f644673e0782ead2c", "kind": "tls_client_hello", "frame_number": 3007, "timestamp_epoch": "1723680622.426613000", "src_ip": "10.8.15.133", "dst_ip": "52.113.194.132", "src_port": 49756, "dst_port": 443, "tcp_stream": 82, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-0649f59ab8dbc5215dff8a30", "kind": "tls_client_hello", "frame_number": 3013, "timestamp_epoch": "1723680622.465634000", "src_ip": "10.8.15.133", "dst_ip": "52.109.0.142", "src_port": 49755, "dst_port": 443, "tcp_stream": 83, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "odc.officeapps.live.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-7a5dcaa3436cddc455401af2", "kind": "tls_client_hello", "frame_number": 3015, "timestamp_epoch": "1723680622.466683000", "src_ip": "10.8.15.133", "dst_ip": "20.241.44.114", "src_port": 49757, "dst_port": 443, "tcp_stream": 84, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "g.live.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-2323b2b41c8d975b8bf13111", "kind": "tls_client_hello", "frame_number": 3018, "timestamp_epoch": "1723680622.491602000", "src_ip": "10.8.15.133", "dst_ip": "52.113.194.132", "src_port": 49756, "dst_port": 443, "tcp_stream": 82, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-df2960933668abe0a1197015", "kind": "tls_client_hello", "frame_number": 3073, "timestamp_epoch": "1723680623.071041000", "src_ip": "10.8.15.133", "dst_ip": "23.63.205.134", "src_port": 49758, "dst_port": 443, "tcp_stream": 85, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "oneclient.sfx.ms", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-f56492ef2aa739ccba79d4a0", "kind": "tls_client_hello", "frame_number": 3151, "timestamp_epoch": "1723680623.820524000", "src_ip": "10.8.15.133", "dst_ip": "23.220.103.18", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "th.bing.com", "tls.handshake.ja3": "46a78af27de56cd4c85b04f57deb3f79" } }, { "event_id": "evt-5929711a211003c43b7da124", "kind": "tls_client_hello", "frame_number": 3546, "timestamp_epoch": "1723680626.203055000", "src_ip": "10.8.15.133", "dst_ip": "13.107.5.93", "src_port": 49759, "dst_port": 443, "tcp_stream": 86, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "default.exp-tas.com", "tls.handshake.ja3": "3c4eb72b882d4d1442c67ce73f1292a9" } }, { "event_id": "evt-ea70febc05fa04f16e1451cd", "kind": "tls_client_hello", "frame_number": 3549, "timestamp_epoch": "1723680626.259996000", "src_ip": "10.8.15.133", "dst_ip": "13.107.5.93", "src_port": 49759, "dst_port": 443, "tcp_stream": 86, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "default.exp-tas.com", "tls.handshake.ja3": "3c4eb72b882d4d1442c67ce73f1292a9" } }, { "event_id": "evt-e3039ebe106e20a3e2700242", "kind": "tls_client_hello", "frame_number": 3672, "timestamp_epoch": "1723680646.525338000", "src_ip": "10.8.15.133", "dst_ip": "13.107.6.158", "src_port": 49762, "dst_port": 443, "tcp_stream": 89, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "business.bing.com", "tls.handshake.ja3": "775ceba0b13f74a42447a14045d31fcc" } }, { "event_id": "evt-8e94a86bf9b43fa4d5a8ef5f", "kind": "tls_client_hello", "frame_number": 3676, "timestamp_epoch": "1723680646.525783000", "src_ip": "10.8.15.133", "dst_ip": "13.107.6.158", "src_port": 49761, "dst_port": 443, "tcp_stream": 88, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "business.bing.com", "tls.handshake.ja3": "3ec074ef84f1118c439e56727227cea3" } }, { "event_id": "evt-4f0723cf01e94551982a18af", "kind": "tls_client_hello", "frame_number": 3681, "timestamp_epoch": "1723680646.658199000", "src_ip": "10.8.15.133", "dst_ip": "13.107.6.158", "src_port": 49762, "dst_port": 443, "tcp_stream": 89, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "business.bing.com", "tls.handshake.ja3": "775ceba0b13f74a42447a14045d31fcc" } }, { "event_id": "evt-a5db161d2cc0c7ed460bf669", "kind": "tls_client_hello", "frame_number": 3683, "timestamp_epoch": "1723680646.659078000", "src_ip": "10.8.15.133", "dst_ip": "13.107.6.158", "src_port": 49761, "dst_port": 443, "tcp_stream": 88, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "business.bing.com", "tls.handshake.ja3": "3ec074ef84f1118c439e56727227cea3" } }, { "event_id": "evt-2a225214d885d1d3af0e4ba7", "kind": "tls_client_hello", "frame_number": 3732, "timestamp_epoch": "1723680647.157232000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 49760, "dst_port": 443, "tcp_stream": 87, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ntp.msn.com", "tls.handshake.ja3": "a2fa4f21077551ea651d383707835d7b" } }, { "event_id": "evt-09b5bb90a83c804f008c51dd", "kind": "tls_client_hello", "frame_number": 3736, "timestamp_epoch": "1723680647.285461000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 49760, "dst_port": 443, "tcp_stream": 87, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ntp.msn.com", "tls.handshake.ja3": "a2fa4f21077551ea651d383707835d7b" } }, { "event_id": "evt-21ff851dbcca44c80589a5d1", "kind": "tls_client_hello", "frame_number": 3847, "timestamp_epoch": "1723680647.738589000", "src_ip": "10.8.15.133", "dst_ip": "23.220.103.18", "src_port": 49764, "dst_port": 443, "tcp_stream": 91, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "25e0b3677a2832677e0c136c73a02311" } }, { "event_id": "evt-c49fe24044b6aa61090fb621", "kind": "tls_client_hello", "frame_number": 3855, "timestamp_epoch": "1723680647.757376000", "src_ip": "10.8.15.133", "dst_ip": "20.42.72.131", "src_port": 49763, "dst_port": 443, "tcp_stream": 90, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "browser.events.data.msn.com", "tls.handshake.ja3": "ab9d07f6268ed23da4f708263cc7ed49" } }, { "event_id": "evt-9f62224ed0a8ff8ca4e13ccb", "kind": "tls_client_hello", "frame_number": 3861, "timestamp_epoch": "1723680647.761701000", "src_ip": "10.8.15.133", "dst_ip": "23.220.103.8", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "th.bing.com", "tls.handshake.ja3": "6925f81e11a98d706da3f0cd0f7bc648" } }, { "event_id": "evt-6deadc84d76b3a311b0ac7d0", "kind": "tls_client_hello", "frame_number": 3868, "timestamp_epoch": "1723680647.778061000", "src_ip": "10.8.15.133", "dst_ip": "13.107.21.237", "src_port": 49765, "dst_port": 443, "tcp_stream": 92, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "c.bing.com", "tls.handshake.ja3": "08c552d3bb717cfa625b1c2e6293fbc3" } }, { "event_id": "evt-09781e4a9f110745a61d0e94", "kind": "tls_client_hello", "frame_number": 3893, "timestamp_epoch": "1723680647.820816000", "src_ip": "10.8.15.133", "dst_ip": "23.53.13.203", "src_port": 49768, "dst_port": 443, "tcp_stream": 95, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "26abc27bb714c3e30049154ed7f03422" } }, { "event_id": "evt-3dc133f087d1cc121404cba4", "kind": "tls_client_hello", "frame_number": 3897, "timestamp_epoch": "1723680647.821215000", "src_ip": "10.8.15.133", "dst_ip": "23.53.13.203", "src_port": 49767, "dst_port": 443, "tcp_stream": 94, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "11702f6f4b7b9c9b2999ebcf2c354984" } }, { "event_id": "evt-443c85b64aeb42e03395866b", "kind": "tls_client_hello", "frame_number": 3901, "timestamp_epoch": "1723680647.821571000", "src_ip": "10.8.15.133", "dst_ip": "23.205.110.12", "src_port": 49770, "dst_port": 443, "tcp_stream": 97, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "img-s-msn-com.akamaized.net", "tls.handshake.ja3": "c44656a187a470fa1e85dfc1707da993" } }, { "event_id": "evt-8c9eea337253b2f3cf75904d", "kind": "tls_client_hello", "frame_number": 3905, "timestamp_epoch": "1723680647.821904000", "src_ip": "10.8.15.133", "dst_ip": "20.125.209.212", "src_port": 49766, "dst_port": 443, "tcp_stream": 93, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "c.msn.com", "tls.handshake.ja3": "68b1b54a6edfe7729708738380263a3a" } }, { "event_id": "evt-0e8dba14cfb3626be09ff25e", "kind": "tls_client_hello", "frame_number": 3909, "timestamp_epoch": "1723680647.822273000", "src_ip": "10.8.15.133", "dst_ip": "18.160.156.115", "src_port": 49769, "dst_port": 443, "tcp_stream": 96, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "sb.scorecardresearch.com", "tls.handshake.ja3": "218b9f26907447fdbf2c8a52418444b7" } }, { "event_id": "evt-8656efd499baadd16fe9de08", "kind": "tls_client_hello", "frame_number": 3919, "timestamp_epoch": "1723680647.835099000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 49771, "dst_port": 443, "tcp_stream": 98, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "api.msn.com", "tls.handshake.ja3": "fc2ac8b293f08f588c5b93dd8b87eef6" } }, { "event_id": "evt-1c6632a413c3dcc0b746817c", "kind": "tls_client_hello", "frame_number": 3940, "timestamp_epoch": "1723680647.883892000", "src_ip": "10.8.15.133", "dst_ip": "13.107.21.237", "src_port": 49765, "dst_port": 443, "tcp_stream": 92, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "c.bing.com", "tls.handshake.ja3": "08c552d3bb717cfa625b1c2e6293fbc3" } }, { "event_id": "evt-ad977f8429270e073b53bed6", "kind": "tls_client_hello", "frame_number": 3946, "timestamp_epoch": "1723680647.901167000", "src_ip": "10.8.15.133", "dst_ip": "20.42.72.131", "src_port": 49763, "dst_port": 443, "tcp_stream": 90, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "browser.events.data.msn.com", "tls.handshake.ja3": "ab9d07f6268ed23da4f708263cc7ed49" } }, { "event_id": "evt-3749f23d479d4dfaf9ce1228", "kind": "tls_client_hello", "frame_number": 3972, "timestamp_epoch": "1723680647.949563000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 49771, "dst_port": 443, "tcp_stream": 98, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "api.msn.com", "tls.handshake.ja3": "fc2ac8b293f08f588c5b93dd8b87eef6" } }, { "event_id": "evt-a52e160ab392b8d612af1360", "kind": "tls_client_hello", "frame_number": 4419, "timestamp_epoch": "1723680648.494630000", "src_ip": "10.8.15.133", "dst_ip": "13.107.246.57", "src_port": 49772, "dst_port": 443, "tcp_stream": 99, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "edge-consumer-static.azureedge.net", "tls.handshake.ja3": "f957ed04f16c95c78f474482505d5e89" } }, { "event_id": "evt-0d225cafec08f697e6460ee9", "kind": "tls_client_hello", "frame_number": 4432, "timestamp_epoch": "1723680648.560629000", "src_ip": "10.8.15.133", "dst_ip": "13.107.246.57", "src_port": 49772, "dst_port": 443, "tcp_stream": 99, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "edge-consumer-static.azureedge.net", "tls.handshake.ja3": "f957ed04f16c95c78f474482505d5e89" } }, { "event_id": "evt-55e5473c64afb0d707cc32d7", "kind": "tls_client_hello", "frame_number": 4483, "timestamp_epoch": "1723680649.064441000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 49773, "dst_port": 443, "tcp_stream": 100, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "srtb.msn.com", "tls.handshake.ja3": "b1e1912cc21fd3c163c8ddf91f56123a" } }, { "event_id": "evt-b4b016d3a213823fd49975e1", "kind": "tls_client_hello", "frame_number": 4489, "timestamp_epoch": "1723680649.193613000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 49773, "dst_port": 443, "tcp_stream": 100, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "srtb.msn.com", "tls.handshake.ja3": "b1e1912cc21fd3c163c8ddf91f56123a" } }, { "event_id": "evt-f9a41080998980fdf1ecd2d2", "kind": "tls_client_hello", "frame_number": 4728, "timestamp_epoch": "1723680649.653743000", "src_ip": "10.8.15.133", "dst_ip": "23.220.103.18", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "2f7a1c53b0a1abfffcdeff101f69baf4" } }, { "event_id": "evt-fc4eb2fe9cee9161e9ba9e19", "kind": "tls_client_hello", "frame_number": 4855, "timestamp_epoch": "1723680649.739700000", "src_ip": "10.8.15.133", "dst_ip": "23.220.103.8", "src_port": 49775, "dst_port": 443, "tcp_stream": 102, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "r.bing.com", "tls.handshake.ja3": "589c33f5c966de68b38bf824fc667e6b" } }, { "event_id": "evt-ba8b8c8ae00bebfe0baf4c57", "kind": "tls_client_hello", "frame_number": 4864, "timestamp_epoch": "1723680649.765409000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.219", "src_port": 49774, "dst_port": 443, "tcp_stream": 101, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "r.msftstatic.com", "tls.handshake.ja3": "33717d60eef91a9c824c343c9b904387" } }, { "event_id": "evt-f999f29725e926af346532f5", "kind": "tls_client_hello", "frame_number": 4871, "timestamp_epoch": "1723680649.780711000", "src_ip": "10.8.15.133", "dst_ip": "23.220.103.8", "src_port": 49776, "dst_port": 443, "tcp_stream": 103, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "r.bing.com", "tls.handshake.ja3": "af8bdb53babadf751a582d1ed25c0eda" } }, { "event_id": "evt-ca7124157a8325290347ce76", "kind": "tls_client_hello", "frame_number": 4951, "timestamp_epoch": "1723680649.813502000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.219", "src_port": 49777, "dst_port": 443, "tcp_stream": 104, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "r.msftstatic.com", "tls.handshake.ja3": "4e96df7dcbca32c279f0af5a0930aa87" } }, { "event_id": "evt-b2a9f2d23f2a03a2a70e660a", "kind": "tls_client_hello", "frame_number": 4986, "timestamp_epoch": "1723680649.895760000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.219", "src_port": 49774, "dst_port": 443, "tcp_stream": 101, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "r.msftstatic.com", "tls.handshake.ja3": "33717d60eef91a9c824c343c9b904387" } }, { "event_id": "evt-0af4df23c81a372dbdb19360", "kind": "tls_client_hello", "frame_number": 5083, "timestamp_epoch": "1723680649.961673000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.219", "src_port": 49777, "dst_port": 443, "tcp_stream": 104, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "r.msftstatic.com", "tls.handshake.ja3": "4e96df7dcbca32c279f0af5a0930aa87" } }, { "event_id": "evt-0e9f678fb514f5feb0002b5c", "kind": "tls_client_hello", "frame_number": 5509, "timestamp_epoch": "1723680650.553411000", "src_ip": "10.8.15.133", "dst_ip": "23.43.244.167", "src_port": 49778, "dst_port": 443, "tcp_stream": 105, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecn-us.dev.virtualearth.net", "tls.handshake.ja3": "09218b185cadc5bc9ac32dd4af1d80ba" } }, { "event_id": "evt-6dcd164b5da3c2b04aa9884c", "kind": "tls_client_hello", "frame_number": 6211, "timestamp_epoch": "1723680655.749003000", "src_ip": "10.8.15.133", "dst_ip": "20.42.72.131", "src_port": 49781, "dst_port": 443, "tcp_stream": 108, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "browser.events.data.msn.com", "tls.handshake.ja3": "11156bf1dc969c54ae91bbfe52874a88" } }, { "event_id": "evt-28609ba737296828ddcbe253", "kind": "tls_client_hello", "frame_number": 6215, "timestamp_epoch": "1723680655.900384000", "src_ip": "10.8.15.133", "dst_ip": "20.42.72.131", "src_port": 49781, "dst_port": 443, "tcp_stream": 108, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "browser.events.data.msn.com", "tls.handshake.ja3": "11156bf1dc969c54ae91bbfe52874a88" } }, { "event_id": "evt-fafcf8dd30ea857be0d0ba32", "kind": "tls_client_hello", "frame_number": 6278, "timestamp_epoch": "1723680656.055329000", "src_ip": "10.8.15.133", "dst_ip": "20.42.72.131", "src_port": 49782, "dst_port": 443, "tcp_stream": 109, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "browser.events.data.msn.com", "tls.handshake.ja3": "fe624dd6795521519b6fbbd082375f4f" } }, { "event_id": "evt-09f5942fdbe2279b6e369466", "kind": "tls_client_hello", "frame_number": 6287, "timestamp_epoch": "1723680656.179337000", "src_ip": "10.8.15.133", "dst_ip": "23.220.103.18", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "173448d57b47fba3f0be89e6bd4599af" } }, { "event_id": "evt-eb36ab0a3f64a36b06f5c8dc", "kind": "tls_client_hello", "frame_number": 6291, "timestamp_epoch": "1723680656.218317000", "src_ip": "10.8.15.133", "dst_ip": "20.42.72.131", "src_port": 49782, "dst_port": 443, "tcp_stream": 109, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "browser.events.data.msn.com", "tls.handshake.ja3": "fe624dd6795521519b6fbbd082375f4f" } }, { "event_id": "evt-8a71242d9ef2651b28dfcdc8", "kind": "tls_client_hello", "frame_number": 6306, "timestamp_epoch": "1723680656.244920000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 49783, "dst_port": 443, "tcp_stream": 110, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "srtb.msn.com", "tls.handshake.ja3": "eb6eb038162eb12fda714a4a5860dc83" } }, { "event_id": "evt-3834f2b34998f883e3cf292a", "kind": "tls_client_hello", "frame_number": 6338, "timestamp_epoch": "1723680656.355466000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 49783, "dst_port": 443, "tcp_stream": 110, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "srtb.msn.com", "tls.handshake.ja3": "eb6eb038162eb12fda714a4a5860dc83" } }, { "event_id": "evt-13f240d66e69263876eeb5e5", "kind": "tls_client_hello", "frame_number": 6379, "timestamp_epoch": "1723680657.384830000", "src_ip": "10.8.15.133", "dst_ip": "20.25.227.174", "src_port": 49784, "dst_port": 443, "tcp_stream": 111, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "nav-edge.smartscreen.microsoft.com", "tls.handshake.ja3": "09d2a38ae19e8be7fa018ad87e43b2ff" } }, { "event_id": "evt-4d0c165f84dad539c1516723", "kind": "tls_client_hello", "frame_number": 8724, "timestamp_epoch": "1723680668.416978000", "src_ip": "10.8.15.133", "dst_ip": "104.40.82.182", "src_port": 49787, "dst_port": 443, "tcp_stream": 114, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "app-edge.smartscreen.microsoft.com", "tls.handshake.ja3": "b7e6d0a42505ebdcb4ca793e16825d04" } }, { "event_id": "evt-0517f8ba99c9a414dc23d2a1", "kind": "tls_client_hello", "frame_number": 8850, "timestamp_epoch": "1723680671.326251000", "src_ip": "10.8.15.133", "dst_ip": "20.10.31.115", "src_port": 49792, "dst_port": 443, "tcp_stream": 119, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "client.wns.windows.com", "tls.handshake.ja3": "6a5d235ee78c6aede6a61448b4e9ff1e" } }, { "event_id": "evt-fe9a6507a5395f4452785076", "kind": "tls_client_hello", "frame_number": 8913, "timestamp_epoch": "1723680681.044773000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.239", "src_port": 49794, "dst_port": 443, "tcp_stream": 121, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "edge.microsoft.com", "tls.handshake.ja3": "22833c8ba3c4d8d22ef4b3ff2fdd992e" } }, { "event_id": "evt-7ce30a528d131913a4fb5c43", "kind": "tls_client_hello", "frame_number": 8922, "timestamp_epoch": "1723680681.092569000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "bzib.nelreports.net", "tls.handshake.ja3": "4e00cf4e4608830803d4914864014e8c" } }, { "event_id": "evt-afc6ac6fc71f1000e2da6948", "kind": "tls_client_hello", "frame_number": 8987, "timestamp_epoch": "1723680681.745462000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.239", "src_port": 49793, "dst_port": 443, "tcp_stream": 120, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "edge.microsoft.com", "tls.handshake.ja3": "49a844a20d27ed5590377789c1ff9a1c" } }, { "event_id": "evt-37bb245d3debdf3a667906e1", "kind": "tls_client_hello", "frame_number": 9006, "timestamp_epoch": "1723680682.359010000", "src_ip": "10.8.15.133", "dst_ip": "23.53.13.196", "src_port": 49798, "dst_port": 443, "tcp_stream": 123, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-942ecd9a3025e24a41225d70", "kind": "tls_client_hello", "frame_number": 9031, "timestamp_epoch": "1723680684.086873000", "src_ip": "10.8.15.133", "dst_ip": "172.67.170.159", "src_port": 49800, "dst_port": 443, "tcp_stream": 124, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "business.checkfedexexp.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-28d23df7ab4daf2e36f82e77", "kind": "tls_client_hello", "frame_number": 10384, "timestamp_epoch": "1723680708.054855000", "src_ip": "10.8.15.133", "dst_ip": "40.126.29.5", "src_port": 49808, "dst_port": 443, "tcp_stream": 132, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.microsoftonline.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-b01aed36e039cb8a9b702641", "kind": "tls_client_hello", "frame_number": 10388, "timestamp_epoch": "1723680708.107727000", "src_ip": "10.8.15.133", "dst_ip": "40.126.29.5", "src_port": 49808, "dst_port": 443, "tcp_stream": 132, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.microsoftonline.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-4dd60e2205e98f7da252283d", "kind": "tls_client_hello", "frame_number": 10429, "timestamp_epoch": "1723680708.980841000", "src_ip": "10.8.15.133", "dst_ip": "52.137.106.217", "src_port": 49809, "dst_port": 443, "tcp_stream": 133, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-60635e159b37d1f8f3726ed5", "kind": "tls_client_hello", "frame_number": 10850, "timestamp_epoch": "1723680726.367792000", "src_ip": "10.8.15.133", "dst_ip": "40.126.29.5", "src_port": 49815, "dst_port": 443, "tcp_stream": 139, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.microsoftonline.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-a9b992e18db95bfa1eb21752", "kind": "tls_client_hello", "frame_number": 10854, "timestamp_epoch": "1723680726.407785000", "src_ip": "10.8.15.133", "dst_ip": "40.126.29.5", "src_port": 49815, "dst_port": 443, "tcp_stream": 139, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.microsoftonline.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-cf08018beeeadd6f1b9d7721", "kind": "tls_client_hello", "frame_number": 10909, "timestamp_epoch": "1723680753.106037000", "src_ip": "10.8.15.133", "dst_ip": "52.182.143.215", "src_port": 49816, "dst_port": 443, "tcp_stream": 140, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-b1e38c4e06181238d0eedad6", "kind": "tls_client_hello", "frame_number": 10943, "timestamp_epoch": "1723680753.503071000", "src_ip": "10.8.15.133", "dst_ip": "52.182.143.215", "src_port": 49817, "dst_port": 443, "tcp_stream": 141, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v20.events.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-adff65129c9117a3bf70c00e", "kind": "tls_client_hello", "frame_number": 11599, "timestamp_epoch": "1723680793.686955000", "src_ip": "10.8.15.133", "dst_ip": "40.126.29.5", "src_port": 49826, "dst_port": 443, "tcp_stream": 150, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.microsoftonline.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-1a9fd705e56e465a58e54b9f", "kind": "tls_client_hello", "frame_number": 11603, "timestamp_epoch": "1723680793.756880000", "src_ip": "10.8.15.133", "dst_ip": "40.126.29.5", "src_port": 49826, "dst_port": 443, "tcp_stream": 150, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.microsoftonline.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-48b02f24f5854b08c1dbc051", "kind": "tls_client_hello", "frame_number": 11700, "timestamp_epoch": "1723680797.564632000", "src_ip": "10.8.15.133", "dst_ip": "52.123.128.254", "src_port": 49832, "dst_port": 443, "tcp_stream": 156, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dual-s-ring.msedge.net", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-660871380a47803a549af137", "kind": "tls_client_hello", "frame_number": 11704, "timestamp_epoch": "1723680797.597999000", "src_ip": "10.8.15.133", "dst_ip": "52.123.128.254", "src_port": 49832, "dst_port": 443, "tcp_stream": 156, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "dual-s-ring.msedge.net", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-824fea6b5fcaaa37bbb93158", "kind": "tls_client_hello", "frame_number": 11736, "timestamp_epoch": "1723680797.856635000", "src_ip": "10.8.15.133", "dst_ip": "23.53.13.205", "src_port": 49833, "dst_port": 443, "tcp_stream": 157, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ow1.res.office365.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-ed59b2dd6d66eb62da03a2e9", "kind": "tls_client_hello", "frame_number": 11770, "timestamp_epoch": "1723680798.323436000", "src_ip": "10.8.15.133", "dst_ip": "13.107.4.254", "src_port": 49834, "dst_port": 443, "tcp_stream": 158, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "c-ring.msedge.net", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-d3c27abdd05e2f4d5c0a1071", "kind": "tls_client_hello", "frame_number": 11774, "timestamp_epoch": "1723680798.387308000", "src_ip": "10.8.15.133", "dst_ip": "13.107.4.254", "src_port": 49834, "dst_port": 443, "tcp_stream": 158, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "c-ring.msedge.net", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-f1bb1d5e0b42c6f234e01a72", "kind": "tls_client_hello", "frame_number": 11806, "timestamp_epoch": "1723680798.779829000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.222", "src_port": 49835, "dst_port": 443, "tcp_stream": 159, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fp.msedge.net", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-84cc0e4992785dfc3daff81e", "kind": "tls_client_hello", "frame_number": 11810, "timestamp_epoch": "1723680798.844463000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.222", "src_port": 49835, "dst_port": 443, "tcp_stream": 159, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fp.msedge.net", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-221d42a1eb4ceecace5c169e", "kind": "tls_client_hello", "frame_number": 11844, "timestamp_epoch": "1723680800.501684000", "src_ip": "10.8.15.133", "dst_ip": "23.220.103.18", "src_port": 49836, "dst_port": 443, "tcp_stream": 160, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "46f5131e766d248db0248a86c494b71c" } }, { "event_id": "evt-4b257080ed398968f8e21937", "kind": "tls_client_hello", "frame_number": 11872, "timestamp_epoch": "1723680800.965893000", "src_ip": "10.8.15.133", "dst_ip": "23.96.180.189", "src_port": 49837, "dst_port": 443, "tcp_stream": 161, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fd.api.iris.microsoft.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-edefc1f11718d176b72be352", "kind": "tls_client_hello", "frame_number": 11908, "timestamp_epoch": "1723680802.854082000", "src_ip": "10.8.15.133", "dst_ip": "23.195.200.230", "src_port": 49838, "dst_port": 443, "tcp_stream": 162, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "cxcs.microsoft.net", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-17066bf8e16cc6e8c9ad6412", "kind": "tls_client_hello", "frame_number": 11912, "timestamp_epoch": "1723680802.863849000", "src_ip": "10.8.15.133", "dst_ip": "23.220.103.72", "src_port": 49839, "dst_port": 443, "tcp_stream": 163, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-e021bc50b44f958481432c38", "kind": "tls_client_hello", "frame_number": 12107, "timestamp_epoch": "1723680857.844217000", "src_ip": "10.8.15.133", "dst_ip": "20.60.228.1", "src_port": 49851, "dst_port": 443, "tcp_stream": 175, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "weathermapdata.blob.core.windows.net", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-4f5a4f96e022b8bab41acb82", "kind": "tls_client_hello", "frame_number": 12111, "timestamp_epoch": "1723680857.925217000", "src_ip": "10.8.15.133", "dst_ip": "20.60.228.1", "src_port": 49851, "dst_port": 443, "tcp_stream": 175, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "weathermapdata.blob.core.windows.net", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-f8b9545c83f54d1b1d48e866", "kind": "tls_client_hello", "frame_number": 12217, "timestamp_epoch": "1723680895.824113000", "src_ip": "10.8.15.133", "dst_ip": "13.107.21.239", "src_port": 49858, "dst_port": 443, "tcp_stream": 182, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "edge.microsoft.com", "tls.handshake.ja3": "e978fa4306e6fe19e2d404321d215b00" } }, { "event_id": "evt-ab435264d74e97e5a1b463f4", "kind": "tls_client_hello", "frame_number": 12265, "timestamp_epoch": "1723680909.364796000", "src_ip": "10.8.15.133", "dst_ip": "52.109.0.136", "src_port": 49861, "dst_port": 443, "tcp_stream": 185, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "mrodevicemgr.officeapps.live.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-c703f2bd87a535ae50f0f96d", "kind": "tls_client_hello", "frame_number": 12292, "timestamp_epoch": "1723680909.941165000", "src_ip": "10.8.15.133", "dst_ip": "23.33.138.184", "src_port": 49862, "dst_port": 443, "tcp_stream": 186, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "go.microsoft.com", "tls.handshake.ja3": "46f5131e766d248db0248a86c494b71c" } }, { "event_id": "evt-e3e15cae1c90ae5da36d7a34", "kind": "tls_client_hello", "frame_number": 12310, "timestamp_epoch": "1723680910.121849000", "src_ip": "10.8.15.133", "dst_ip": "23.33.138.184", "src_port": 49863, "dst_port": 443, "tcp_stream": 187, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "go.microsoft.com", "tls.handshake.ja3": "46f5131e766d248db0248a86c494b71c" } }, { "event_id": "evt-63b80a6019b028dc4220e436", "kind": "tls_client_hello", "frame_number": 12330, "timestamp_epoch": "1723680910.305652000", "src_ip": "10.8.15.133", "dst_ip": "23.33.138.184", "src_port": 49864, "dst_port": 443, "tcp_stream": 188, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "go.microsoft.com", "tls.handshake.ja3": "46f5131e766d248db0248a86c494b71c" } }, { "event_id": "evt-c03c244d61662ce21772a033", "kind": "tls_client_hello", "frame_number": 12351, "timestamp_epoch": "1723680910.483204000", "src_ip": "10.8.15.133", "dst_ip": "23.33.138.184", "src_port": 49865, "dst_port": 443, "tcp_stream": 189, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "go.microsoft.com", "tls.handshake.ja3": "46f5131e766d248db0248a86c494b71c" } }, { "event_id": "evt-2a449f66eb95a60f490b4797", "kind": "tls_client_hello", "frame_number": 12374, "timestamp_epoch": "1723680910.660614000", "src_ip": "10.8.15.133", "dst_ip": "23.33.138.184", "src_port": 49866, "dst_port": 443, "tcp_stream": 190, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "go.microsoft.com", "tls.handshake.ja3": "46f5131e766d248db0248a86c494b71c" } }, { "event_id": "evt-120d90eccc9297d2d080d5d5", "kind": "tls_client_hello", "frame_number": 12395, "timestamp_epoch": "1723680910.902863000", "src_ip": "10.8.15.133", "dst_ip": "23.33.138.184", "src_port": 49867, "dst_port": 443, "tcp_stream": 191, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "go.microsoft.com", "tls.handshake.ja3": "46f5131e766d248db0248a86c494b71c" } }, { "event_id": "evt-e4f84521446d641320e7affd", "kind": "tls_client_hello", "frame_number": 12425, "timestamp_epoch": "1723680911.133796000", "src_ip": "10.8.15.133", "dst_ip": "23.33.138.184", "src_port": 49868, "dst_port": 443, "tcp_stream": 192, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "go.microsoft.com", "tls.handshake.ja3": "46f5131e766d248db0248a86c494b71c" } }, { "event_id": "evt-3d2a474099a83109b27c731e", "kind": "tls_client_hello", "frame_number": 12436, "timestamp_epoch": "1723680911.245372000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 49869, "dst_port": 443, "tcp_stream": 193, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "windows.msn.com", "tls.handshake.ja3": "5c263245de4d50106d8e0d6087b0fcc5" } }, { "event_id": "evt-aec4eaac8c2a0122b4745d72", "kind": "tls_client_hello", "frame_number": 12440, "timestamp_epoch": "1723680911.245835000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 49870, "dst_port": 443, "tcp_stream": 194, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "windows.msn.com", "tls.handshake.ja3": "ec93fbad48fbc839a6e52e85c3f5af8d" } }, { "event_id": "evt-e7aecf2edef1693e4cae2f72", "kind": "tls_client_hello", "frame_number": 12463, "timestamp_epoch": "1723680911.365627000", "src_ip": "10.8.15.133", "dst_ip": "23.33.138.184", "src_port": 49871, "dst_port": 443, "tcp_stream": 195, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "go.microsoft.com", "tls.handshake.ja3": "46f5131e766d248db0248a86c494b71c" } }, { "event_id": "evt-e1a1d4f54b8a028e3937dddf", "kind": "tls_client_hello", "frame_number": 12465, "timestamp_epoch": "1723680911.367043000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 49869, "dst_port": 443, "tcp_stream": 193, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "windows.msn.com", "tls.handshake.ja3": "5c263245de4d50106d8e0d6087b0fcc5" } }, { "event_id": "evt-cdd077d20333b50e14251a1f", "kind": "tls_client_hello", "frame_number": 12467, "timestamp_epoch": "1723680911.367720000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 49870, "dst_port": 443, "tcp_stream": 194, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "windows.msn.com", "tls.handshake.ja3": "ec93fbad48fbc839a6e52e85c3f5af8d" } }, { "event_id": "evt-52a82d618734f75dcfd03116", "kind": "tls_client_hello", "frame_number": 12542, "timestamp_epoch": "1723680911.842842000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 49874, "dst_port": 443, "tcp_stream": 198, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.msn.com", "tls.handshake.ja3": "34f7d1c3fe8b7bb4b8cee1ceefa986a5" } }, { "event_id": "evt-79ada774eb99d9f4e7356a83", "kind": "tls_client_hello", "frame_number": 12546, "timestamp_epoch": "1723680911.963703000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 49874, "dst_port": 443, "tcp_stream": 198, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.msn.com", "tls.handshake.ja3": "34f7d1c3fe8b7bb4b8cee1ceefa986a5" } }, { "event_id": "evt-d2fb7c99a82362a37f111a60", "kind": "tls_client_hello", "frame_number": 12582, "timestamp_epoch": "1723680912.259202000", "src_ip": "10.8.15.133", "dst_ip": "23.223.31.34", "src_port": 49875, "dst_port": 443, "tcp_stream": 199, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "49122e3f86717743d247b0e57255881e" } }, { "event_id": "evt-e597da68e74f932e60d2d7e2", "kind": "tls_client_hello", "frame_number": 12593, "timestamp_epoch": "1723680912.354568000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 49876, "dst_port": 443, "tcp_stream": 200, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "api.msn.com", "tls.handshake.ja3": "0940eef199c4e4a2d7fff1702ca8e267" } }, { "event_id": "evt-002e1ab8f05a2a18525f765f", "kind": "tls_client_hello", "frame_number": 12615, "timestamp_epoch": "1723680912.460984000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 49876, "dst_port": 443, "tcp_stream": 200, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "api.msn.com", "tls.handshake.ja3": "0940eef199c4e4a2d7fff1702ca8e267" } }, { "event_id": "evt-b741740f0cee0eadb3778558", "kind": "tls_client_hello", "frame_number": 12722, "timestamp_epoch": "1723680912.962917000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 49877, "dst_port": 443, "tcp_stream": 201, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "srtb.msn.com", "tls.handshake.ja3": "c6e2484ca73f97e2cbb72bacc9c9916b" } }, { "event_id": "evt-9723c892979ffea406f2ac0e", "kind": "tls_client_hello", "frame_number": 12729, "timestamp_epoch": "1723680913.063117000", "src_ip": "10.8.15.133", "dst_ip": "23.223.31.34", "src_port": 49878, "dst_port": 443, "tcp_stream": 202, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "cd51c3a587eeacaf4f714e3920764550" } }, { "event_id": "evt-f199ecde05ae0bfe0ad1b286", "kind": "tls_client_hello", "frame_number": 12733, "timestamp_epoch": "1723680913.074674000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 49877, "dst_port": 443, "tcp_stream": 201, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "srtb.msn.com", "tls.handshake.ja3": "c6e2484ca73f97e2cbb72bacc9c9916b" } }, { "event_id": "evt-de054bc79e1d289eeb1b42f3", "kind": "tls_client_hello", "frame_number": 12761, "timestamp_epoch": "1723680913.202066000", "src_ip": "10.8.15.133", "dst_ip": "23.205.110.12", "src_port": 49879, "dst_port": 443, "tcp_stream": 203, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "img-s-msn-com.akamaized.net", "tls.handshake.ja3": "b74979b1b06e1413e302d2c817ca33db" } }, { "event_id": "evt-870e58dd0bff0eeeb90c37ec", "kind": "tls_client_hello", "frame_number": 12765, "timestamp_epoch": "1723680913.205044000", "src_ip": "10.8.15.133", "dst_ip": "23.220.103.72", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "th.bing.com", "tls.handshake.ja3": "4d09d5e0a7539f71bfd5ab61fc77938e" } }, { "event_id": "evt-61c054eb43670f13e8ea10b6", "kind": "tls_client_hello", "frame_number": 12788, "timestamp_epoch": "1723680913.241765000", "src_ip": "10.8.15.133", "dst_ip": "23.220.103.72", "src_port": 49880, "dst_port": 443, "tcp_stream": 204, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "th.bing.com", "tls.handshake.ja3": "973e5ee0c53bfc4aaff964c70002dcc3" } }, { "event_id": "evt-2abfea808b2c00d458fc6364", "kind": "tls_client_hello", "frame_number": 12885, "timestamp_epoch": "1723680913.302499000", "src_ip": "10.8.15.133", "dst_ip": "23.60.57.94", "src_port": 49881, "dst_port": 443, "tcp_stream": 205, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "img.s-msn.com", "tls.handshake.ja3": "b4162be74fb260b4576b62481ee819de" } }, { "event_id": "evt-84c143c3a50db8802ac38c92", "kind": "tls_client_hello", "frame_number": 13831, "timestamp_epoch": "1723680988.001569000", "src_ip": "10.8.15.133", "dst_ip": "40.126.29.10", "src_port": 49896, "dst_port": 443, "tcp_stream": 220, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.microsoftonline.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-814f2d0b2c70b1a48672828f", "kind": "tls_client_hello", "frame_number": 13836, "timestamp_epoch": "1723680988.047624000", "src_ip": "10.8.15.133", "dst_ip": "40.126.29.10", "src_port": 49896, "dst_port": 443, "tcp_stream": 220, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.microsoftonline.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-a39e1cff4566d3b678a33851", "kind": "tls_client_hello", "frame_number": 13854, "timestamp_epoch": "1723680988.460545000", "src_ip": "10.8.15.133", "dst_ip": "20.99.184.37", "src_port": 49897, "dst_port": 443, "tcp_stream": 221, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "displaycatalog.mp.microsoft.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-57076ef1e05f996a086e3bc7", "kind": "tls_client_hello", "frame_number": 13893, "timestamp_epoch": "1723680990.287103000", "src_ip": "10.8.15.133", "dst_ip": "52.137.106.217", "src_port": 49899, "dst_port": 443, "tcp_stream": 223, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-ac7acd817d6504eb99306b60", "kind": "tls_client_hello", "frame_number": 13898, "timestamp_epoch": "1723680990.338471000", "src_ip": "10.8.15.133", "dst_ip": "13.85.23.206", "src_port": 49900, "dst_port": 443, "tcp_stream": 224, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fe3cr.delivery.mp.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-8ce6f5b6cdf67bed7cd555b2", "kind": "tls_client_hello", "frame_number": 14102, "timestamp_epoch": "1723681003.222759000", "src_ip": "10.8.15.133", "dst_ip": "20.42.65.94", "src_port": 49903, "dst_port": 443, "tcp_stream": 227, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-373c524a58e7fc0d4c6afade", "kind": "tls_client_hello", "frame_number": 14149, "timestamp_epoch": "1723681007.284513000", "src_ip": "10.8.15.133", "dst_ip": "20.42.65.94", "src_port": 49905, "dst_port": 443, "tcp_stream": 229, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-f0558dc42cc238383921abe4", "kind": "tls_client_hello", "frame_number": 14226, "timestamp_epoch": "1723681037.779398000", "src_ip": "10.8.15.133", "dst_ip": "23.53.13.196", "src_port": 49911, "dst_port": 443, "tcp_stream": 235, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "5919f6108f098e14c2f37619021ebd4d" } }, { "event_id": "evt-2c6bd512ea552e7ed5fc196d", "kind": "tls_client_hello", "frame_number": 14503, "timestamp_epoch": "1723681154.564163000", "src_ip": "10.8.15.133", "dst_ip": "20.241.44.114", "src_port": 49938, "dst_port": 443, "tcp_stream": 259, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "g.live.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-ded0b9ccf832a855d6c901e9", "kind": "tls_client_hello", "frame_number": 14531, "timestamp_epoch": "1723681154.958021000", "src_ip": "10.8.15.133", "dst_ip": "23.56.233.15", "src_port": 49939, "dst_port": 443, "tcp_stream": 260, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "oneclient.sfx.ms", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-a43043bddeab2fc6d22c5a55", "kind": "tls_client_hello", "frame_number": 14640, "timestamp_epoch": "1723681155.458646000", "src_ip": "10.8.15.133", "dst_ip": "52.113.194.132", "src_port": 49941, "dst_port": 443, "tcp_stream": 262, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-9d124e9cdb0c94317e88023a", "kind": "tls_client_hello", "frame_number": 14643, "timestamp_epoch": "1723681155.519827000", "src_ip": "10.8.15.133", "dst_ip": "52.113.194.132", "src_port": 49941, "dst_port": 443, "tcp_stream": 262, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-458c4f3a7787ad39e33511cd", "kind": "tls_client_hello", "frame_number": 14771, "timestamp_epoch": "1723681192.215237000", "src_ip": "10.8.15.133", "dst_ip": "52.152.180.153", "src_port": 49948, "dst_port": 443, "tcp_stream": 269, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fe2cr.update.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-dc898178073b9e55639bab20", "kind": "tls_client_hello", "frame_number": 14931, "timestamp_epoch": "1723681209.903085000", "src_ip": "10.8.15.133", "dst_ip": "20.44.10.122", "src_port": 49952, "dst_port": 443, "tcp_stream": 273, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-63d2a5adaa09b55b54b11a6c", "kind": "tls_client_hello", "frame_number": 15111, "timestamp_epoch": "1723681282.618242000", "src_ip": "10.8.15.133", "dst_ip": "20.3.0.251", "src_port": 49966, "dst_port": 443, "tcp_stream": 287, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "licensing.mp.microsoft.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-689ce3b9deead8c475de5001", "kind": "tls_client_hello", "frame_number": 15181, "timestamp_epoch": "1723681289.668145000", "src_ip": "10.8.15.133", "dst_ip": "23.194.68.140", "src_port": 49968, "dst_port": 443, "tcp_stream": 289, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "storecatalogrevocation.storequality.microsoft.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-4f0e9b66846cfea8dbdc1b91", "kind": "tls_client_hello", "frame_number": 15279, "timestamp_epoch": "1723681312.866135000", "src_ip": "10.8.15.133", "dst_ip": "20.42.65.88", "src_port": 49978, "dst_port": 443, "tcp_stream": 296, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-37c3dde9a53b225c8166de08", "kind": "tls_client_hello", "frame_number": 15354, "timestamp_epoch": "1723681330.075840000", "src_ip": "10.8.15.133", "dst_ip": "23.221.36.164", "src_port": 49983, "dst_port": 443, "tcp_stream": 301, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "armmf.adobe.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-ac057c1c7bcd165e0f57baa9", "kind": "tls_client_hello", "frame_number": 15474, "timestamp_epoch": "1723681381.492002000", "src_ip": "10.8.15.133", "dst_ip": "23.53.13.197", "src_port": 49993, "dst_port": 443, "tcp_stream": 311, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-6bc0597bc2939c6ceff0bda7", "kind": "tls_client_hello", "frame_number": 15771, "timestamp_epoch": "1723681512.285308000", "src_ip": "10.8.15.133", "dst_ip": "52.113.194.132", "src_port": 50017, "dst_port": 443, "tcp_stream": 335, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "258a5a1e95b8a911872bae9081526644" } }, { "event_id": "evt-67f78fd40dde71902e64e203", "kind": "tls_client_hello", "frame_number": 15772, "timestamp_epoch": "1723681512.285354000", "src_ip": "10.8.15.133", "dst_ip": "52.113.194.132", "src_port": 50018, "dst_port": 443, "tcp_stream": 336, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "258a5a1e95b8a911872bae9081526644" } }, { "event_id": "evt-cfba3751a404bd855d489e47", "kind": "tls_client_hello", "frame_number": 15870, "timestamp_epoch": "1723681517.499945000", "src_ip": "10.8.15.133", "dst_ip": "20.25.227.174", "src_port": 50020, "dst_port": 443, "tcp_stream": 338, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "nav.smartscreen.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-b97036d8326baffb8d22d3ec", "kind": "tls_client_hello", "frame_number": 15993, "timestamp_epoch": "1723681540.812330000", "src_ip": "10.8.15.133", "dst_ip": "20.96.153.111", "src_port": 50029, "dst_port": 443, "tcp_stream": 347, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fd.api.iris.microsoft.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-bebb01b991f9245f550c3cbb", "kind": "tls_client_hello", "frame_number": 16284, "timestamp_epoch": "1723681672.709241000", "src_ip": "10.8.15.133", "dst_ip": "52.168.117.170", "src_port": 50053, "dst_port": 443, "tcp_stream": 371, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-7c725060868c8ecd6e5b9d59", "kind": "tls_client_hello", "frame_number": 16578, "timestamp_epoch": "1723681810.679494000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 50078, "dst_port": 443, "tcp_stream": 396, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "windows.msn.com", "tls.handshake.ja3": "46f5131e766d248db0248a86c494b71c" } }, { "event_id": "evt-305548da30e9af8944ac4337", "kind": "tls_client_hello", "frame_number": 16582, "timestamp_epoch": "1723681810.744481000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 50078, "dst_port": 443, "tcp_stream": 396, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "windows.msn.com", "tls.handshake.ja3": "46f5131e766d248db0248a86c494b71c" } }, { "event_id": "evt-52b9e0e12afe9176086b5326", "kind": "tls_client_hello", "frame_number": 16796, "timestamp_epoch": "1723681909.618984000", "src_ip": "10.8.15.133", "dst_ip": "20.189.173.9", "src_port": 50095, "dst_port": 443, "tcp_stream": 413, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-a6ca5e8587999acef9ea8e3f", "kind": "tls_client_hello", "frame_number": 17132, "timestamp_epoch": "1723682071.235006000", "src_ip": "10.8.15.133", "dst_ip": "52.113.194.132", "src_port": 50124, "dst_port": 443, "tcp_stream": 442, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-3474de9efd7b23624127cf43", "kind": "tls_client_hello", "frame_number": 17136, "timestamp_epoch": "1723682071.296752000", "src_ip": "10.8.15.133", "dst_ip": "52.113.194.132", "src_port": 50124, "dst_port": 443, "tcp_stream": 442, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-cb00f891876c9481885dce50", "kind": "tls_client_hello", "frame_number": 17297, "timestamp_epoch": "1723682144.992328000", "src_ip": "10.8.15.133", "dst_ip": "52.113.194.132", "src_port": 50138, "dst_port": 443, "tcp_stream": 456, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "5919f6108f098e14c2f37619021ebd4d" } }, { "event_id": "evt-a5e4a8764b872ca21a86a71e", "kind": "tls_client_hello", "frame_number": 17301, "timestamp_epoch": "1723682145.058887000", "src_ip": "10.8.15.133", "dst_ip": "52.113.194.132", "src_port": 50138, "dst_port": 443, "tcp_stream": 456, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "5919f6108f098e14c2f37619021ebd4d" } }, { "event_id": "evt-48323d8fc3c679da27e0e83e", "kind": "tls_client_hello", "frame_number": 17810, "timestamp_epoch": "1723682392.322492000", "src_ip": "10.8.15.133", "dst_ip": "13.70.79.200", "src_port": 50185, "dst_port": 443, "tcp_stream": 503, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "mobile.events.data.microsoft.com", "tls.handshake.ja3": "5919f6108f098e14c2f37619021ebd4d" } }, { "event_id": "evt-8eceee7d96bd79e0e4f54d4e", "kind": "tls_client_hello", "frame_number": 17814, "timestamp_epoch": "1723682392.527841000", "src_ip": "10.8.15.133", "dst_ip": "13.70.79.200", "src_port": 50185, "dst_port": 443, "tcp_stream": 503, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "mobile.events.data.microsoft.com", "tls.handshake.ja3": "5919f6108f098e14c2f37619021ebd4d" } }, { "event_id": "evt-3a96e3c246e87c0ea8c6ca3f", "kind": "tls_client_hello", "frame_number": 17855, "timestamp_epoch": "1723682399.982309000", "src_ip": "10.8.15.133", "dst_ip": "13.70.79.200", "src_port": 50187, "dst_port": 443, "tcp_stream": 505, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "mobile.events.data.microsoft.com", "tls.handshake.ja3": "5919f6108f098e14c2f37619021ebd4d" } }, { "event_id": "evt-f495772f0d0ce5ec88319e33", "kind": "tls_client_hello", "frame_number": 17859, "timestamp_epoch": "1723682400.232996000", "src_ip": "10.8.15.133", "dst_ip": "13.70.79.200", "src_port": 50187, "dst_port": 443, "tcp_stream": 505, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "mobile.events.data.microsoft.com", "tls.handshake.ja3": "5919f6108f098e14c2f37619021ebd4d" } }, { "event_id": "evt-9efa3f2ff9e44aa6c9afab7a", "kind": "tls_client_hello", "frame_number": 17965, "timestamp_epoch": "1723682445.396810000", "src_ip": "10.8.15.133", "dst_ip": "52.113.194.132", "src_port": 50196, "dst_port": 443, "tcp_stream": 514, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "5919f6108f098e14c2f37619021ebd4d" } }, { "event_id": "evt-500ad3b86d5a6072afcbd14f", "kind": "tls_client_hello", "frame_number": 17971, "timestamp_epoch": "1723682445.474075000", "src_ip": "10.8.15.133", "dst_ip": "52.113.194.132", "src_port": 50196, "dst_port": 443, "tcp_stream": 514, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "5919f6108f098e14c2f37619021ebd4d" } } ], "dhcp": [ { "event_id": "evt-56e641be840d946539cb0995", "kind": "dhcp", "frame_number": 1, "timestamp_epoch": "1723680583.804291000", "src_ip": "0.0.0.0", "dst_ip": "255.255.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "dhcp.hw.mac_addr": "00:1c:bf:03:54:82,00:1c:bf:03:54:82", "dhcp.ip.your": "0.0.0.0", "dhcp.option.dhcp": "3", "dhcp.option.hostname": "DESKTOP-H8ALZBV", "dhcp.option.requested_ip_address": "10.8.15.132", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-bcd62340453c9ae51d6f2517", "kind": "dhcp", "frame_number": 2, "timestamp_epoch": "1723680583.805046000", "src_ip": "10.8.15.4", "dst_ip": "255.255.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 1, "fields": { "dhcp.hw.mac_addr": "00:1c:bf:03:54:82", "dhcp.ip.your": "0.0.0.0", "dhcp.option.dhcp": "6", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-c7b5fb281b4036ec36b3f170", "kind": "dhcp", "frame_number": 3, "timestamp_epoch": "1723680583.815024000", "src_ip": "0.0.0.0", "dst_ip": "255.255.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "dhcp.hw.mac_addr": "00:1c:bf:03:54:82,00:1c:bf:03:54:82", "dhcp.ip.your": "0.0.0.0", "dhcp.option.dhcp": "1", "dhcp.option.hostname": "DESKTOP-H8ALZBV", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-04a71657fa2cc74b3c1f4977", "kind": "dhcp", "frame_number": 4, "timestamp_epoch": "1723680583.815945000", "src_ip": "10.8.15.4", "dst_ip": "255.255.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 1, "fields": { "dhcp.hw.mac_addr": "00:1c:bf:03:54:82", "dhcp.ip.your": "10.8.15.133", "dhcp.option.dhcp": "2", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-7cfd61d26446e82e49c34bda", "kind": "dhcp", "frame_number": 5, "timestamp_epoch": "1723680583.827903000", "src_ip": "0.0.0.0", "dst_ip": "255.255.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "dhcp.hw.mac_addr": "00:1c:bf:03:54:82,00:1c:bf:03:54:82", "dhcp.ip.your": "0.0.0.0", "dhcp.option.dhcp": "3", "dhcp.option.hostname": "DESKTOP-H8ALZBV", "dhcp.option.requested_ip_address": "10.8.15.133", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-f3cc54c7a9c3a322d34d2c49", "kind": "dhcp", "frame_number": 6, "timestamp_epoch": "1723680583.828521000", "src_ip": "10.8.15.4", "dst_ip": "255.255.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 1, "fields": { "dhcp.hw.mac_addr": "00:1c:bf:03:54:82", "dhcp.ip.your": "10.8.15.133", "dhcp.option.dhcp": "5", "eth.src": "64:00:6a:8c:9c:40" } } ], "identity": [ { "event_id": "evt-c1bb6c128867b4451d6ff740", "kind": "identity", "frame_number": 15, "timestamp_epoch": "1723680583.883830000", "src_ip": "10.8.15.133", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 2, "fields": { "dns.qry.name": "DESKTOP-H8ALZBV.local", "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-a3cf6a28b4cc1a1226f4211e", "kind": "identity", "frame_number": 16, "timestamp_epoch": "1723680583.884090000", "src_ip": "10.8.15.133", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 2, "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-8393a6fafc57d7fb283478e5", "kind": "identity", "frame_number": 17, "timestamp_epoch": "1723680583.886077000", "src_ip": "10.8.15.133", "dst_ip": "224.0.0.252", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 3, "fields": { "dns.qry.name": "DESKTOP-H8ALZBV", "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-1227eb8117ab91e695639517", "kind": "identity", "frame_number": 30, "timestamp_epoch": "1723680584.241556000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1c:bf:03:54:82", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-H8ALZBV<00>,DESKTOP-H8ALZBV<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-b117ebd51e46b162d86d4adc", "kind": "identity", "frame_number": 31, "timestamp_epoch": "1723680584.242030000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1c:bf:03:54:82", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "LAFONTAINEBLEU<00>,LAFONTAINEBLEU<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-03cde5d7f1dea0dba2f59b78", "kind": "identity", "frame_number": 50, "timestamp_epoch": "1723680584.603837000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-e7f6632d38a00dfc6fa6bb95", "kind": "identity", "frame_number": 51, "timestamp_epoch": "1723680584.604015000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-1fb8fa930e88428ee7544192", "kind": "identity", "frame_number": 52, "timestamp_epoch": "1723680584.604313000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-57ddb64c8df402449c84c591", "kind": "identity", "frame_number": 57, "timestamp_epoch": "1723680584.988087000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1c:bf:03:54:82", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "LAFONTAINEBLEU<00>,LAFONTAINEBLEU<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-e7f69d56234480855da326df", "kind": "identity", "frame_number": 58, "timestamp_epoch": "1723680584.988227000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1c:bf:03:54:82", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-H8ALZBV<00>,DESKTOP-H8ALZBV<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-c9439b25ebe6c0236b087ce7", "kind": "identity", "frame_number": 103, "timestamp_epoch": "1723680585.739794000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1c:bf:03:54:82", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "LAFONTAINEBLEU<00>,LAFONTAINEBLEU<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-654808a502c291166b08080d", "kind": "identity", "frame_number": 104, "timestamp_epoch": "1723680585.739856000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1c:bf:03:54:82", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-H8ALZBV<00>,DESKTOP-H8ALZBV<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-c71b3f56389acc4d9bb83e6f", "kind": "identity", "frame_number": 151, "timestamp_epoch": "1723680586.099681000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 5, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.CNameString": "desktop-h8alzbv$", "kerberos.msg_type": "10" } }, { "event_id": "evt-f4875a2c6661a5aa5319a078", "kind": "identity", "frame_number": 152, "timestamp_epoch": "1723680586.100123000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 5, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "30" } }, { "event_id": "evt-a5a96acc15cf0aa7a0aae9e2", "kind": "identity", "frame_number": 166, "timestamp_epoch": "1723680586.110090000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 8, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.CNameString": "desktop-h8alzbv$", "kerberos.msg_type": "10" } }, { "event_id": "evt-9d914e628bad3b383faf59cc", "kind": "identity", "frame_number": 169, "timestamp_epoch": "1723680586.110373000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 9, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.CNameString": "desktop-h8alzbv$", "kerberos.msg_type": "10" } }, { "event_id": "evt-a57b273041043cfad23a3bd2", "kind": "identity", "frame_number": 170, "timestamp_epoch": "1723680586.111129000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 8, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "30" } }, { "event_id": "evt-40ba5a049708830ac7e5eb7f", "kind": "identity", "frame_number": 173, "timestamp_epoch": "1723680586.111602000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 9, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.CNameString": "DESKTOP-H8ALZBV$", "kerberos.msg_type": "11" } }, { "event_id": "evt-e0a9faca1e07c2000e4029d5", "kind": "identity", "frame_number": 187, "timestamp_epoch": "1723680586.120910000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.CNameString": "desktop-h8alzbv$", "kerberos.msg_type": "10" } }, { "event_id": "evt-0acc2493ee63c0e259ee609b", "kind": "identity", "frame_number": 195, "timestamp_epoch": "1723680586.122161000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.CNameString": "DESKTOP-H8ALZBV$", "kerberos.msg_type": "11" } }, { "event_id": "evt-3e7fbfc6eb9dde254e4ee42f", "kind": "identity", "frame_number": 200, "timestamp_epoch": "1723680586.122720000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.CNameString": "desktop-h8alzbv$", "kerberos.msg_type": "10" } }, { "event_id": "evt-58bf1b35576a1e76c8a65eff", "kind": "identity", "frame_number": 203, "timestamp_epoch": "1723680586.123226000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "30" } }, { "event_id": "evt-603480728352ffa072589d72", "kind": "identity", "frame_number": 217, "timestamp_epoch": "1723680586.132883000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-3756d6605479abe3e13d20b2", "kind": "identity", "frame_number": 220, "timestamp_epoch": "1723680586.133031000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 14, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-375af1df00b92b6ad678e9f7", "kind": "identity", "frame_number": 224, "timestamp_epoch": "1723680586.133379000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 16, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.CNameString": "desktop-h8alzbv$", "kerberos.msg_type": "10" } }, { "event_id": "evt-2008ee81dcc804a02f004332", "kind": "identity", "frame_number": 226, "timestamp_epoch": "1723680586.134061000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.CNameString": "DESKTOP-H8ALZBV$", "kerberos.msg_type": "13" } }, { "event_id": "evt-ef6966165b698f8143a0d6af", "kind": "identity", "frame_number": 228, "timestamp_epoch": "1723680586.134077000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 14, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.CNameString": "DESKTOP-H8ALZBV$", "kerberos.msg_type": "13" } }, { "event_id": "evt-3181ce233b5f81d72f92cfc8", "kind": "identity", "frame_number": 231, "timestamp_epoch": "1723680586.134839000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 16, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.CNameString": "DESKTOP-H8ALZBV$", "kerberos.msg_type": "11" } }, { "event_id": "evt-dec3d04be8a2d9b966f90fdc", "kind": "identity", "frame_number": 254, "timestamp_epoch": "1723680586.152745000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 17, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-feabb0a42ba545d934c6583b", "kind": "identity", "frame_number": 256, "timestamp_epoch": "1723680586.152857000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-ffd80d4244f2ade32177a383", "kind": "identity", "frame_number": 261, "timestamp_epoch": "1723680586.153796000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 17, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.CNameString": "DESKTOP-H8ALZBV$", "kerberos.msg_type": "13" } }, { "event_id": "evt-27048a9118ff51a3bc9d1b9d", "kind": "identity", "frame_number": 264, "timestamp_epoch": "1723680586.154217000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.CNameString": "DESKTOP-H8ALZBV$", "kerberos.msg_type": "13" } }, { "event_id": "evt-a989a48ad5d00b5a3ec491e1", "kind": "identity", "frame_number": 274, "timestamp_epoch": "1723680586.156172000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-408da90c24b5676149920872", "kind": "identity", "frame_number": 276, "timestamp_epoch": "1723680586.156934000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-a37872e103de4e2b2d7e316f", "kind": "identity", "frame_number": 279, "timestamp_epoch": "1723680586.160578000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "15" } }, { "event_id": "evt-dddac0d254b359fbcf86262a", "kind": "identity", "frame_number": 295, "timestamp_epoch": "1723680586.165042000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-db31aa23d65a7c60d19d867f", "kind": "identity", "frame_number": 299, "timestamp_epoch": "1723680586.165682000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-e061c8bd41e3e93929a921b1", "kind": "identity", "frame_number": 307, "timestamp_epoch": "1723680586.169687000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-79c15e0551711be76c28ca30", "kind": "identity", "frame_number": 309, "timestamp_epoch": "1723680586.170227000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-c5b6bba3375b0715d740ff7f", "kind": "identity", "frame_number": 310, "timestamp_epoch": "1723680586.170761000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "15" } }, { "event_id": "evt-3cf16105aefb1d189ac86ab8", "kind": "identity", "frame_number": 323, "timestamp_epoch": "1723680586.200229000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-a928c416da979476ff73ec45", "kind": "identity", "frame_number": 325, "timestamp_epoch": "1723680586.200947000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-0fd1d2bfdc73a31bd133b0f0", "kind": "identity", "frame_number": 329, "timestamp_epoch": "1723680586.215804000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "15" } }, { "event_id": "evt-71fa38aabe66a75c5fccf704", "kind": "identity", "frame_number": 339, "timestamp_epoch": "1723680586.228486000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-42eca8c2da498f6f3753a48d", "kind": "identity", "frame_number": 342, "timestamp_epoch": "1723680586.228979000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-84d409a292710af9f7e9154d", "kind": "identity", "frame_number": 344, "timestamp_epoch": "1723680586.229640000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-906f9ca6d1d2a4f81001ffd6", "kind": "identity", "frame_number": 345, "timestamp_epoch": "1723680586.229864000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-987e2cb8b6ad10ec91cac027", "kind": "identity", "frame_number": 346, "timestamp_epoch": "1723680586.231080000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-e10f9f21ddc39bfce2c53cfd", "kind": "identity", "frame_number": 347, "timestamp_epoch": "1723680586.231232000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-a17d8fa00f93f099645cc3e3", "kind": "identity", "frame_number": 352, "timestamp_epoch": "1723680586.238884000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-0b8bbbcffd0e3e42f79c0e50", "kind": "identity", "frame_number": 353, "timestamp_epoch": "1723680586.239062000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-d12f7f45d39ed8445551fbee", "kind": "identity", "frame_number": 359, "timestamp_epoch": "1723680586.305176000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-28f362f294ccac9658d47031", "kind": "identity", "frame_number": 360, "timestamp_epoch": "1723680586.305692000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-dd9a0d74631c2ef8040729f1", "kind": "identity", "frame_number": 387, "timestamp_epoch": "1723680586.346645000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-6cae31890e0f8242d5c022b9", "kind": "identity", "frame_number": 390, "timestamp_epoch": "1723680586.347727000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 23, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.CNameString": "DESKTOP-H8ALZBV$", "kerberos.msg_type": "13" } }, { "event_id": "evt-27ca0317bca34849db54325e", "kind": "identity", "frame_number": 400, "timestamp_epoch": "1723680586.400406000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 22, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-f190481d8ff87f9605d45e9f", "kind": "identity", "frame_number": 402, "timestamp_epoch": "1723680586.401590000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 22, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-c5782a59814729d25b6b7162", "kind": "identity", "frame_number": 403, "timestamp_epoch": "1723680586.404303000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 22, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "15" } }, { "event_id": "evt-aad1a172f6f3edab10a473da", "kind": "identity", "frame_number": 413, "timestamp_epoch": "1723680586.417634000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-7a5eb887642aed7afa045e5c", "kind": "identity", "frame_number": 416, "timestamp_epoch": "1723680586.418281000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-bc8e0387c8827911f7e659f6", "kind": "identity", "frame_number": 417, "timestamp_epoch": "1723680586.419173000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-e9cc32e4307690b6e361af39", "kind": "identity", "frame_number": 419, "timestamp_epoch": "1723680586.419532000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "15" } }, { "event_id": "evt-13862eede1c6d6f6f1994af7", "kind": "identity", "frame_number": 421, "timestamp_epoch": "1723680586.419758000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-f3ce7aba55c0f0237cdb2d60", "kind": "identity", "frame_number": 446, "timestamp_epoch": "1723680586.500412000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1c:bf:03:54:82", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-H8ALZBV<00>,DESKTOP-H8ALZBV<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-610639261dc27a4da4727c65", "kind": "identity", "frame_number": 447, "timestamp_epoch": "1723680586.500505000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1c:bf:03:54:82", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "LAFONTAINEBLEU<00>,LAFONTAINEBLEU<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-4b915e550b78cd6dbdb6ed43", "kind": "identity", "frame_number": 471, "timestamp_epoch": "1723680586.644505000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1c:bf:03:54:82", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-H8ALZBV<20>,DESKTOP-H8ALZBV<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-feff03e96f77bd588889a334", "kind": "identity", "frame_number": 482, "timestamp_epoch": "1723680586.861444000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-3cacc602b6386ee06c9a5458", "kind": "identity", "frame_number": 484, "timestamp_epoch": "1723680586.862253000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-e34a13356e9a07c84e6136af", "kind": "identity", "frame_number": 490, "timestamp_epoch": "1723680586.913512000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 28, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-5ed6e156411d1cceed59ef3b", "kind": "identity", "frame_number": 493, "timestamp_epoch": "1723680586.914545000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 28, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.CNameString": "DESKTOP-H8ALZBV$", "kerberos.msg_type": "13" } }, { "event_id": "evt-c9f3a9eb06cab196c1766a3c", "kind": "identity", "frame_number": 504, "timestamp_epoch": "1723680586.923457000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-cb361f085b9a8d2cbe6301c6", "kind": "identity", "frame_number": 506, "timestamp_epoch": "1723680586.924302000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-18459286b31b2f18b10a23b2", "kind": "identity", "frame_number": 518, "timestamp_epoch": "1723680586.975834000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 30, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-1e09e8d47d7c322c3386f9ba", "kind": "identity", "frame_number": 521, "timestamp_epoch": "1723680586.976933000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 30, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.CNameString": "DESKTOP-H8ALZBV$", "kerberos.msg_type": "13" } }, { "event_id": "evt-5fa37c7b1a39305afd65216d", "kind": "identity", "frame_number": 530, "timestamp_epoch": "1723680586.979337000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 31, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-d09c12ca8c9173f111855be0", "kind": "identity", "frame_number": 533, "timestamp_epoch": "1723680586.979822000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 31, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.CNameString": "DESKTOP-H8ALZBV$", "kerberos.msg_type": "13" } }, { "event_id": "evt-baf99a2041eab764459973e1", "kind": "identity", "frame_number": 540, "timestamp_epoch": "1723680586.980980000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-08b905c7ac6ee6f5f21b69a7", "kind": "identity", "frame_number": 542, "timestamp_epoch": "1723680586.981938000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-0af83687d60a7e33eac87308", "kind": "identity", "frame_number": 543, "timestamp_epoch": "1723680586.983780000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-f2f25e4ab570581335d76db8", "kind": "identity", "frame_number": 544, "timestamp_epoch": "1723680586.983993000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-ff719dc8479eb14409e2571a", "kind": "identity", "frame_number": 545, "timestamp_epoch": "1723680586.987953000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-4a3aae13bd7286b691ddf6ed", "kind": "identity", "frame_number": 546, "timestamp_epoch": "1723680586.988276000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-4bc8be4587106552d1ee90d5", "kind": "identity", "frame_number": 547, "timestamp_epoch": "1723680586.990270000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-6d3e5d0bae511a166896f827", "kind": "identity", "frame_number": 550, "timestamp_epoch": "1723680586.990537000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-b541c37ec6fc4a3df2f82570", "kind": "identity", "frame_number": 553, "timestamp_epoch": "1723680586.994776000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-dbdb55883b87860c568581ed", "kind": "identity", "frame_number": 554, "timestamp_epoch": "1723680586.994946000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-ba1bea5331e0d20b9bb3ace6", "kind": "identity", "frame_number": 555, "timestamp_epoch": "1723680587.004471000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-478491b1e48cb4ad436255ed", "kind": "identity", "frame_number": 556, "timestamp_epoch": "1723680587.004893000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-092eac84611f20737d683160", "kind": "identity", "frame_number": 557, "timestamp_epoch": "1723680587.009559000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-74383782327427dbb22611ab", "kind": "identity", "frame_number": 558, "timestamp_epoch": "1723680587.009944000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-a51a04bb1c24608dced47b25", "kind": "identity", "frame_number": 559, "timestamp_epoch": "1723680587.011950000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-e9128b877c8f0860995d6069", "kind": "identity", "frame_number": 560, "timestamp_epoch": "1723680587.012234000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-7717ed96b200fd16bdee3940", "kind": "identity", "frame_number": 561, "timestamp_epoch": "1723680587.026014000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-dac6b77a9601d666b9370b1f", "kind": "identity", "frame_number": 562, "timestamp_epoch": "1723680587.026302000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-bebe5b14775a393d3856f109", "kind": "identity", "frame_number": 563, "timestamp_epoch": "1723680587.036644000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-9404d63c20bd20f6fe774d60", "kind": "identity", "frame_number": 564, "timestamp_epoch": "1723680587.036997000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-9f1ad45a21fcc4754d072d74", "kind": "identity", "frame_number": 565, "timestamp_epoch": "1723680587.039224000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-8bf8bc93d56d5a86fb924514", "kind": "identity", "frame_number": 566, "timestamp_epoch": "1723680587.039646000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-222e400e5a42532ab3f38552", "kind": "identity", "frame_number": 567, "timestamp_epoch": "1723680587.040630000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-82fa1bb75b7adfa80ba07e4c", "kind": "identity", "frame_number": 568, "timestamp_epoch": "1723680587.040936000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-8f2cb64f78780cd4fab286ab", "kind": "identity", "frame_number": 569, "timestamp_epoch": "1723680587.041691000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-be06ed897b77512acc3c666b", "kind": "identity", "frame_number": 570, "timestamp_epoch": "1723680587.042037000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-93c0811112f7ef2ab6b3b4f3", "kind": "identity", "frame_number": 571, "timestamp_epoch": "1723680587.042419000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-1ec4f4a2aa853e078e703a4c", "kind": "identity", "frame_number": 572, "timestamp_epoch": "1723680587.042558000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-8f1d5d7c68e98a14c0970ade", "kind": "identity", "frame_number": 573, "timestamp_epoch": "1723680587.046355000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-2e522764e13723086f19a687", "kind": "identity", "frame_number": 574, "timestamp_epoch": "1723680587.046677000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-4f8c4267e1da84935a0458d7", "kind": "identity", "frame_number": 575, "timestamp_epoch": "1723680587.048398000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-2af30d8772171945cc11723c", "kind": "identity", "frame_number": 576, "timestamp_epoch": "1723680587.048778000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-540f40576643e7722215742c", "kind": "identity", "frame_number": 577, "timestamp_epoch": "1723680587.053216000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-cffb80c4fe719f931f845a47", "kind": "identity", "frame_number": 578, "timestamp_epoch": "1723680587.053378000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-bffd95c1a6e02329801c51b6", "kind": "identity", "frame_number": 579, "timestamp_epoch": "1723680587.054793000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-c068e8df3c15142c047153b4", "kind": "identity", "frame_number": 580, "timestamp_epoch": "1723680587.055003000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-501f9c3e496f75fcf03042db", "kind": "identity", "frame_number": 581, "timestamp_epoch": "1723680587.055715000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-aaf62cc6ac193d62a36f0a6c", "kind": "identity", "frame_number": 582, "timestamp_epoch": "1723680587.055999000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-06ba20006e5b917bf369be7c", "kind": "identity", "frame_number": 583, "timestamp_epoch": "1723680587.057715000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-555163ff8609dc58e732cbba", "kind": "identity", "frame_number": 584, "timestamp_epoch": "1723680587.057963000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-01755d1033dd90f093c91843", "kind": "identity", "frame_number": 585, "timestamp_epoch": "1723680587.060803000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-382d1341e6844a82792aefc1", "kind": "identity", "frame_number": 586, "timestamp_epoch": "1723680587.061001000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-7e41ed2b4ebf28af047f47c9", "kind": "identity", "frame_number": 587, "timestamp_epoch": "1723680587.064019000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-d6fed67f9b9eba9910828f7b", "kind": "identity", "frame_number": 588, "timestamp_epoch": "1723680587.064175000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-65e7672330b656e64ed1c292", "kind": "identity", "frame_number": 589, "timestamp_epoch": "1723680587.067149000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-0cc57640a01831dadca6a2b5", "kind": "identity", "frame_number": 590, "timestamp_epoch": "1723680587.067374000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-5aa044ba03065ce2140ae00e", "kind": "identity", "frame_number": 591, "timestamp_epoch": "1723680587.069415000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-e2f25f7e6e907f94536ac311", "kind": "identity", "frame_number": 592, "timestamp_epoch": "1723680587.069552000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-c9214a0f126b2aeb1353a899", "kind": "identity", "frame_number": 593, "timestamp_epoch": "1723680587.070994000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-4f1e4600acc4f26e1d380fc1", "kind": "identity", "frame_number": 594, "timestamp_epoch": "1723680587.071250000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-a2c25cc47b811ee0daebaa01", "kind": "identity", "frame_number": 595, "timestamp_epoch": "1723680587.073635000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-836b87f0c41dce065983e566", "kind": "identity", "frame_number": 596, "timestamp_epoch": "1723680587.073884000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-abf0444a252c628ee82bcbb3", "kind": "identity", "frame_number": 597, "timestamp_epoch": "1723680587.076467000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-8be74ea08fcef2af694af99e", "kind": "identity", "frame_number": 598, "timestamp_epoch": "1723680587.076669000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-f362a53f4ae2edf54c71c276", "kind": "identity", "frame_number": 599, "timestamp_epoch": "1723680587.079680000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-59f98ef11580d1be2f537cc6", "kind": "identity", "frame_number": 600, "timestamp_epoch": "1723680587.079857000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-a614e2659d2a3980beea5378", "kind": "identity", "frame_number": 601, "timestamp_epoch": "1723680587.087138000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-974c6670e1cb35bdccc6647d", "kind": "identity", "frame_number": 602, "timestamp_epoch": "1723680587.087391000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-c13754d88e31432d0e45198d", "kind": "identity", "frame_number": 603, "timestamp_epoch": "1723680587.089924000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-8ee9b73aa5aeca7532d9203b", "kind": "identity", "frame_number": 604, "timestamp_epoch": "1723680587.090084000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-c0249b189dd17943e6bf45b3", "kind": "identity", "frame_number": 605, "timestamp_epoch": "1723680587.127167000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-5f2fe3171453a774b4cc2300", "kind": "identity", "frame_number": 606, "timestamp_epoch": "1723680587.127574000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-32fb0b4eba878765ee5bde25", "kind": "identity", "frame_number": 607, "timestamp_epoch": "1723680587.128842000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-1c1535a893ad466d7053f687", "kind": "identity", "frame_number": 608, "timestamp_epoch": "1723680587.129043000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-8ce05a6dcb3c81cb5cd5d122", "kind": "identity", "frame_number": 609, "timestamp_epoch": "1723680587.130929000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-d3bbcc04f622a63bb3014a28", "kind": "identity", "frame_number": 610, "timestamp_epoch": "1723680587.131268000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-33c5762d9589d0455786973f", "kind": "identity", "frame_number": 611, "timestamp_epoch": "1723680587.132375000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-0c32801701a87e7eb8473455", "kind": "identity", "frame_number": 612, "timestamp_epoch": "1723680587.132565000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-be42613b728deec01f81bb9a", "kind": "identity", "frame_number": 613, "timestamp_epoch": "1723680587.140879000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-4fad70d75208500b30e36c9b", "kind": "identity", "frame_number": 614, "timestamp_epoch": "1723680587.141076000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-424a2fcdb8e9da873d4766ac", "kind": "identity", "frame_number": 615, "timestamp_epoch": "1723680587.147837000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-d86f32ef5a428f4a3973b852", "kind": "identity", "frame_number": 616, "timestamp_epoch": "1723680587.148002000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-2f9121296279c4601d240b59", "kind": "identity", "frame_number": 617, "timestamp_epoch": "1723680587.149745000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-ae39e1a97a380feb5b6e8e5d", "kind": "identity", "frame_number": 618, "timestamp_epoch": "1723680587.149958000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-d441ab24fd7f9cc4c33c6872", "kind": "identity", "frame_number": 619, "timestamp_epoch": "1723680587.153529000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-b8861e693148493caeee99e2", "kind": "identity", "frame_number": 620, "timestamp_epoch": "1723680587.153719000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-f81d18fadcfa2a9c603180b9", "kind": "identity", "frame_number": 621, "timestamp_epoch": "1723680587.159664000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-e196de2062ff397071c012e6", "kind": "identity", "frame_number": 622, "timestamp_epoch": "1723680587.159825000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-3d1601edd252e9da02f70985", "kind": "identity", "frame_number": 624, "timestamp_epoch": "1723680587.165651000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-e7de5d61762efb724793d91a", "kind": "identity", "frame_number": 625, "timestamp_epoch": "1723680587.165805000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-5496fc4263b6095510e2e5cd", "kind": "identity", "frame_number": 626, "timestamp_epoch": "1723680587.167745000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-12b6f28d49de0b467f7ba64b", "kind": "identity", "frame_number": 627, "timestamp_epoch": "1723680587.167956000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-08cd0d2ec8113b8f42f7e8cb", "kind": "identity", "frame_number": 628, "timestamp_epoch": "1723680587.168576000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-2f4b64030304396df72b4420", "kind": "identity", "frame_number": 629, "timestamp_epoch": "1723680587.168771000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-48a7be91a7ddcffd445daeca", "kind": "identity", "frame_number": 630, "timestamp_epoch": "1723680587.169786000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-3998af47bd28b56198b72c1f", "kind": "identity", "frame_number": 631, "timestamp_epoch": "1723680587.170014000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-003f885edb6365e7c8aa1064", "kind": "identity", "frame_number": 632, "timestamp_epoch": "1723680587.171086000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-7be1487f70c0385dafffdee7", "kind": "identity", "frame_number": 634, "timestamp_epoch": "1723680587.171251000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-c42de0cf1a93ff5efbad3899", "kind": "identity", "frame_number": 636, "timestamp_epoch": "1723680587.172350000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-92efe7783419792a8b70a1f2", "kind": "identity", "frame_number": 637, "timestamp_epoch": "1723680587.172472000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-9b76dd554759c915b5441600", "kind": "identity", "frame_number": 638, "timestamp_epoch": "1723680587.181167000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-5fa7bf43c3abb4d825bca5a1", "kind": "identity", "frame_number": 639, "timestamp_epoch": "1723680587.181491000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-df10525743c504d5f745a6a3", "kind": "identity", "frame_number": 641, "timestamp_epoch": "1723680587.182826000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-db03eb35e2521adcd1ccad0f", "kind": "identity", "frame_number": 642, "timestamp_epoch": "1723680587.183014000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-ebe468ce7a115a8c744de589", "kind": "identity", "frame_number": 643, "timestamp_epoch": "1723680587.185778000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-46eed47358ce93fd554bd66e", "kind": "identity", "frame_number": 644, "timestamp_epoch": "1723680587.185900000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-66747b74b592ad0fc0a05957", "kind": "identity", "frame_number": 645, "timestamp_epoch": "1723680587.197062000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-da47ee5851a5d9c8cde59932", "kind": "identity", "frame_number": 646, "timestamp_epoch": "1723680587.197343000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-2030d42c551f72cb410ccc80", "kind": "identity", "frame_number": 647, "timestamp_epoch": "1723680587.199074000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-3c3dad60b51a53845405f262", "kind": "identity", "frame_number": 648, "timestamp_epoch": "1723680587.199211000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-d7b4afff406fe448322e5303", "kind": "identity", "frame_number": 649, "timestamp_epoch": "1723680587.200140000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-9793a963bae10a536723a625", "kind": "identity", "frame_number": 650, "timestamp_epoch": "1723680587.200403000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-32e651e35c8f56c7a9ea0e8e", "kind": "identity", "frame_number": 651, "timestamp_epoch": "1723680587.201951000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-68f63d68f5e0b701e0292883", "kind": "identity", "frame_number": 652, "timestamp_epoch": "1723680587.202083000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-747545eb631da29c6dcbff0d", "kind": "identity", "frame_number": 653, "timestamp_epoch": "1723680587.208362000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-ba5f44dc5f30d2950b7390cf", "kind": "identity", "frame_number": 654, "timestamp_epoch": "1723680587.208530000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-eb20580b0ecf05551ae0e825", "kind": "identity", "frame_number": 655, "timestamp_epoch": "1723680587.217702000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-ef5d428189519c33fff31931", "kind": "identity", "frame_number": 656, "timestamp_epoch": "1723680587.217988000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-22ea440f7d56bc397046ae97", "kind": "identity", "frame_number": 657, "timestamp_epoch": "1723680587.218725000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-e903b80253cf03aab57808b5", "kind": "identity", "frame_number": 658, "timestamp_epoch": "1723680587.218877000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-c2998d04dea89d787c3aa2bc", "kind": "identity", "frame_number": 659, "timestamp_epoch": "1723680587.220876000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-ef634edf7734bdf061d3e605", "kind": "identity", "frame_number": 660, "timestamp_epoch": "1723680587.221042000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-7f46b5f2bc8aa56d7afacfe0", "kind": "identity", "frame_number": 661, "timestamp_epoch": "1723680587.223495000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-9194839e7ddf7cd7b82f7a13", "kind": "identity", "frame_number": 662, "timestamp_epoch": "1723680587.223695000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-fe12067a1683427f2b374ad1", "kind": "identity", "frame_number": 665, "timestamp_epoch": "1723680587.227489000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-dca9da06f557e8911d907402", "kind": "identity", "frame_number": 666, "timestamp_epoch": "1723680587.227655000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-41187d1779ed3598ae0fabd3", "kind": "identity", "frame_number": 667, "timestamp_epoch": "1723680587.228264000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-2d9000683d738f00bad9a281", "kind": "identity", "frame_number": 668, "timestamp_epoch": "1723680587.228412000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-4a095ed172124659e629a481", "kind": "identity", "frame_number": 693, "timestamp_epoch": "1723680587.408847000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1c:bf:03:54:82", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-H8ALZBV<20>,DESKTOP-H8ALZBV<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-de61c83f934eb3fb040fa1a6", "kind": "identity", "frame_number": 730, "timestamp_epoch": "1723680588.173575000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1c:bf:03:54:82", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-H8ALZBV<20>,DESKTOP-H8ALZBV<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-6aa0a3c5731ef3e82ae26b13", "kind": "identity", "frame_number": 759, "timestamp_epoch": "1723680588.933467000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 6, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1c:bf:03:54:82", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-H8ALZBV<20>,DESKTOP-H8ALZBV<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-80b44d403f443a1f6d95e875", "kind": "identity", "frame_number": 771, "timestamp_epoch": "1723680589.060655000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-7d0ba27eb69a35d4c4ac50a8", "kind": "identity", "frame_number": 773, "timestamp_epoch": "1723680589.061369000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-071c4be280e0b71d90f46e80", "kind": "identity", "frame_number": 774, "timestamp_epoch": "1723680589.061695000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "15" } }, { "event_id": "evt-40d924e241d5222cdd0bb92b", "kind": "identity", "frame_number": 810, "timestamp_epoch": "1723680589.324404000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 36, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-aa2a68b6bcfab83fe0d0953a", "kind": "identity", "frame_number": 812, "timestamp_epoch": "1723680589.325251000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 36, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-62236238d9289b63b37eba1c", "kind": "identity", "frame_number": 823, "timestamp_epoch": "1723680589.330954000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 37, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-332f417ee90f508419b85dce", "kind": "identity", "frame_number": 825, "timestamp_epoch": "1723680589.331594000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 37, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-87cdd33c68a82911b1c4b63f", "kind": "identity", "frame_number": 841, "timestamp_epoch": "1723680589.743833000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 18, "fields": { "browser.server": "DESKTOP-H8ALZBV", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-3c1301d0d4866b1e401700f3", "kind": "identity", "frame_number": 897, "timestamp_epoch": "1723680594.913590000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-bc015f8872857c00407d2778", "kind": "identity", "frame_number": 899, "timestamp_epoch": "1723680594.914633000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-fa9ba4ee5f3329cb7a276b3a", "kind": "identity", "frame_number": 914, "timestamp_epoch": "1723680594.931067000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 40, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-4130ea470c0f5b5802af0571", "kind": "identity", "frame_number": 916, "timestamp_epoch": "1723680594.931841000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 40, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-b912ff46beaaed86aa135a2e", "kind": "identity", "frame_number": 922, "timestamp_epoch": "1723680594.933396000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 41, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.CNameString": "DESKTOP-H8ALZBV$", "kerberos.msg_type": "10" } }, { "event_id": "evt-40c30e26cdfe054dc294fe75", "kind": "identity", "frame_number": 923, "timestamp_epoch": "1723680594.933856000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 41, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "30" } }, { "event_id": "evt-91d2fe41c595d0ee47822575", "kind": "identity", "frame_number": 930, "timestamp_epoch": "1723680594.934916000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 42, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.CNameString": "DESKTOP-H8ALZBV$", "kerberos.msg_type": "10" } }, { "event_id": "evt-c5fc7cfa4155559da689e3a0", "kind": "identity", "frame_number": 932, "timestamp_epoch": "1723680594.935625000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 42, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.CNameString": "DESKTOP-H8ALZBV$", "kerberos.msg_type": "11" } }, { "event_id": "evt-89e0a68c95a7fe3346994e0d", "kind": "identity", "frame_number": 941, "timestamp_epoch": "1723680594.936315000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-6037dd36837f3a58da681f3b", "kind": "identity", "frame_number": 944, "timestamp_epoch": "1723680594.937013000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.CNameString": "DESKTOP-H8ALZBV$", "kerberos.msg_type": "13" } }, { "event_id": "evt-845a507117b1fe57ead458d7", "kind": "identity", "frame_number": 965, "timestamp_epoch": "1723680600.745604000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-da14e9d84760917d0652baa8", "kind": "identity", "frame_number": 966, "timestamp_epoch": "1723680600.746181000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-82a1aea7bc276fb1e9520547", "kind": "identity", "frame_number": 967, "timestamp_epoch": "1723680600.746517000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-f90bd906f0d9d78cefa451d9", "kind": "identity", "frame_number": 968, "timestamp_epoch": "1723680600.746844000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-f098e0361ff5f31c778883a4", "kind": "identity", "frame_number": 975, "timestamp_epoch": "1723680608.106952000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 44, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.CNameString": "plucero", "kerberos.msg_type": "10" } }, { "event_id": "evt-72b0c2cccc64661ebb02f370", "kind": "identity", "frame_number": 976, "timestamp_epoch": "1723680608.107848000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 44, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "30" } }, { "event_id": "evt-c959718bc70f84c21dab4020", "kind": "identity", "frame_number": 983, "timestamp_epoch": "1723680608.115612000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 45, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.CNameString": "plucero", "kerberos.msg_type": "10" } }, { "event_id": "evt-4e7d237a212ca324be9034e7", "kind": "identity", "frame_number": 985, "timestamp_epoch": "1723680608.116435000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 45, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.CNameString": "plucero", "kerberos.msg_type": "11" } }, { "event_id": "evt-adc4b5ef0658ba4ebd19725b", "kind": "identity", "frame_number": 994, "timestamp_epoch": "1723680608.117764000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 46, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-868521fc1e03cd18f32529b7", "kind": "identity", "frame_number": 997, "timestamp_epoch": "1723680608.118716000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 46, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.CNameString": "plucero", "kerberos.msg_type": "13" } }, { "event_id": "evt-c91e8bd8a10e30790b8f3514", "kind": "identity", "frame_number": 1008, "timestamp_epoch": "1723680608.252078000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 47, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-bacde8f24798d035349a1030", "kind": "identity", "frame_number": 1011, "timestamp_epoch": "1723680608.253051000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 47, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.CNameString": "plucero", "kerberos.msg_type": "13" } }, { "event_id": "evt-ab5cc4c7d8ff392c3f55c1e3", "kind": "identity", "frame_number": 1017, "timestamp_epoch": "1723680608.253781000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-b3e2f1a39607d16e8c4ef000", "kind": "identity", "frame_number": 1019, "timestamp_epoch": "1723680608.254318000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-79398569f06ff7ad3ff2fff8", "kind": "identity", "frame_number": 1020, "timestamp_epoch": "1723680608.254511000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "15" } }, { "event_id": "evt-3697fc2927e8919374fe1f07", "kind": "identity", "frame_number": 1034, "timestamp_epoch": "1723680608.262175000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 48, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-7d63a4323a5f030565204596", "kind": "identity", "frame_number": 1036, "timestamp_epoch": "1723680608.263016000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 48, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-e77cd54c425e3665089bf986", "kind": "identity", "frame_number": 1043, "timestamp_epoch": "1723680608.269420000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 49, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-2f90f4c29662180402a5527f", "kind": "identity", "frame_number": 1045, "timestamp_epoch": "1723680608.270141000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 49, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-3d4a9afb984bb56ba79083e1", "kind": "identity", "frame_number": 1056, "timestamp_epoch": "1723680608.279002000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 50, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-bb3732f11406baf811c28858", "kind": "identity", "frame_number": 1059, "timestamp_epoch": "1723680608.280003000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 50, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.CNameString": "plucero", "kerberos.msg_type": "13" } }, { "event_id": "evt-b58b2cad5de448a51679a0ec", "kind": "identity", "frame_number": 1068, "timestamp_epoch": "1723680608.280713000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 51, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-0841bfca4bd188bb5badd121", "kind": "identity", "frame_number": 1071, "timestamp_epoch": "1723680608.281162000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 51, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.CNameString": "plucero", "kerberos.msg_type": "13" } }, { "event_id": "evt-8940388b2f3a5992b4877687", "kind": "identity", "frame_number": 1078, "timestamp_epoch": "1723680608.281718000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-1c6347298344f2604fef48ff", "kind": "identity", "frame_number": 1080, "timestamp_epoch": "1723680608.282749000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-eb871a7431b69954f7b2eb67", "kind": "identity", "frame_number": 1081, "timestamp_epoch": "1723680608.283115000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-f20744fd9f9467125739de98", "kind": "identity", "frame_number": 1082, "timestamp_epoch": "1723680608.283272000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-809ef0d437ac8c98209ffbc0", "kind": "identity", "frame_number": 1087, "timestamp_epoch": "1723680608.290993000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-ad693d39a7f4ad632d3e130d", "kind": "identity", "frame_number": 1088, "timestamp_epoch": "1723680608.291250000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-689287242bda24850e77948b", "kind": "identity", "frame_number": 1089, "timestamp_epoch": "1723680608.291422000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-6e6c21e1c06c5d77d9333c03", "kind": "identity", "frame_number": 1090, "timestamp_epoch": "1723680608.291568000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-4215697f6d32b214aabd457c", "kind": "identity", "frame_number": 1091, "timestamp_epoch": "1723680608.291749000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-82ce9605098c060b71654546", "kind": "identity", "frame_number": 1092, "timestamp_epoch": "1723680608.291935000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-d661782b3ae376caa9a79b24", "kind": "identity", "frame_number": 1094, "timestamp_epoch": "1723680608.292195000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-fba46d11ead7c70963a31bc5", "kind": "identity", "frame_number": 1095, "timestamp_epoch": "1723680608.292331000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-6f6987d7e822ba28c44a1596", "kind": "identity", "frame_number": 1096, "timestamp_epoch": "1723680608.292494000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-b90fdefb370a52c193820744", "kind": "identity", "frame_number": 1097, "timestamp_epoch": "1723680608.292835000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-f2b3ce3376f8f59f071e59ca", "kind": "identity", "frame_number": 1098, "timestamp_epoch": "1723680608.293037000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-baaaf6541c29564e7d93ef88", "kind": "identity", "frame_number": 1099, "timestamp_epoch": "1723680608.293290000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-61a916bf1163f390736ae630", "kind": "identity", "frame_number": 1100, "timestamp_epoch": "1723680608.293468000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-d47906e88e642480a3401775", "kind": "identity", "frame_number": 1101, "timestamp_epoch": "1723680608.293826000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-1db4e091f38fcc0ec9dece89", "kind": "identity", "frame_number": 1102, "timestamp_epoch": "1723680608.294014000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-de24d385447ff31ae1f873b9", "kind": "identity", "frame_number": 1103, "timestamp_epoch": "1723680608.294335000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-3bd141701bd4f6ee24c7f86b", "kind": "identity", "frame_number": 1104, "timestamp_epoch": "1723680608.294498000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-a8f5d33c3c304e9501c4d6b6", "kind": "identity", "frame_number": 1105, "timestamp_epoch": "1723680608.294889000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-da00bc9256ba4cb7a3fe57ee", "kind": "identity", "frame_number": 1106, "timestamp_epoch": "1723680608.295053000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-aad15bf7e3194e1e1136df9a", "kind": "identity", "frame_number": 1107, "timestamp_epoch": "1723680608.295392000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-f068356422003a77c239c55b", "kind": "identity", "frame_number": 1108, "timestamp_epoch": "1723680608.295580000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-fbf9b894dd16de07731eacdd", "kind": "identity", "frame_number": 1109, "timestamp_epoch": "1723680608.296055000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-2b4a84469628207f74f0ef51", "kind": "identity", "frame_number": 1110, "timestamp_epoch": "1723680608.296214000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-9995ce28cb45ee06867b262b", "kind": "identity", "frame_number": 1111, "timestamp_epoch": "1723680608.296635000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "samr.samr_UserInfo21.account_name": "plucero", "samr.samr_UserInfo21.full_name": "Pierce Lucero" } }, { "event_id": "evt-9c5ed577bd736a2da2676f99", "kind": "identity", "frame_number": 1112, "timestamp_epoch": "1723680608.296855000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-97be4eef731c06c4c80affd3", "kind": "identity", "frame_number": 1113, "timestamp_epoch": "1723680608.297258000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-9123438900c1c99fb6c9fdc1", "kind": "identity", "frame_number": 1114, "timestamp_epoch": "1723680608.297426000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-1dc85b8280ab166b0e8d72de", "kind": "identity", "frame_number": 1115, "timestamp_epoch": "1723680608.297744000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-733ec060c291c305b016a811", "kind": "identity", "frame_number": 1116, "timestamp_epoch": "1723680608.297908000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-8bfbc68accd91d1a8362e0e5", "kind": "identity", "frame_number": 1117, "timestamp_epoch": "1723680608.298252000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-1fc81e06994bb02d558517e0", "kind": "identity", "frame_number": 1118, "timestamp_epoch": "1723680608.298462000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-94f4786f7a399606d73fbec4", "kind": "identity", "frame_number": 1119, "timestamp_epoch": "1723680608.298712000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-dc3168f3dcbab49909cee075", "kind": "identity", "frame_number": 1120, "timestamp_epoch": "1723680608.298892000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-df1cfe8bab1ecda5fa2aedf5", "kind": "identity", "frame_number": 1121, "timestamp_epoch": "1723680608.299161000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-adcb7e5a14a15a7f9a43d450", "kind": "identity", "frame_number": 1122, "timestamp_epoch": "1723680608.299311000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-a3ebaa3ae3e25fa58674cf6e", "kind": "identity", "frame_number": 1123, "timestamp_epoch": "1723680608.299551000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-7028bc78a18de8482dc3fc92", "kind": "identity", "frame_number": 1124, "timestamp_epoch": "1723680608.299700000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-9cf3f297b6976d21cdc3d36f", "kind": "identity", "frame_number": 1125, "timestamp_epoch": "1723680608.299949000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-73952b94b538b900e66f3ff8", "kind": "identity", "frame_number": 1126, "timestamp_epoch": "1723680608.300120000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-e9b9809d7484221ac2689831", "kind": "identity", "frame_number": 1127, "timestamp_epoch": "1723680608.300293000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-747495af5112b90b00546e76", "kind": "identity", "frame_number": 1133, "timestamp_epoch": "1723680608.415820000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-9957204867a2597aee862f51", "kind": "identity", "frame_number": 1134, "timestamp_epoch": "1723680608.416221000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-395af265008a39ae5b97f800", "kind": "identity", "frame_number": 1139, "timestamp_epoch": "1723680608.417084000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-07b9e1a7ccb88d9c8c1d1ccf", "kind": "identity", "frame_number": 1142, "timestamp_epoch": "1723680608.418138000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.CNameString": "plucero", "kerberos.msg_type": "13" } }, { "event_id": "evt-e5c85648e7a429a17bbfe7e3", "kind": "identity", "frame_number": 1149, "timestamp_epoch": "1723680608.418641000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-35ab6b5a677d358cb8538628", "kind": "identity", "frame_number": 1151, "timestamp_epoch": "1723680608.419622000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-a543b4a34940166c325edf4a", "kind": "identity", "frame_number": 1152, "timestamp_epoch": "1723680608.419996000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-392e8374b877ec8dd8c7af5d", "kind": "identity", "frame_number": 1153, "timestamp_epoch": "1723680608.420174000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-6b18114d0b6d911ea8635484", "kind": "identity", "frame_number": 1154, "timestamp_epoch": "1723680608.420321000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-e63c41cbf6279bf269c792f1", "kind": "identity", "frame_number": 1155, "timestamp_epoch": "1723680608.420454000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-14c580460d96588cd2eab8fd", "kind": "identity", "frame_number": 2165, "timestamp_epoch": "1723680619.138194000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 75, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-e7a6c15cb90246e3ccb2b7a2", "kind": "identity", "frame_number": 2167, "timestamp_epoch": "1723680619.138973000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 75, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-4df14457a2c540a9b228871b", "kind": "identity", "frame_number": 2168, "timestamp_epoch": "1723680619.139541000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 75, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "15" } }, { "event_id": "evt-650e6631b774df2e03521acb", "kind": "identity", "frame_number": 2198, "timestamp_epoch": "1723680619.151800000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 76, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-a4c2a6f56bd25270d8293474", "kind": "identity", "frame_number": 2200, "timestamp_epoch": "1723680619.152525000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 76, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-1703d2c66c4fb3889a9c555b", "kind": "identity", "frame_number": 2211, "timestamp_epoch": "1723680619.157530000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-77401b215094699f45536908", "kind": "identity", "frame_number": 2213, "timestamp_epoch": "1723680619.158222000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-5dd6ec7b784b8f3ff4c89ce9", "kind": "identity", "frame_number": 2991, "timestamp_epoch": "1723680622.188783000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-1418d8fe82ad1e4fa43720e9", "kind": "identity", "frame_number": 2992, "timestamp_epoch": "1723680622.189067000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-eac58f17c51d960b11b766c5", "kind": "identity", "frame_number": 2993, "timestamp_epoch": "1723680622.189258000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-1c2cb23de39c16ca58f0abc3", "kind": "identity", "frame_number": 2994, "timestamp_epoch": "1723680622.189436000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-7d1b1cae46a6393257cf17cc", "kind": "identity", "frame_number": 3511, "timestamp_epoch": "1723680625.103471000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-5b38c086d3155f523d1e08a1", "kind": "identity", "frame_number": 3512, "timestamp_epoch": "1723680625.103850000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-e19762bec843765d2a518a37", "kind": "identity", "frame_number": 3513, "timestamp_epoch": "1723680625.105425000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-c348462165cf74e882819e71", "kind": "identity", "frame_number": 3514, "timestamp_epoch": "1723680625.105713000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-59a93a3e2dbe7ef0b0960998", "kind": "identity", "frame_number": 3518, "timestamp_epoch": "1723680625.624493000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-1bf5de86d0e4daa5bbbdc1ee", "kind": "identity", "frame_number": 3519, "timestamp_epoch": "1723680625.624803000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-0f4ccebb35d52a444f725aa4", "kind": "identity", "frame_number": 3520, "timestamp_epoch": "1723680625.625066000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-ea3a97449bb1a71a452af5ed", "kind": "identity", "frame_number": 3521, "timestamp_epoch": "1723680625.625215000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-cb7376f5f07cc534f468aa2d", "kind": "identity", "frame_number": 3522, "timestamp_epoch": "1723680625.627822000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-71915c221047351b34df30dc", "kind": "identity", "frame_number": 3523, "timestamp_epoch": "1723680625.628071000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-481c466ff3a62d20feec8bfb", "kind": "identity", "frame_number": 3524, "timestamp_epoch": "1723680625.628366000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-caf9a080ec01b660b54c4783", "kind": "identity", "frame_number": 3525, "timestamp_epoch": "1723680625.628505000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-9cec2cc1501915c464cc6793", "kind": "identity", "frame_number": 3526, "timestamp_epoch": "1723680625.630737000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-c6109a8bee7d9139cdc5ea60", "kind": "identity", "frame_number": 3527, "timestamp_epoch": "1723680625.630978000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-22a30d521535eeaa6e5c6828", "kind": "identity", "frame_number": 3528, "timestamp_epoch": "1723680625.631404000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-de1f81dd19005bc4602a3fb3", "kind": "identity", "frame_number": 3529, "timestamp_epoch": "1723680625.631569000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-9596007d272e0d052944a001", "kind": "identity", "frame_number": 3530, "timestamp_epoch": "1723680625.637584000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-b486fac3c6d0796d0213b243", "kind": "identity", "frame_number": 3531, "timestamp_epoch": "1723680625.637940000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-d40ac19d322a275d30688c6a", "kind": "identity", "frame_number": 3532, "timestamp_epoch": "1723680625.638234000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-42e61608c105313d65d82006", "kind": "identity", "frame_number": 3533, "timestamp_epoch": "1723680625.638419000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-52e07b16c3b72f8b9209dcb6", "kind": "identity", "frame_number": 3534, "timestamp_epoch": "1723680625.652814000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-9f57b54f562c5a75e0c69ce6", "kind": "identity", "frame_number": 3535, "timestamp_epoch": "1723680625.653175000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-bf6ec75b9465243af4128f90", "kind": "identity", "frame_number": 3536, "timestamp_epoch": "1723680625.653551000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-ecaa7beb0ce2adc6846eac3d", "kind": "identity", "frame_number": 3537, "timestamp_epoch": "1723680625.653760000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-a1a1d4d0a886ff619e32a2f8", "kind": "identity", "frame_number": 6150, "timestamp_epoch": "1723680653.659827000", "src_ip": "10.8.15.133", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 2, "fields": { "dns.qry.name": "_googlecast._tcp.local", "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-96bfb005f8ba49839a5b09ff", "kind": "identity", "frame_number": 6199, "timestamp_epoch": "1723680654.675111000", "src_ip": "10.8.15.133", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 2, "fields": { "dns.qry.name": "_googlecast._tcp.local", "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-9de077e26bd898aa26d14b08", "kind": "identity", "frame_number": 6369, "timestamp_epoch": "1723680656.683939000", "src_ip": "10.8.15.133", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 2, "fields": { "dns.qry.name": "_googlecast._tcp.local", "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-9fdc19f383480af008675308", "kind": "identity", "frame_number": 8766, "timestamp_epoch": "1723680669.166822000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 116, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-b452cd867553c4467414ee8c", "kind": "identity", "frame_number": 8768, "timestamp_epoch": "1723680669.167742000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 116, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-6a61711f0328397d8f443dab", "kind": "identity", "frame_number": 8769, "timestamp_epoch": "1723680669.168161000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 116, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "15" } }, { "event_id": "evt-545e9d49528c9cf8b0a2053b", "kind": "identity", "frame_number": 8793, "timestamp_epoch": "1723680669.178289000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 117, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-f3db786e5a38e8b3cf8d0099", "kind": "identity", "frame_number": 8795, "timestamp_epoch": "1723680669.179140000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 117, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-bb207d638d0514ba47da0105", "kind": "identity", "frame_number": 8806, "timestamp_epoch": "1723680669.183217000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 118, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-baab6a0c1e2e6d9ef08c948e", "kind": "identity", "frame_number": 8808, "timestamp_epoch": "1723680669.183920000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 118, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-0df26e08de1f525b3dbf5a83", "kind": "identity", "frame_number": 8903, "timestamp_epoch": "1723680680.908440000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-5dc89cadd37f3877d333a7f5", "kind": "identity", "frame_number": 8904, "timestamp_epoch": "1723680680.908780000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-3022e299ebb1dcfc039756e3", "kind": "identity", "frame_number": 10319, "timestamp_epoch": "1723680707.869069000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 129, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-9616a57d0b78f599374a2574", "kind": "identity", "frame_number": 10321, "timestamp_epoch": "1723680707.869719000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 129, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-30181c5638fe3b5598dccbb7", "kind": "identity", "frame_number": 10322, "timestamp_epoch": "1723680707.870071000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 129, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "15" } }, { "event_id": "evt-fa0ec57d7e4f80f64b0a0d6e", "kind": "identity", "frame_number": 10346, "timestamp_epoch": "1723680707.879339000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-79f1ee2730281f4a1000eb3d", "kind": "identity", "frame_number": 10348, "timestamp_epoch": "1723680707.880056000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-10147d98c8e245966a1ec75d", "kind": "identity", "frame_number": 10359, "timestamp_epoch": "1723680707.884542000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-85a20151665c3f38db8572a5", "kind": "identity", "frame_number": 10361, "timestamp_epoch": "1723680707.885178000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-b8bd04da2b3f115abfd26b6b", "kind": "identity", "frame_number": 10787, "timestamp_epoch": "1723680726.268860000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 136, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-a73ccd9244c605b5e6991586", "kind": "identity", "frame_number": 10789, "timestamp_epoch": "1723680726.269527000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 136, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-07f64a341fabd3d73d5b15e0", "kind": "identity", "frame_number": 10790, "timestamp_epoch": "1723680726.269892000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 136, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "15" } }, { "event_id": "evt-392180e6d8c1a3ca943a1e6c", "kind": "identity", "frame_number": 10814, "timestamp_epoch": "1723680726.279327000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-6a0dcdf44e63b661b339a1ca", "kind": "identity", "frame_number": 10816, "timestamp_epoch": "1723680726.279932000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-15efa8f8a19dcc72e61395a6", "kind": "identity", "frame_number": 10827, "timestamp_epoch": "1723680726.284604000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-9fd71b216a8af08748434275", "kind": "identity", "frame_number": 10829, "timestamp_epoch": "1723680726.285345000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-5145a54738029718ab62fd9d", "kind": "identity", "frame_number": 11537, "timestamp_epoch": "1723680793.572468000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-7ac617969092ef93a01883d6", "kind": "identity", "frame_number": 11539, "timestamp_epoch": "1723680793.573124000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-254cb1e0a7873264db876aed", "kind": "identity", "frame_number": 11540, "timestamp_epoch": "1723680793.573518000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "15" } }, { "event_id": "evt-85a74cdcfc419ecb43b34155", "kind": "identity", "frame_number": 11564, "timestamp_epoch": "1723680793.583308000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 148, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-8a7e5f2187c157da35d41711", "kind": "identity", "frame_number": 11566, "timestamp_epoch": "1723680793.584069000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 148, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-3e0557c22ffb9b0c97e68b76", "kind": "identity", "frame_number": 11577, "timestamp_epoch": "1723680793.589691000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 149, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-d6b4ef92c8370c418492e112", "kind": "identity", "frame_number": 11579, "timestamp_epoch": "1723680793.590422000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 149, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-689bc86b6f50ce89d1405762", "kind": "identity", "frame_number": 11645, "timestamp_epoch": "1723680795.694955000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 153, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-3916451e82425c3397611d72", "kind": "identity", "frame_number": 11648, "timestamp_epoch": "1723680795.695877000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 153, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.CNameString": "plucero", "kerberos.msg_type": "13" } }, { "event_id": "evt-6a994f5b559f434ebad536db", "kind": "identity", "frame_number": 11654, "timestamp_epoch": "1723680795.702791000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 152, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-44020b5d6cde46ebc2cd308d", "kind": "identity", "frame_number": 11656, "timestamp_epoch": "1723680795.703747000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 152, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-3f0fce9033122b0af3e3cd91", "kind": "identity", "frame_number": 11671, "timestamp_epoch": "1723680795.728515000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 154, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-2cc3c68f8a9d89eff2a10121", "kind": "identity", "frame_number": 11673, "timestamp_epoch": "1723680795.729326000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 154, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-60459b244c2b4e1923b39696", "kind": "identity", "frame_number": 12013, "timestamp_epoch": "1723680827.249355000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 18, "fields": { "browser.server": "DESKTOP-H8ALZBV", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-8a11422fe4b48b56e06de5eb", "kind": "identity", "frame_number": 12516, "timestamp_epoch": "1723680911.762733000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 196, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-d778cd70107615c848c5f00d", "kind": "identity", "frame_number": 12518, "timestamp_epoch": "1723680911.763442000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 196, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-1464682a83aad521bee22ac1", "kind": "identity", "frame_number": 12527, "timestamp_epoch": "1723680911.773739000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 197, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-09529a255ad53e787f3d2bd9", "kind": "identity", "frame_number": 12529, "timestamp_epoch": "1723680911.774536000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 197, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-14168daa7ff5c6aa341911f9", "kind": "identity", "frame_number": 13676, "timestamp_epoch": "1723680984.935074000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 212, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-7976939757778f9e3f79a185", "kind": "identity", "frame_number": 13678, "timestamp_epoch": "1723680984.935756000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 212, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-d8eaa535b67fee3e1b7ad4d8", "kind": "identity", "frame_number": 13679, "timestamp_epoch": "1723680984.936097000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 212, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "15" } }, { "event_id": "evt-e693e11d97ce51bd8c7fa523", "kind": "identity", "frame_number": 13703, "timestamp_epoch": "1723680984.945127000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 213, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-2f27742fc95ad3aa5174e8e3", "kind": "identity", "frame_number": 13705, "timestamp_epoch": "1723680984.945807000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 213, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-1112a3f4c695aab0c35d6d5e", "kind": "identity", "frame_number": 13716, "timestamp_epoch": "1723680984.949622000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 214, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-714abb9843ef95e6d195030d", "kind": "identity", "frame_number": 13718, "timestamp_epoch": "1723680984.950226000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 214, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-7ff79c662e823a8058850c40", "kind": "identity", "frame_number": 13761, "timestamp_epoch": "1723680987.857785000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 217, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-26bbeff5f2b5df7eefe2fc34", "kind": "identity", "frame_number": 13763, "timestamp_epoch": "1723680987.858704000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 217, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-23cea4d4195b85ed2da8ffc7", "kind": "identity", "frame_number": 13764, "timestamp_epoch": "1723680987.859215000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 217, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "15" } }, { "event_id": "evt-4a909c3f38e36d53e855720a", "kind": "identity", "frame_number": 13788, "timestamp_epoch": "1723680987.868608000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 218, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-d8e65065f369f82f759ffb51", "kind": "identity", "frame_number": 13790, "timestamp_epoch": "1723680987.869256000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 218, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-683a4c78830e03e4ada1bbad", "kind": "identity", "frame_number": 13801, "timestamp_epoch": "1723680987.873924000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 219, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-792939f799665997ab01e0a2", "kind": "identity", "frame_number": 13803, "timestamp_epoch": "1723680987.874664000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 219, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-92298674b86d6d3499b9629f", "kind": "identity", "frame_number": 14728, "timestamp_epoch": "1723681184.603396000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-d9dde679b35df078d6ae630c", "kind": "identity", "frame_number": 14729, "timestamp_epoch": "1723681184.603516000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-1e170b92dc13fd15c67ce4e6", "kind": "identity", "frame_number": 14730, "timestamp_epoch": "1723681184.604122000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-154efb284af2d32302481d7d", "kind": "identity", "frame_number": 14731, "timestamp_epoch": "1723681184.604237000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-f7231628e6d05a4b09d45744", "kind": "identity", "frame_number": 14748, "timestamp_epoch": "1723681188.275341000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-ead5bbde328759ba9b401ada", "kind": "identity", "frame_number": 14749, "timestamp_epoch": "1723681188.276168000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-e022906407a9c2fc8984ff62", "kind": "identity", "frame_number": 14750, "timestamp_epoch": "1723681188.276825000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-56e72d1a249260d436ae5358", "kind": "identity", "frame_number": 14751, "timestamp_epoch": "1723681188.277239000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-2f8d6b7ec914319e5b85dfc6", "kind": "identity", "frame_number": 14752, "timestamp_epoch": "1723681188.277692000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-1d2a4307d4f5e6d8d8376718", "kind": "identity", "frame_number": 14753, "timestamp_epoch": "1723681188.278177000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-ad39a61c5b13c2275065e273", "kind": "identity", "frame_number": 14754, "timestamp_epoch": "1723681188.278672000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-654cd9284fcc1a9918ebedc6", "kind": "identity", "frame_number": 14755, "timestamp_epoch": "1723681188.279081000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-ee456ee5219698473b825189", "kind": "identity", "frame_number": 14798, "timestamp_epoch": "1723681199.026053000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-e414cfdd3c1074869230ce9e", "kind": "identity", "frame_number": 14799, "timestamp_epoch": "1723681199.026646000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-90471f5cbc39741511b61134", "kind": "identity", "frame_number": 14800, "timestamp_epoch": "1723681199.027055000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-8b2b79aca1fa49a0a0abf225", "kind": "identity", "frame_number": 14801, "timestamp_epoch": "1723681199.027490000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-e54dbbd30ba22d41265542e1", "kind": "identity", "frame_number": 15256, "timestamp_epoch": "1723681305.542611000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 18, "fields": { "browser.server": "DESKTOP-H8ALZBV", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-d9c64f2b0bdb48425508a74b", "kind": "identity", "frame_number": 15696, "timestamp_epoch": "1723681486.487933000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 330, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-9c0e3fd3db8ecf93b7282afb", "kind": "identity", "frame_number": 15697, "timestamp_epoch": "1723681486.488215000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 330, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-ee0133ba4e44c1b959130bf6", "kind": "identity", "frame_number": 15698, "timestamp_epoch": "1723681486.488586000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 330, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-baca348558a6de42125bd6a8", "kind": "identity", "frame_number": 15701, "timestamp_epoch": "1723681486.489721000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 330, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-32257dc4d07efcd5e9dfaaf0", "kind": "identity", "frame_number": 15703, "timestamp_epoch": "1723681486.490949000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 330, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-2c637ce5fcf13c87ebe7f536", "kind": "identity", "frame_number": 15704, "timestamp_epoch": "1723681486.491456000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 330, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-e0f87770ea5842d0b8b7efea", "kind": "identity", "frame_number": 15705, "timestamp_epoch": "1723681486.491678000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 330, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-70c83073803dbc76d3d78934", "kind": "identity", "frame_number": 15706, "timestamp_epoch": "1723681486.491912000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 330, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-dbb8911239987f7744a9633e", "kind": "identity", "frame_number": 15707, "timestamp_epoch": "1723681486.492090000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 330, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-602c63342b0389249c3eb8fe", "kind": "identity", "frame_number": 15708, "timestamp_epoch": "1723681486.492300000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 330, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-2a1d0b2b10f1120867835ec9", "kind": "identity", "frame_number": 15709, "timestamp_epoch": "1723681486.492622000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 330, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-000a3133eab7c69ad64dab04", "kind": "identity", "frame_number": 15735, "timestamp_epoch": "1723681497.215921000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 330, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-be34835f785d3c39f886b2ad", "kind": "identity", "frame_number": 15736, "timestamp_epoch": "1723681497.216534000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 330, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-540251b75f4ac48dcaed0c98", "kind": "identity", "frame_number": 15737, "timestamp_epoch": "1723681497.217210000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 330, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-f0283f1f8a1e7a3e0fe2edaf", "kind": "identity", "frame_number": 15738, "timestamp_epoch": "1723681497.217799000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 330, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-b07b3aedf88bbfd772e86fce", "kind": "identity", "frame_number": 15965, "timestamp_epoch": "1723681540.377502000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 345, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-b6c3b82ab7020e4d97fd3c96", "kind": "identity", "frame_number": 15967, "timestamp_epoch": "1723681540.378380000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 345, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-a919776b782a228c1426d66f", "kind": "identity", "frame_number": 15978, "timestamp_epoch": "1723681540.394297000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 346, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-16f7aca05664dc7ac7131a40", "kind": "identity", "frame_number": 15980, "timestamp_epoch": "1723681540.395140000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 346, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-2cda99d25e487b1a1a14b67f", "kind": "identity", "frame_number": 16511, "timestamp_epoch": "1723681785.015606000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-23c91ad65d7d1bb0d0ad9f61", "kind": "identity", "frame_number": 16512, "timestamp_epoch": "1723681785.015954000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-4257023470eda1dda33b703c", "kind": "identity", "frame_number": 17047, "timestamp_epoch": "1723682026.693492000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 18, "fields": { "browser.server": "DESKTOP-H8ALZBV", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-e2de480b9644d5d953fb3045", "kind": "identity", "frame_number": 17766, "timestamp_epoch": "1723682385.379636000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-73bcac92bbb07bf545dcf8c3", "kind": "identity", "frame_number": 17767, "timestamp_epoch": "1723682385.380079000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 52, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-ee3bbde5852822539508a53a", "kind": "identity", "frame_number": 17773, "timestamp_epoch": "1723682386.512337000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 501, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-6f72e95c93adee61d079f0a5", "kind": "identity", "frame_number": 17774, "timestamp_epoch": "1723682386.512556000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 501, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-3dd488df880fd34db8e89c05", "kind": "identity", "frame_number": 17775, "timestamp_epoch": "1723682386.512945000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 501, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-cc38360be050b1a056c1c50f", "kind": "identity", "frame_number": 17778, "timestamp_epoch": "1723682386.514100000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 501, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82", "kerberos.msg_type": "14" } }, { "event_id": "evt-1c4afde1721ceb62faac340f", "kind": "identity", "frame_number": 17780, "timestamp_epoch": "1723682386.515312000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 501, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40", "kerberos.msg_type": "15" } }, { "event_id": "evt-22789a860ac60006cb74bd58", "kind": "identity", "frame_number": 17781, "timestamp_epoch": "1723682386.515805000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 501, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-6d4909ea4f5643cb598b1f78", "kind": "identity", "frame_number": 17782, "timestamp_epoch": "1723682386.516022000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 501, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-7b45014a799f87c65a996943", "kind": "identity", "frame_number": 17783, "timestamp_epoch": "1723682386.516243000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 501, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-55e3505010f67ed6f76be342", "kind": "identity", "frame_number": 17784, "timestamp_epoch": "1723682386.516366000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 501, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-f22e6392eaff54ddaa62c6f2", "kind": "identity", "frame_number": 17785, "timestamp_epoch": "1723682386.516434000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 501, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-b9273422aa6105e5b8224416", "kind": "identity", "frame_number": 17786, "timestamp_epoch": "1723682386.516693000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 501, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-9ad1dec422f254438c73edff", "kind": "identity", "frame_number": 17846, "timestamp_epoch": "1723682397.301308000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 501, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-406d7c39f0c87e9c871384b5", "kind": "identity", "frame_number": 17847, "timestamp_epoch": "1723682397.301894000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 501, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } }, { "event_id": "evt-91749abb2cc187feaef1de32", "kind": "identity", "frame_number": 17848, "timestamp_epoch": "1723682397.302442000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 501, "udp_stream": null, "fields": { "eth.dst": "64:00:6a:8c:9c:40", "eth.src": "00:1c:bf:03:54:82" } }, { "event_id": "evt-8725c84b7fc87b8fc8c5ffd9", "kind": "identity", "frame_number": 17849, "timestamp_epoch": "1723682397.302962000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 501, "udp_stream": null, "fields": { "eth.dst": "00:1c:bf:03:54:82", "eth.src": "64:00:6a:8c:9c:40" } } ], "directory_service": [ { "event_id": "evt-4467506f3d00bd189c5cbb65", "kind": "directory_service", "frame_number": 37, "timestamp_epoch": "1723680584.316304000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-5005ac3c2aca4e074f211245", "kind": "directory_service", "frame_number": 39, "timestamp_epoch": "1723680584.316590000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-1f190dd8e9e991eaca807daf", "kind": "directory_service", "frame_number": 281, "timestamp_epoch": "1723680586.162496000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-2f7eeba08bfcf02712c353c5", "kind": "directory_service", "frame_number": 282, "timestamp_epoch": "1723680586.162688000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-f324d60d3640af54aba81551", "kind": "directory_service", "frame_number": 285, "timestamp_epoch": "1723680586.163355000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-f5519d7ecb1c6c1b5bbcc2df", "kind": "directory_service", "frame_number": 287, "timestamp_epoch": "1723680586.163662000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-ca4bfcb9f2bafa64987a6d6c", "kind": "directory_service", "frame_number": 288, "timestamp_epoch": "1723680586.163682000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-5da257cbc805dab7bec0688a", "kind": "directory_service", "frame_number": 290, "timestamp_epoch": "1723680586.163947000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-5ffba6ddb888781745994e41", "kind": "directory_service", "frame_number": 292, "timestamp_epoch": "1723680586.164365000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-0e4b9ba514278c367c26dc50", "kind": "directory_service", "frame_number": 293, "timestamp_epoch": "1723680586.164600000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-db76bb2d3e5066b5409e3a0a", "kind": "directory_service", "frame_number": 295, "timestamp_epoch": "1723680586.165042000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-86bc1e440d98b870a3438f16", "kind": "directory_service", "frame_number": 297, "timestamp_epoch": "1723680586.165243000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-ca80d16ac98f398318137937", "kind": "directory_service", "frame_number": 298, "timestamp_epoch": "1723680586.165377000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-f976f2735b77ea933cfb648a", "kind": "directory_service", "frame_number": 299, "timestamp_epoch": "1723680586.165682000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-02a5d3e65661e1bb2d56eab5", "kind": "directory_service", "frame_number": 300, "timestamp_epoch": "1723680586.167935000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": {} }, { "event_id": "evt-fa4d0ba806e3eafb290c25cd", "kind": "directory_service", "frame_number": 302, "timestamp_epoch": "1723680586.168128000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": {} }, { "event_id": "evt-f4ff000a53bcd777260fc4de", "kind": "directory_service", "frame_number": 304, "timestamp_epoch": "1723680586.169382000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": {} }, { "event_id": "evt-5bc077b0b39ac7188df93fbc", "kind": "directory_service", "frame_number": 305, "timestamp_epoch": "1723680586.169656000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": {} }, { "event_id": "evt-a3aa2f6dbe0d257bfef18fd1", "kind": "directory_service", "frame_number": 312, "timestamp_epoch": "1723680586.175079000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-342f03f816c207fe5ca026a3", "kind": "directory_service", "frame_number": 313, "timestamp_epoch": "1723680586.175336000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-0b3ad04f56e60ff315e3a84b", "kind": "directory_service", "frame_number": 314, "timestamp_epoch": "1723680586.183783000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-c42c6d29c3081a1ef6f339a7", "kind": "directory_service", "frame_number": 315, "timestamp_epoch": "1723680586.184129000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-10f3dad0e92f95816659e646", "kind": "directory_service", "frame_number": 316, "timestamp_epoch": "1723680586.185886000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-f74e2922e52e8adaf1647bc1", "kind": "directory_service", "frame_number": 317, "timestamp_epoch": "1723680586.186040000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-26ce90c312f4b508603c4efd", "kind": "directory_service", "frame_number": 331, "timestamp_epoch": "1723680586.222611000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-669eee326a9427e89e8d6811", "kind": "directory_service", "frame_number": 333, "timestamp_epoch": "1723680586.223085000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-f6f0ac01d493d01ee7ce20ca", "kind": "directory_service", "frame_number": 335, "timestamp_epoch": "1723680586.223909000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "30" } }, { "event_id": "evt-4eb66ab8968a0c1497bc7f7e", "kind": "directory_service", "frame_number": 336, "timestamp_epoch": "1723680586.224242000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "30" } }, { "event_id": "evt-75dfd7de4e7ac7022454865d", "kind": "directory_service", "frame_number": 342, "timestamp_epoch": "1723680586.228979000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-39c23c1d94d40453e3f31c14", "kind": "directory_service", "frame_number": 345, "timestamp_epoch": "1723680586.229864000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-19b8215dcc088ecb066076a7", "kind": "directory_service", "frame_number": 348, "timestamp_epoch": "1723680586.231259000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-0c433931295add4409da2944", "kind": "directory_service", "frame_number": 349, "timestamp_epoch": "1723680586.231483000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-da02b96f1ca5786bdb588fcd", "kind": "directory_service", "frame_number": 350, "timestamp_epoch": "1723680586.232492000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-09c1d5d37ac5a073364f1938", "kind": "directory_service", "frame_number": 367, "timestamp_epoch": "1723680586.333842000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": {} }, { "event_id": "evt-63eba8ad2921f52e192306ea", "kind": "directory_service", "frame_number": 370, "timestamp_epoch": "1723680586.334337000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": {} }, { "event_id": "evt-ad8ea42af527eb4e52d1fd42", "kind": "directory_service", "frame_number": 405, "timestamp_epoch": "1723680586.407343000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 22, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-9b3e0fcdd02f7b477a08b1c0", "kind": "directory_service", "frame_number": 406, "timestamp_epoch": "1723680586.407559000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 22, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-c7360a421907378a033a719f", "kind": "directory_service", "frame_number": 407, "timestamp_epoch": "1723680586.408227000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 22, "udp_stream": null, "fields": { "drsuapi.opnum": "13" } }, { "event_id": "evt-f19ebce46f230335630d274c", "kind": "directory_service", "frame_number": 408, "timestamp_epoch": "1723680586.408786000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 22, "udp_stream": null, "fields": { "drsuapi.opnum": "13" } }, { "event_id": "evt-52d1a2309165fa022a954a92", "kind": "directory_service", "frame_number": 411, "timestamp_epoch": "1723680586.417183000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 22, "udp_stream": null, "fields": { "drsuapi.opnum": "13" } }, { "event_id": "evt-523625727863191f6d53866f", "kind": "directory_service", "frame_number": 415, "timestamp_epoch": "1723680586.417890000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 22, "udp_stream": null, "fields": { "drsuapi.opnum": "13" } }, { "event_id": "evt-6ae9ff0262a6d47f7a6129a5", "kind": "directory_service", "frame_number": 418, "timestamp_epoch": "1723680586.419421000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 22, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-ecef275e717402f614e39bdd", "kind": "directory_service", "frame_number": 420, "timestamp_epoch": "1723680586.419690000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 22, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-7f240a4ecb92e5ce83c76834", "kind": "directory_service", "frame_number": 423, "timestamp_epoch": "1723680586.421509000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-34626a8566fbf018a5eb874a", "kind": "directory_service", "frame_number": 424, "timestamp_epoch": "1723680586.421823000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-7bd8804889f1797f1ce8f8d7", "kind": "directory_service", "frame_number": 425, "timestamp_epoch": "1723680586.422332000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-c76a2d2c615bd11d7248f86c", "kind": "directory_service", "frame_number": 426, "timestamp_epoch": "1723680586.422890000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-2fa1e49f99e16f536430f48d", "kind": "directory_service", "frame_number": 427, "timestamp_epoch": "1723680586.425984000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-89a9351550a2edc8bd9d7ec9", "kind": "directory_service", "frame_number": 428, "timestamp_epoch": "1723680586.426156000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-a4f92b3512007d87ba6b95c1", "kind": "directory_service", "frame_number": 434, "timestamp_epoch": "1723680586.460022000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": {} }, { "event_id": "evt-6a59d1b0ca9076dcf150a4cf", "kind": "directory_service", "frame_number": 436, "timestamp_epoch": "1723680586.460412000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": {} }, { "event_id": "evt-580e2512ac16b26a0d59a301", "kind": "directory_service", "frame_number": 454, "timestamp_epoch": "1723680586.566735000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": {} }, { "event_id": "evt-67deefcdb2c1006aaff011ca", "kind": "directory_service", "frame_number": 456, "timestamp_epoch": "1723680586.567224000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": {} }, { "event_id": "evt-9a8fb1e9709803c08e7734d5", "kind": "directory_service", "frame_number": 461, "timestamp_epoch": "1723680586.570595000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": {} }, { "event_id": "evt-df8d51294871538ff6300069", "kind": "directory_service", "frame_number": 464, "timestamp_epoch": "1723680586.571159000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": {} }, { "event_id": "evt-69cc4ea43533cb5b30b27dc1", "kind": "directory_service", "frame_number": 465, "timestamp_epoch": "1723680586.571718000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": {} }, { "event_id": "evt-52f909732f83a9066b7cc083", "kind": "directory_service", "frame_number": 466, "timestamp_epoch": "1723680586.572032000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": {} }, { "event_id": "evt-8ad736751fba38ca5de28380", "kind": "directory_service", "frame_number": 467, "timestamp_epoch": "1723680586.572226000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": {} }, { "event_id": "evt-96c6e2a6d339be515c8f9ad6", "kind": "directory_service", "frame_number": 477, "timestamp_epoch": "1723680586.858009000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-071b89466960698ed489b5c1", "kind": "directory_service", "frame_number": 479, "timestamp_epoch": "1723680586.858347000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-b95105848c6cc322aebccf66", "kind": "directory_service", "frame_number": 482, "timestamp_epoch": "1723680586.861444000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-298391ce39f67ffa936b779d", "kind": "directory_service", "frame_number": 484, "timestamp_epoch": "1723680586.862253000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-4db60a805d6424f1b8c3ac4c", "kind": "directory_service", "frame_number": 498, "timestamp_epoch": "1723680586.918933000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": { "ldap.baseObject": "DC=lafontainebleu,DC=org", "ldap.filter": "1", "ldap.protocolOp": "3" } }, { "event_id": "evt-e78db2e0c5a29e1b7a5a8d3e", "kind": "directory_service", "frame_number": 499, "timestamp_epoch": "1723680586.919299000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": { "ldap.protocolOp": "4,19,19,19,5" } }, { "event_id": "evt-618cfa81327d1959300c9745", "kind": "directory_service", "frame_number": 504, "timestamp_epoch": "1723680586.923457000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-a64f26c00cba3d225bb4f421", "kind": "directory_service", "frame_number": 506, "timestamp_epoch": "1723680586.924302000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-3afe6ff0d933c8eb17f05f5c", "kind": "directory_service", "frame_number": 507, "timestamp_epoch": "1723680586.925209000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-0e3092ffb06203dd772079a7", "kind": "directory_service", "frame_number": 508, "timestamp_epoch": "1723680586.925448000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-780c4fe7f36945923e91be87", "kind": "directory_service", "frame_number": 509, "timestamp_epoch": "1723680586.927027000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=lafontainebleu,DC=org", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-e61af26ea4b4e236009903bd", "kind": "directory_service", "frame_number": 510, "timestamp_epoch": "1723680586.927291000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-4210f594895b3f6cfd01124f", "kind": "directory_service", "frame_number": 511, "timestamp_epoch": "1723680586.927993000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": { "ldap.baseObject": "cn=policies,cn=system,DC=lafontainebleu,DC=org", "ldap.filter": "0", "ldap.protocolOp": "3" } }, { "event_id": "evt-b754b1663cbf6db6662a8063", "kind": "directory_service", "frame_number": 512, "timestamp_epoch": "1723680586.928362000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-3a4c080ab97c3645c3b1bf89", "kind": "directory_service", "frame_number": 669, "timestamp_epoch": "1723680587.233004000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 29, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-411a19db9300f4275886592c", "kind": "directory_service", "frame_number": 673, "timestamp_epoch": "1723680587.260152000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 27, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-76b109c8fddd43fb091c2eb7", "kind": "directory_service", "frame_number": 776, "timestamp_epoch": "1723680589.063397000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-ec0fb0780295b2f572a972a4", "kind": "directory_service", "frame_number": 777, "timestamp_epoch": "1723680589.063735000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-6c0d32ae5698325d20df421f", "kind": "directory_service", "frame_number": 778, "timestamp_epoch": "1723680589.064122000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-67ba08f7e0160c3376df1a15", "kind": "directory_service", "frame_number": 779, "timestamp_epoch": "1723680589.064448000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-a1aca064d1aa489fb6f3ada9", "kind": "directory_service", "frame_number": 780, "timestamp_epoch": "1723680589.064730000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-c1b6035b6b5d20c591b2d87f", "kind": "directory_service", "frame_number": 781, "timestamp_epoch": "1723680589.064904000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-966962ad5d042320c006b702", "kind": "directory_service", "frame_number": 784, "timestamp_epoch": "1723680589.066298000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-ea04c34ef584f8705efff2b1", "kind": "directory_service", "frame_number": 785, "timestamp_epoch": "1723680589.066447000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-480c56daad1e2c688cceb91e", "kind": "directory_service", "frame_number": 786, "timestamp_epoch": "1723680589.066760000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-a0da5df9f8345042c2c06d17", "kind": "directory_service", "frame_number": 787, "timestamp_epoch": "1723680589.066986000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-aec33b1debff23be9ef5f4ec", "kind": "directory_service", "frame_number": 788, "timestamp_epoch": "1723680589.067268000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-bca3e6bd426b8e2da9e562a1", "kind": "directory_service", "frame_number": 789, "timestamp_epoch": "1723680589.067414000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-9f5a04184c901a4142ca2295", "kind": "directory_service", "frame_number": 805, "timestamp_epoch": "1723680589.322280000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 36, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-2af8eccd6713f3421dff2a67", "kind": "directory_service", "frame_number": 807, "timestamp_epoch": "1723680589.322588000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 36, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-9925ae2104218c1c07a40ff7", "kind": "directory_service", "frame_number": 810, "timestamp_epoch": "1723680589.324404000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 36, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-66156a4dee1be3e706d238e1", "kind": "directory_service", "frame_number": 812, "timestamp_epoch": "1723680589.325251000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 36, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-7ba8648a893c0bd57ae4003b", "kind": "directory_service", "frame_number": 813, "timestamp_epoch": "1723680589.327099000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 36, "udp_stream": null, "fields": {} }, { "event_id": "evt-668cbcc470f25f117f88c00f", "kind": "directory_service", "frame_number": 814, "timestamp_epoch": "1723680589.327512000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 36, "udp_stream": null, "fields": {} }, { "event_id": "evt-58d44994bee3dceeb01a17d5", "kind": "directory_service", "frame_number": 815, "timestamp_epoch": "1723680589.327801000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 36, "udp_stream": null, "fields": {} }, { "event_id": "evt-98620d2a9864f467e88b85c7", "kind": "directory_service", "frame_number": 816, "timestamp_epoch": "1723680589.328051000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 36, "udp_stream": null, "fields": {} }, { "event_id": "evt-116842cc5896e5559c4e2c4f", "kind": "directory_service", "frame_number": 817, "timestamp_epoch": "1723680589.328308000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 36, "udp_stream": null, "fields": {} }, { "event_id": "evt-e13ad87880a2a29b0a072278", "kind": "directory_service", "frame_number": 818, "timestamp_epoch": "1723680589.328531000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 36, "udp_stream": null, "fields": {} }, { "event_id": "evt-a076a98b40b0907492df9c48", "kind": "directory_service", "frame_number": 823, "timestamp_epoch": "1723680589.330954000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 37, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-20e06a35eed478ac596a1b16", "kind": "directory_service", "frame_number": 825, "timestamp_epoch": "1723680589.331594000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 37, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-03af9338fec54bfc30c4a717", "kind": "directory_service", "frame_number": 826, "timestamp_epoch": "1723680589.331945000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 37, "udp_stream": null, "fields": {} }, { "event_id": "evt-6285373a5854a8cef0f2e932", "kind": "directory_service", "frame_number": 829, "timestamp_epoch": "1723680589.332163000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 37, "udp_stream": null, "fields": {} }, { "event_id": "evt-759f5b179b9af3fe01cb7631", "kind": "directory_service", "frame_number": 831, "timestamp_epoch": "1723680589.332615000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 37, "udp_stream": null, "fields": {} }, { "event_id": "evt-00f47fa161438db7feff6889", "kind": "directory_service", "frame_number": 832, "timestamp_epoch": "1723680589.332847000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 37, "udp_stream": null, "fields": {} }, { "event_id": "evt-1b3cf973ffdacf89556ebf2f", "kind": "directory_service", "frame_number": 833, "timestamp_epoch": "1723680589.333097000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 37, "udp_stream": null, "fields": {} }, { "event_id": "evt-a4b7c40eb08a27d3b9084fae", "kind": "directory_service", "frame_number": 835, "timestamp_epoch": "1723680589.333557000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 36, "udp_stream": null, "fields": {} }, { "event_id": "evt-64807631c0924e5db4fda85b", "kind": "directory_service", "frame_number": 892, "timestamp_epoch": "1723680594.911094000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-7a14fee30a70ae0451e09e04", "kind": "directory_service", "frame_number": 894, "timestamp_epoch": "1723680594.911658000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-47baacf249d5881ef18d7585", "kind": "directory_service", "frame_number": 897, "timestamp_epoch": "1723680594.913590000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-7afa00ca2b1eccf5a87fd424", "kind": "directory_service", "frame_number": 899, "timestamp_epoch": "1723680594.914633000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-08520088cb4de30d1589d126", "kind": "directory_service", "frame_number": 900, "timestamp_epoch": "1723680594.916130000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-f1e73551641a34c53f8172fe", "kind": "directory_service", "frame_number": 901, "timestamp_epoch": "1723680594.916365000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-5a776f273eed6b74854508f4", "kind": "directory_service", "frame_number": 902, "timestamp_epoch": "1723680594.916675000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-45d5024e552a72dc08ddc457", "kind": "directory_service", "frame_number": 903, "timestamp_epoch": "1723680594.916837000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-efd0304b189cb95fdf0c8e77", "kind": "directory_service", "frame_number": 904, "timestamp_epoch": "1723680594.917132000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "ldap.baseObject": "CN=NTDS Settings,CN=WIN-JEGJIX7Q9RS,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=lafontainebleu,DC=org", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-b464e421e8d7ce6a30bdcdd2", "kind": "directory_service", "frame_number": 905, "timestamp_epoch": "1723680594.917418000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-90a6852b158ec03b9901b47d", "kind": "directory_service", "frame_number": 906, "timestamp_epoch": "1723680594.917721000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Public Key Services,CN=Services,CN=Configuration,DC=lafontainebleu,DC=org", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-b427732d3669fa0e235430c6", "kind": "directory_service", "frame_number": 907, "timestamp_epoch": "1723680594.918030000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-cdc7164e9470b4e308bc9c76", "kind": "directory_service", "frame_number": 908, "timestamp_epoch": "1723680594.918472000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "ldap.baseObject": "CN=OID,CN=Public Key Services,CN=Services,CN=Configuration,DC=lafontainebleu,DC=org", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-89870ea830bb3f9fba399e7a", "kind": "directory_service", "frame_number": 909, "timestamp_epoch": "1723680594.918864000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-79bfea867c7988bc72ee1b8b", "kind": "directory_service", "frame_number": 914, "timestamp_epoch": "1723680594.931067000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 40, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-6730cbe57d26f639a4edf045", "kind": "directory_service", "frame_number": 916, "timestamp_epoch": "1723680594.931841000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 40, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-70d883491883f43263ef1395", "kind": "directory_service", "frame_number": 917, "timestamp_epoch": "1723680594.932325000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 40, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-112ee221d3becd73218f6d29", "kind": "directory_service", "frame_number": 918, "timestamp_epoch": "1723680594.932466000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 40, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-b8480d334263b7755d05b7cc", "kind": "directory_service", "frame_number": 949, "timestamp_epoch": "1723680594.937953000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 40, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=lafontainebleu,DC=org", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-ef95a43b07d7bbdc52d3469c", "kind": "directory_service", "frame_number": 950, "timestamp_epoch": "1723680594.938268000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 40, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-8f19efae0df70015025678d4", "kind": "directory_service", "frame_number": 951, "timestamp_epoch": "1723680594.938627000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 40, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-e5225df0818349ac4351d526", "kind": "directory_service", "frame_number": 955, "timestamp_epoch": "1723680594.939118000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 39, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-72f5091861cd2614744a355b", "kind": "directory_service", "frame_number": 1022, "timestamp_epoch": "1723680608.254938000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-9e94587e67ba289d184e8a6e", "kind": "directory_service", "frame_number": 1023, "timestamp_epoch": "1723680608.255139000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-0129d13ff1511d651300aa6c", "kind": "directory_service", "frame_number": 1024, "timestamp_epoch": "1723680608.255330000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-3150e323bc7fc8ea331b9761", "kind": "directory_service", "frame_number": 1025, "timestamp_epoch": "1723680608.255622000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-e509169f04dfc158f61b310a", "kind": "directory_service", "frame_number": 1026, "timestamp_epoch": "1723680608.255819000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-324100827154d880d3446d57", "kind": "directory_service", "frame_number": 1027, "timestamp_epoch": "1723680608.256076000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-ec67c65c2e9ca52fb594b4b4", "kind": "directory_service", "frame_number": 1028, "timestamp_epoch": "1723680608.256225000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-5fad922b86d22c99d1f63016", "kind": "directory_service", "frame_number": 1029, "timestamp_epoch": "1723680608.256355000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-3eb9bbf04e731a2609580143", "kind": "directory_service", "frame_number": 1034, "timestamp_epoch": "1723680608.262175000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 48, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-4d0fb913f61f8bff8e315eef", "kind": "directory_service", "frame_number": 1036, "timestamp_epoch": "1723680608.263016000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 48, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-19ca321b205082b45ca2e06a", "kind": "directory_service", "frame_number": 1037, "timestamp_epoch": "1723680608.266520000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 48, "udp_stream": null, "fields": { "ldap.baseObject": "DC=lafontainebleu,DC=org", "ldap.filter": "1", "ldap.protocolOp": "3" } }, { "event_id": "evt-b104f1e6bae53c37d9daa428", "kind": "directory_service", "frame_number": 1038, "timestamp_epoch": "1723680608.266867000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 48, "udp_stream": null, "fields": { "ldap.protocolOp": "4,19,19,19,5" } }, { "event_id": "evt-bea65e0e4014513425d0c448", "kind": "directory_service", "frame_number": 1043, "timestamp_epoch": "1723680608.269420000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 49, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-9285b7cbc422f36b7a0899b9", "kind": "directory_service", "frame_number": 1045, "timestamp_epoch": "1723680608.270141000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 49, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-fb97abcc05ad4146a871dc86", "kind": "directory_service", "frame_number": 1046, "timestamp_epoch": "1723680608.270460000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 49, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-556d1e9aef069c9f83c274d3", "kind": "directory_service", "frame_number": 1047, "timestamp_epoch": "1723680608.270637000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 49, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-58425a004a1f6b3b1c26ca38", "kind": "directory_service", "frame_number": 1048, "timestamp_epoch": "1723680608.270835000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 49, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=lafontainebleu,DC=org", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-3843e51bf1c7e11d0742cc54", "kind": "directory_service", "frame_number": 1049, "timestamp_epoch": "1723680608.271050000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 49, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-64fa1458e5e10eb4adf94508", "kind": "directory_service", "frame_number": 1050, "timestamp_epoch": "1723680608.271287000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 48, "udp_stream": null, "fields": { "ldap.baseObject": "cn=policies,cn=system,DC=lafontainebleu,DC=org", "ldap.filter": "0", "ldap.protocolOp": "3" } }, { "event_id": "evt-0ba23e4a8401bf7c719564ea", "kind": "directory_service", "frame_number": 1051, "timestamp_epoch": "1723680608.271601000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 48, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-51babd7707ee3947ab2e4cd6", "kind": "directory_service", "frame_number": 1083, "timestamp_epoch": "1723680608.286720000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 49, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-cb062b8deb4daff114689426", "kind": "directory_service", "frame_number": 1085, "timestamp_epoch": "1723680608.289999000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 48, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-d6bab1e67dc4bb2017a21b07", "kind": "directory_service", "frame_number": 1096, "timestamp_epoch": "1723680608.292494000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-91bb13506654ae3c7761a10b", "kind": "directory_service", "frame_number": 1097, "timestamp_epoch": "1723680608.292835000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-c91704b5ea0b72f996d5c09e", "kind": "directory_service", "frame_number": 1098, "timestamp_epoch": "1723680608.293037000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-a9f3f1bc554298f67bb101c6", "kind": "directory_service", "frame_number": 1099, "timestamp_epoch": "1723680608.293290000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-d294ec087ea9528c57af9098", "kind": "directory_service", "frame_number": 1100, "timestamp_epoch": "1723680608.293468000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-66410222ce9f3b99a30ccf5d", "kind": "directory_service", "frame_number": 1101, "timestamp_epoch": "1723680608.293826000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-d2d23c08b0f17013a9ecbf9d", "kind": "directory_service", "frame_number": 1102, "timestamp_epoch": "1723680608.294014000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-3c49da2aa547eb03b4d32bd0", "kind": "directory_service", "frame_number": 1103, "timestamp_epoch": "1723680608.294335000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-4c3afd32cd79c5ee0f260da4", "kind": "directory_service", "frame_number": 1104, "timestamp_epoch": "1723680608.294498000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-9fc87fada6e40567948e2d08", "kind": "directory_service", "frame_number": 1105, "timestamp_epoch": "1723680608.294889000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-e0b1f26219b056d572900002", "kind": "directory_service", "frame_number": 1106, "timestamp_epoch": "1723680608.295053000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-61e5a9de2c7d58a7273c6bf6", "kind": "directory_service", "frame_number": 1107, "timestamp_epoch": "1723680608.295392000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-920f0255bf8c8b8693a1be29", "kind": "directory_service", "frame_number": 1108, "timestamp_epoch": "1723680608.295580000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "34" } }, { "event_id": "evt-1d588f1f39e0c43c4e35689f", "kind": "directory_service", "frame_number": 1109, "timestamp_epoch": "1723680608.296055000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "34" } }, { "event_id": "evt-52c283687ab7eeedae775191", "kind": "directory_service", "frame_number": 1110, "timestamp_epoch": "1723680608.296214000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "36" } }, { "event_id": "evt-057ad208d6e97af2b0ac9cbb", "kind": "directory_service", "frame_number": 1111, "timestamp_epoch": "1723680608.296635000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "36", "samr.samr_UserInfo21.account_name": "plucero", "samr.samr_UserInfo21.full_name": "Pierce Lucero" } }, { "event_id": "evt-2a3c629bb6325a49590f6831", "kind": "directory_service", "frame_number": 1112, "timestamp_epoch": "1723680608.296855000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "3" } }, { "event_id": "evt-15b972080a55c73f31b3c262", "kind": "directory_service", "frame_number": 1113, "timestamp_epoch": "1723680608.297258000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "3" } }, { "event_id": "evt-463faaf2e8817cdcafee86f8", "kind": "directory_service", "frame_number": 1114, "timestamp_epoch": "1723680608.297426000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "39" } }, { "event_id": "evt-cf3e1671f44dc4e9a8a7e6d5", "kind": "directory_service", "frame_number": 1115, "timestamp_epoch": "1723680608.297744000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "39" } }, { "event_id": "evt-227598332c81befb7309373b", "kind": "directory_service", "frame_number": 1116, "timestamp_epoch": "1723680608.297908000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "16" } }, { "event_id": "evt-1582869352c7693943b3af9e", "kind": "directory_service", "frame_number": 1117, "timestamp_epoch": "1723680608.298252000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "16" } }, { "event_id": "evt-d1f4c664572b0ac9b8338533", "kind": "directory_service", "frame_number": 1118, "timestamp_epoch": "1723680608.298462000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-1442f9399cfabc0860865cbb", "kind": "directory_service", "frame_number": 1119, "timestamp_epoch": "1723680608.298712000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-3238ca048567a18f8f423c0e", "kind": "directory_service", "frame_number": 1120, "timestamp_epoch": "1723680608.298892000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-7d497e9d6d5efd511d90b59a", "kind": "directory_service", "frame_number": 1121, "timestamp_epoch": "1723680608.299161000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-20ef085f5ad24695eebef54e", "kind": "directory_service", "frame_number": 1122, "timestamp_epoch": "1723680608.299311000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-d81f3c38173b9e22a8eb5b3a", "kind": "directory_service", "frame_number": 1123, "timestamp_epoch": "1723680608.299551000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-6e493b96669959cb67ddf880", "kind": "directory_service", "frame_number": 1124, "timestamp_epoch": "1723680608.299700000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-5f000d1a4c05fe502779c69f", "kind": "directory_service", "frame_number": 1125, "timestamp_epoch": "1723680608.299949000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 1, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-d4589231ed40e9b5ef76c04d", "kind": "directory_service", "frame_number": 2170, "timestamp_epoch": "1723680619.142078000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 75, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-b833f567f02e02d1a66dc692", "kind": "directory_service", "frame_number": 2171, "timestamp_epoch": "1723680619.142315000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 75, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-5d3f2e7cc9148debde610664", "kind": "directory_service", "frame_number": 2173, "timestamp_epoch": "1723680619.142601000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 75, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-7c54e8e361411fd07da5190e", "kind": "directory_service", "frame_number": 2175, "timestamp_epoch": "1723680619.142979000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 75, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-17ba8ed038e2257fc4116b15", "kind": "directory_service", "frame_number": 2176, "timestamp_epoch": "1723680619.143163000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 75, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-5afb067dfd93074fd3a13643", "kind": "directory_service", "frame_number": 2179, "timestamp_epoch": "1723680619.143304000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 75, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-adf4102a531a19b7727c53cb", "kind": "directory_service", "frame_number": 2184, "timestamp_epoch": "1723680619.146051000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 75, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-0189cbfb469d54717825b62e", "kind": "directory_service", "frame_number": 2185, "timestamp_epoch": "1723680619.146253000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 75, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-61d5330f9057891da6db4d69", "kind": "directory_service", "frame_number": 2186, "timestamp_epoch": "1723680619.146435000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 75, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-20ba4bd03073bd59a0801ce5", "kind": "directory_service", "frame_number": 2187, "timestamp_epoch": "1723680619.146719000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 75, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-02ff757de6a6017288af0138", "kind": "directory_service", "frame_number": 2188, "timestamp_epoch": "1723680619.146901000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 75, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-7617fcf07e3a6d0bc9ce3194", "kind": "directory_service", "frame_number": 2189, "timestamp_epoch": "1723680619.147091000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 75, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-0b6bbf6a7a2f9c4707e26063", "kind": "directory_service", "frame_number": 2193, "timestamp_epoch": "1723680619.150261000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 76, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-0dec8e8cb60fd8ca8d27e725", "kind": "directory_service", "frame_number": 2195, "timestamp_epoch": "1723680619.150540000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 76, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-ebdc8c13f90190058a43017c", "kind": "directory_service", "frame_number": 2198, "timestamp_epoch": "1723680619.151800000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 76, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-d3140517a8df255f6d154109", "kind": "directory_service", "frame_number": 2200, "timestamp_epoch": "1723680619.152525000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 76, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-f9875f5539e5d6d24ecda9cf", "kind": "directory_service", "frame_number": 2201, "timestamp_epoch": "1723680619.152947000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 76, "udp_stream": null, "fields": {} }, { "event_id": "evt-c0e002d427051147751ed60e", "kind": "directory_service", "frame_number": 2202, "timestamp_epoch": "1723680619.153176000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 76, "udp_stream": null, "fields": {} }, { "event_id": "evt-1ea7f3be552de4119ff7d5a8", "kind": "directory_service", "frame_number": 2203, "timestamp_epoch": "1723680619.153458000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 76, "udp_stream": null, "fields": {} }, { "event_id": "evt-f82ba96e92c24a367bd32e23", "kind": "directory_service", "frame_number": 2204, "timestamp_epoch": "1723680619.153636000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 76, "udp_stream": null, "fields": {} }, { "event_id": "evt-208dd3d44cdb761a14dfb996", "kind": "directory_service", "frame_number": 2205, "timestamp_epoch": "1723680619.153878000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 76, "udp_stream": null, "fields": {} }, { "event_id": "evt-f0e1cf8366616cbf5e8c1d0f", "kind": "directory_service", "frame_number": 2206, "timestamp_epoch": "1723680619.154056000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 76, "udp_stream": null, "fields": {} }, { "event_id": "evt-92cbf0f7de950df1c0ec20bb", "kind": "directory_service", "frame_number": 2211, "timestamp_epoch": "1723680619.157530000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-c1f2a8201f73d06454a94f44", "kind": "directory_service", "frame_number": 2213, "timestamp_epoch": "1723680619.158222000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-0f65cb968712caa2eed21ddb", "kind": "directory_service", "frame_number": 2214, "timestamp_epoch": "1723680619.158686000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": {} }, { "event_id": "evt-197347e0808afcbe9594c9ac", "kind": "directory_service", "frame_number": 2217, "timestamp_epoch": "1723680619.158932000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": {} }, { "event_id": "evt-90127110d37485c10c957cba", "kind": "directory_service", "frame_number": 2219, "timestamp_epoch": "1723680619.159464000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": {} }, { "event_id": "evt-eac1b2df994bbf6f147ce289", "kind": "directory_service", "frame_number": 2220, "timestamp_epoch": "1723680619.159752000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": {} }, { "event_id": "evt-2aff34668cf2a18b252f99cd", "kind": "directory_service", "frame_number": 2221, "timestamp_epoch": "1723680619.160052000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": {} }, { "event_id": "evt-67c3d51b239c4c0db97a4de7", "kind": "directory_service", "frame_number": 2224, "timestamp_epoch": "1723680619.160335000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 76, "udp_stream": null, "fields": {} }, { "event_id": "evt-a11ace813f23794226336964", "kind": "directory_service", "frame_number": 8771, "timestamp_epoch": "1723680669.170554000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 116, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-dfbaf9067368cdfe90e9ff2b", "kind": "directory_service", "frame_number": 8772, "timestamp_epoch": "1723680669.170822000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 116, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-20b51e6b5f7489392772e86d", "kind": "directory_service", "frame_number": 8773, "timestamp_epoch": "1723680669.171234000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 116, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-3b671c5dae04e3dd77603f51", "kind": "directory_service", "frame_number": 8774, "timestamp_epoch": "1723680669.171583000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 116, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-94631981c1ff5dd9a8585867", "kind": "directory_service", "frame_number": 8775, "timestamp_epoch": "1723680669.171828000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 116, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-c7cf2018dee3ac7a7f881756", "kind": "directory_service", "frame_number": 8776, "timestamp_epoch": "1723680669.172016000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 116, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-cd47f76836b03edd9637e369", "kind": "directory_service", "frame_number": 8779, "timestamp_epoch": "1723680669.173716000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 116, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-e9cc2981c43db4921807ace3", "kind": "directory_service", "frame_number": 8780, "timestamp_epoch": "1723680669.173916000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 116, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-60db78882f8ddcb8b05a4f38", "kind": "directory_service", "frame_number": 8781, "timestamp_epoch": "1723680669.174116000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 116, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-6a852b863d77c5dd694a5643", "kind": "directory_service", "frame_number": 8782, "timestamp_epoch": "1723680669.174421000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 116, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-9feb81b230f1f75e98fc1f19", "kind": "directory_service", "frame_number": 8783, "timestamp_epoch": "1723680669.174611000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 116, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-7a53be0e5104f60e60987d98", "kind": "directory_service", "frame_number": 8784, "timestamp_epoch": "1723680669.174776000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 116, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-fdffcac2cc7e803abf8ad583", "kind": "directory_service", "frame_number": 8788, "timestamp_epoch": "1723680669.177116000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 117, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-7e912c81438c70a812d0433d", "kind": "directory_service", "frame_number": 8790, "timestamp_epoch": "1723680669.177405000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 117, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-2141f7faf7415d33e8ae5f2e", "kind": "directory_service", "frame_number": 8793, "timestamp_epoch": "1723680669.178289000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 117, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-ded98ea3e7ff3df64d3eca82", "kind": "directory_service", "frame_number": 8795, "timestamp_epoch": "1723680669.179140000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 117, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-5c092544c66c10bf9adb2963", "kind": "directory_service", "frame_number": 8796, "timestamp_epoch": "1723680669.179482000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 117, "udp_stream": null, "fields": {} }, { "event_id": "evt-c17c9cc0621820fc23c21b05", "kind": "directory_service", "frame_number": 8797, "timestamp_epoch": "1723680669.179708000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 117, "udp_stream": null, "fields": {} }, { "event_id": "evt-15d0a642a46c5ee2f3a6de2b", "kind": "directory_service", "frame_number": 8798, "timestamp_epoch": "1723680669.179947000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 117, "udp_stream": null, "fields": {} }, { "event_id": "evt-716af230d7b78f462402010f", "kind": "directory_service", "frame_number": 8799, "timestamp_epoch": "1723680669.180172000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 117, "udp_stream": null, "fields": {} }, { "event_id": "evt-29599ba7e2f55140569ee824", "kind": "directory_service", "frame_number": 8800, "timestamp_epoch": "1723680669.180357000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 117, "udp_stream": null, "fields": {} }, { "event_id": "evt-89e4f1f35d4564486cf6bbf4", "kind": "directory_service", "frame_number": 8801, "timestamp_epoch": "1723680669.180565000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 117, "udp_stream": null, "fields": {} }, { "event_id": "evt-0a82d354033067ed5e1b1cf3", "kind": "directory_service", "frame_number": 8806, "timestamp_epoch": "1723680669.183217000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 118, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-fd279ba640686b45778772c7", "kind": "directory_service", "frame_number": 8808, "timestamp_epoch": "1723680669.183920000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 118, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-f8b66592815149c900ec35c1", "kind": "directory_service", "frame_number": 8809, "timestamp_epoch": "1723680669.184395000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 118, "udp_stream": null, "fields": {} }, { "event_id": "evt-a8c8ee52861b7d1096c9b924", "kind": "directory_service", "frame_number": 8812, "timestamp_epoch": "1723680669.184677000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 118, "udp_stream": null, "fields": {} }, { "event_id": "evt-0fcaded857173b28b854ca7c", "kind": "directory_service", "frame_number": 8814, "timestamp_epoch": "1723680669.185005000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 118, "udp_stream": null, "fields": {} }, { "event_id": "evt-6fcf63394bf82b1bb9cff78b", "kind": "directory_service", "frame_number": 8815, "timestamp_epoch": "1723680669.185287000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 118, "udp_stream": null, "fields": {} }, { "event_id": "evt-c90b97edef03560f7e6f2ced", "kind": "directory_service", "frame_number": 8816, "timestamp_epoch": "1723680669.185491000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 118, "udp_stream": null, "fields": {} }, { "event_id": "evt-80b6d0280275f1d88ca7a3d2", "kind": "directory_service", "frame_number": 8820, "timestamp_epoch": "1723680669.186001000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 117, "udp_stream": null, "fields": {} }, { "event_id": "evt-a6bd984a08492b4f4d278223", "kind": "directory_service", "frame_number": 10324, "timestamp_epoch": "1723680707.872008000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 129, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-5147acdeb4ffb52da426eba3", "kind": "directory_service", "frame_number": 10325, "timestamp_epoch": "1723680707.872244000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 129, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-aef6566ff910f9957acd66c7", "kind": "directory_service", "frame_number": 10326, "timestamp_epoch": "1723680707.872467000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 129, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-8cd34a69b7ec97eb79506fa5", "kind": "directory_service", "frame_number": 10327, "timestamp_epoch": "1723680707.872807000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 129, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-60908184f4dc155f12edffb0", "kind": "directory_service", "frame_number": 10328, "timestamp_epoch": "1723680707.873023000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 129, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-df7c8203f289e43e2e29eafd", "kind": "directory_service", "frame_number": 10329, "timestamp_epoch": "1723680707.873195000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 129, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-a5a2384954177c2c5def6b2e", "kind": "directory_service", "frame_number": 10332, "timestamp_epoch": "1723680707.874681000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 129, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-b4d8bf2b3c75c0834357b575", "kind": "directory_service", "frame_number": 10333, "timestamp_epoch": "1723680707.874883000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 129, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-546d7c177b120332f9dae62c", "kind": "directory_service", "frame_number": 10334, "timestamp_epoch": "1723680707.875077000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 129, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-4c47ea7a1e2ee671b95ffe86", "kind": "directory_service", "frame_number": 10335, "timestamp_epoch": "1723680707.875361000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 129, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-51c086dcb1164d281dbd1f43", "kind": "directory_service", "frame_number": 10336, "timestamp_epoch": "1723680707.875542000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 129, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-7aadd8d5062f7d502d1f2d39", "kind": "directory_service", "frame_number": 10337, "timestamp_epoch": "1723680707.875719000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 129, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-ad1aaf6887b29a421a5076f9", "kind": "directory_service", "frame_number": 10341, "timestamp_epoch": "1723680707.878189000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-4cfe3c4b080688a9e20a202f", "kind": "directory_service", "frame_number": 10343, "timestamp_epoch": "1723680707.878499000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-ede73d25ef5ae3eefcdab99e", "kind": "directory_service", "frame_number": 10346, "timestamp_epoch": "1723680707.879339000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-57aa7e5d5cbbc57303aa7512", "kind": "directory_service", "frame_number": 10348, "timestamp_epoch": "1723680707.880056000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-c3242c0a3da74f9549721cff", "kind": "directory_service", "frame_number": 10349, "timestamp_epoch": "1723680707.880452000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": {} }, { "event_id": "evt-b4f3fbded650039862d4d79b", "kind": "directory_service", "frame_number": 10350, "timestamp_epoch": "1723680707.880675000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": {} }, { "event_id": "evt-a6b5194e2204529b695b8513", "kind": "directory_service", "frame_number": 10351, "timestamp_epoch": "1723680707.880893000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": {} }, { "event_id": "evt-1e708a8a5b720223d75441e5", "kind": "directory_service", "frame_number": 10352, "timestamp_epoch": "1723680707.881085000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": {} }, { "event_id": "evt-3758c2289e2c231f6eb6b4d1", "kind": "directory_service", "frame_number": 10353, "timestamp_epoch": "1723680707.881264000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": {} }, { "event_id": "evt-cad249d2872f2d4616522d6f", "kind": "directory_service", "frame_number": 10354, "timestamp_epoch": "1723680707.881451000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": {} }, { "event_id": "evt-3b180432aa595b08c4f44117", "kind": "directory_service", "frame_number": 10359, "timestamp_epoch": "1723680707.884542000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-394de8ae02436caca340cee0", "kind": "directory_service", "frame_number": 10361, "timestamp_epoch": "1723680707.885178000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-9f6937cc60f00ebf9e599132", "kind": "directory_service", "frame_number": 10362, "timestamp_epoch": "1723680707.885559000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": {} }, { "event_id": "evt-f8ad3794310efd08d78d35cd", "kind": "directory_service", "frame_number": 10365, "timestamp_epoch": "1723680707.885810000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": {} }, { "event_id": "evt-988b75e8fa017915ccb4776d", "kind": "directory_service", "frame_number": 10367, "timestamp_epoch": "1723680707.886071000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": {} }, { "event_id": "evt-7bf10b8962bf8bebd2bf252e", "kind": "directory_service", "frame_number": 10368, "timestamp_epoch": "1723680707.886329000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": {} }, { "event_id": "evt-b245b7ce3eb54b959d89646b", "kind": "directory_service", "frame_number": 10369, "timestamp_epoch": "1723680707.886516000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": {} }, { "event_id": "evt-62892d214fa6281c228a86ea", "kind": "directory_service", "frame_number": 10373, "timestamp_epoch": "1723680707.886942000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": {} }, { "event_id": "evt-5562821aef5e4f81c64ed6b7", "kind": "directory_service", "frame_number": 10792, "timestamp_epoch": "1723680726.271910000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 136, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-88cfa4c635925f79451031bd", "kind": "directory_service", "frame_number": 10793, "timestamp_epoch": "1723680726.272191000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 136, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-c729fee4c7f592f67a5e4725", "kind": "directory_service", "frame_number": 10794, "timestamp_epoch": "1723680726.272437000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 136, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-97e461168bd641148010e834", "kind": "directory_service", "frame_number": 10795, "timestamp_epoch": "1723680726.272794000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 136, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-23b6c5f260901e833f73fd6d", "kind": "directory_service", "frame_number": 10796, "timestamp_epoch": "1723680726.272994000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 136, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-346799d7365b4c13fb20fe9a", "kind": "directory_service", "frame_number": 10797, "timestamp_epoch": "1723680726.273174000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 136, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-7d7fbf2575ba7cfa3a9ab617", "kind": "directory_service", "frame_number": 10800, "timestamp_epoch": "1723680726.274795000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 136, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-5f407335eb59d374ef8ea503", "kind": "directory_service", "frame_number": 10801, "timestamp_epoch": "1723680726.274984000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 136, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-7e016979f75905a9e8d93c54", "kind": "directory_service", "frame_number": 10802, "timestamp_epoch": "1723680726.275171000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 136, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-342bce1e92bb78a1fe6971e4", "kind": "directory_service", "frame_number": 10803, "timestamp_epoch": "1723680726.275430000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 136, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-81305350f0ba451be699a31d", "kind": "directory_service", "frame_number": 10804, "timestamp_epoch": "1723680726.275611000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 136, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-1feab9b1b3776136d436f32c", "kind": "directory_service", "frame_number": 10805, "timestamp_epoch": "1723680726.275772000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 136, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-328ccbb2343998a193d4391e", "kind": "directory_service", "frame_number": 10809, "timestamp_epoch": "1723680726.278208000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-7a23e407388b6ea24444aeeb", "kind": "directory_service", "frame_number": 10811, "timestamp_epoch": "1723680726.278478000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-73cbb903111d66c15d86851d", "kind": "directory_service", "frame_number": 10814, "timestamp_epoch": "1723680726.279327000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-1067c681cef3a9f8a186df31", "kind": "directory_service", "frame_number": 10816, "timestamp_epoch": "1723680726.279932000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-3a71600bfb857565b527ed3e", "kind": "directory_service", "frame_number": 10817, "timestamp_epoch": "1723680726.280306000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": {} }, { "event_id": "evt-4235ac19164c7eaa8f085e50", "kind": "directory_service", "frame_number": 10818, "timestamp_epoch": "1723680726.280560000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": {} }, { "event_id": "evt-92f19c4c3e0ad66aaa076c0d", "kind": "directory_service", "frame_number": 10819, "timestamp_epoch": "1723680726.280781000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": {} }, { "event_id": "evt-bf9f1bb52fb603783344fffa", "kind": "directory_service", "frame_number": 10820, "timestamp_epoch": "1723680726.280982000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": {} }, { "event_id": "evt-6a273324d7113ec22a8d7f6f", "kind": "directory_service", "frame_number": 10821, "timestamp_epoch": "1723680726.281165000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": {} }, { "event_id": "evt-557f828889a1ea662900d6d9", "kind": "directory_service", "frame_number": 10822, "timestamp_epoch": "1723680726.281360000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": {} }, { "event_id": "evt-244e7896d34444257808b8f4", "kind": "directory_service", "frame_number": 10827, "timestamp_epoch": "1723680726.284604000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-f84538d45fd83bc7dcff98ec", "kind": "directory_service", "frame_number": 10829, "timestamp_epoch": "1723680726.285345000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-572cc974d5ed25f3c0c817ae", "kind": "directory_service", "frame_number": 10830, "timestamp_epoch": "1723680726.285727000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": {} }, { "event_id": "evt-ebb66235de9f13bb234afe0b", "kind": "directory_service", "frame_number": 10833, "timestamp_epoch": "1723680726.285995000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": {} }, { "event_id": "evt-c0651881b0b9331bc654b339", "kind": "directory_service", "frame_number": 10835, "timestamp_epoch": "1723680726.286321000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": {} }, { "event_id": "evt-848c467c742b58274c16f6bb", "kind": "directory_service", "frame_number": 10836, "timestamp_epoch": "1723680726.286605000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": {} }, { "event_id": "evt-2e3419c4161a4679ef2a5ae5", "kind": "directory_service", "frame_number": 10837, "timestamp_epoch": "1723680726.286818000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": {} }, { "event_id": "evt-2f06cc76009ac4f173c3c310", "kind": "directory_service", "frame_number": 10841, "timestamp_epoch": "1723680726.287221000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 137, "udp_stream": null, "fields": {} }, { "event_id": "evt-b372487680082f5ec68acce4", "kind": "directory_service", "frame_number": 11542, "timestamp_epoch": "1723680793.575615000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-afc5baf58b96e6f14d4009dc", "kind": "directory_service", "frame_number": 11543, "timestamp_epoch": "1723680793.575868000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-46cc67776533276bfb94d2ad", "kind": "directory_service", "frame_number": 11544, "timestamp_epoch": "1723680793.576154000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-a3879cdab9194fcd834e857f", "kind": "directory_service", "frame_number": 11545, "timestamp_epoch": "1723680793.576475000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-dc0285e89f991fd31936d23b", "kind": "directory_service", "frame_number": 11546, "timestamp_epoch": "1723680793.576710000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-d7c424d465e3476bfed62505", "kind": "directory_service", "frame_number": 11547, "timestamp_epoch": "1723680793.576876000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-0cdc75427f15c5de22d80a07", "kind": "directory_service", "frame_number": 11550, "timestamp_epoch": "1723680793.578633000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-f004460087df92ddbe0e91cc", "kind": "directory_service", "frame_number": 11551, "timestamp_epoch": "1723680793.578827000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-6bd65d76c4f2a3a30d4004b5", "kind": "directory_service", "frame_number": 11552, "timestamp_epoch": "1723680793.579033000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-11f7f6e01249c21eb7f831fa", "kind": "directory_service", "frame_number": 11553, "timestamp_epoch": "1723680793.579321000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-58b2ae3c88fe0874e9ded9ce", "kind": "directory_service", "frame_number": 11554, "timestamp_epoch": "1723680793.579501000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-49afdbdf54683295bccaf551", "kind": "directory_service", "frame_number": 11555, "timestamp_epoch": "1723680793.579650000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 147, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-c4b8a5103620b991ec36fb1b", "kind": "directory_service", "frame_number": 11559, "timestamp_epoch": "1723680793.582099000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 148, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-e87c1310e7d7fd56671e8424", "kind": "directory_service", "frame_number": 11561, "timestamp_epoch": "1723680793.582360000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 148, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-68f192644c815e4f94e204b9", "kind": "directory_service", "frame_number": 11564, "timestamp_epoch": "1723680793.583308000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 148, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-c354e1a035fdfd1d02dbfc51", "kind": "directory_service", "frame_number": 11566, "timestamp_epoch": "1723680793.584069000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 148, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-e7760094c8fd89527320b62a", "kind": "directory_service", "frame_number": 11567, "timestamp_epoch": "1723680793.584848000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 148, "udp_stream": null, "fields": {} }, { "event_id": "evt-737024da5ebd5af3815485c8", "kind": "directory_service", "frame_number": 11568, "timestamp_epoch": "1723680793.585134000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 148, "udp_stream": null, "fields": {} }, { "event_id": "evt-c77b1fd4587a7eb9801167df", "kind": "directory_service", "frame_number": 11569, "timestamp_epoch": "1723680793.585396000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 148, "udp_stream": null, "fields": {} }, { "event_id": "evt-74c8612bb62d6282b4d307df", "kind": "directory_service", "frame_number": 11570, "timestamp_epoch": "1723680793.585635000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 148, "udp_stream": null, "fields": {} }, { "event_id": "evt-464b5338c03a950b9e536c27", "kind": "directory_service", "frame_number": 11571, "timestamp_epoch": "1723680793.585855000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 148, "udp_stream": null, "fields": {} }, { "event_id": "evt-2eaf73528534c5c448e04bfd", "kind": "directory_service", "frame_number": 11572, "timestamp_epoch": "1723680793.586076000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 148, "udp_stream": null, "fields": {} }, { "event_id": "evt-4cf48fffa1093c79eb3ac616", "kind": "directory_service", "frame_number": 11577, "timestamp_epoch": "1723680793.589691000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 149, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-e9c321c558528d73fcb00d88", "kind": "directory_service", "frame_number": 11579, "timestamp_epoch": "1723680793.590422000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 149, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-c5514c01fde0cace07af0ea3", "kind": "directory_service", "frame_number": 11580, "timestamp_epoch": "1723680793.590821000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 149, "udp_stream": null, "fields": {} }, { "event_id": "evt-a2162b67379022484d319c49", "kind": "directory_service", "frame_number": 11583, "timestamp_epoch": "1723680793.591070000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 149, "udp_stream": null, "fields": {} }, { "event_id": "evt-2916240257490c7f01cb5a18", "kind": "directory_service", "frame_number": 11585, "timestamp_epoch": "1723680793.591360000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 149, "udp_stream": null, "fields": {} }, { "event_id": "evt-7970c561f5db6cba75554be9", "kind": "directory_service", "frame_number": 11586, "timestamp_epoch": "1723680793.591623000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 149, "udp_stream": null, "fields": {} }, { "event_id": "evt-0c1d61356321aa3d7b0d5a7c", "kind": "directory_service", "frame_number": 11587, "timestamp_epoch": "1723680793.591818000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 149, "udp_stream": null, "fields": {} }, { "event_id": "evt-d4893a8630ff69c4f7943f82", "kind": "directory_service", "frame_number": 11591, "timestamp_epoch": "1723680793.592067000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 148, "udp_stream": null, "fields": {} }, { "event_id": "evt-1bd50b9ba4a79c73292f1492", "kind": "directory_service", "frame_number": 11637, "timestamp_epoch": "1723680795.692663000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 152, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-1faaf2831788813335be09b9", "kind": "directory_service", "frame_number": 11639, "timestamp_epoch": "1723680795.693019000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 152, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-1ccae1ebc62e2c09612f32e2", "kind": "directory_service", "frame_number": 11654, "timestamp_epoch": "1723680795.702791000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 152, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-13b658f14d4c44579ef96ec3", "kind": "directory_service", "frame_number": 11656, "timestamp_epoch": "1723680795.703747000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 152, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-6a01aada8cb6c1693cc17656", "kind": "directory_service", "frame_number": 11657, "timestamp_epoch": "1723680795.705483000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 152, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Pierce Lucero,CN=Users,DC=lafontainebleu,DC=org", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-c78f357533c2b2f19c62da98", "kind": "directory_service", "frame_number": 11658, "timestamp_epoch": "1723680795.705808000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 152, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-bdc0f5f83c41f69f3a83b1b0", "kind": "directory_service", "frame_number": 11659, "timestamp_epoch": "1723680795.706187000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 152, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-1008e73a895aa2cc48dbd690", "kind": "directory_service", "frame_number": 11671, "timestamp_epoch": "1723680795.728515000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 154, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-c2b7cc0ee763c0e3ab8dbb6a", "kind": "directory_service", "frame_number": 11673, "timestamp_epoch": "1723680795.729326000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 154, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-a9cd1e665d33c051e802742a", "kind": "directory_service", "frame_number": 11674, "timestamp_epoch": "1723680795.729653000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 154, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Pierce Lucero,CN=Users,DC=lafontainebleu,DC=org", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-4a62750342391f0d982b1ae9", "kind": "directory_service", "frame_number": 11675, "timestamp_epoch": "1723680795.729993000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 154, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-5030cdf157b575333d9383c6", "kind": "directory_service", "frame_number": 11676, "timestamp_epoch": "1723680795.730221000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 154, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-82db3fa98eb38acee1938f8f", "kind": "directory_service", "frame_number": 12511, "timestamp_epoch": "1723680911.761187000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 196, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-fa352e1ab5033aad38ef37a8", "kind": "directory_service", "frame_number": 12513, "timestamp_epoch": "1723680911.761516000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 196, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-6bbdfba52b6a3d4d74bb3340", "kind": "directory_service", "frame_number": 12516, "timestamp_epoch": "1723680911.762733000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 196, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-17a469c499005dd813b0157a", "kind": "directory_service", "frame_number": 12518, "timestamp_epoch": "1723680911.763442000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 196, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-b884c4f41f0ccf2c8746068f", "kind": "directory_service", "frame_number": 12519, "timestamp_epoch": "1723680911.764785000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 196, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Pierce Lucero,CN=Users,DC=lafontainebleu,DC=org", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-4ee562fe85aabeeea7b4481e", "kind": "directory_service", "frame_number": 12520, "timestamp_epoch": "1723680911.765039000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 196, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-36d5208ea63dcd4495b49dc6", "kind": "directory_service", "frame_number": 12521, "timestamp_epoch": "1723680911.765407000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 196, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-43fefc6119ff815c23186032", "kind": "directory_service", "frame_number": 12527, "timestamp_epoch": "1723680911.773739000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 197, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-6e894e0c451108601b2d01eb", "kind": "directory_service", "frame_number": 12529, "timestamp_epoch": "1723680911.774536000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 197, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-8778cb45a5c018833776aad3", "kind": "directory_service", "frame_number": 12530, "timestamp_epoch": "1723680911.783790000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 197, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Pierce Lucero,CN=Users,DC=lafontainebleu,DC=org", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-bbf5f63aac887e59ec66d5e4", "kind": "directory_service", "frame_number": 12531, "timestamp_epoch": "1723680911.784208000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 197, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-253c5a7f3c4bb94c0d7b1160", "kind": "directory_service", "frame_number": 12532, "timestamp_epoch": "1723680911.784493000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 197, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-08bc6339bbac512d2359be7e", "kind": "directory_service", "frame_number": 13681, "timestamp_epoch": "1723680984.938022000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 212, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-a825990cd87f6673c510bc5d", "kind": "directory_service", "frame_number": 13682, "timestamp_epoch": "1723680984.938304000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 212, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-aeba0c85565a3b0b392c9e13", "kind": "directory_service", "frame_number": 13683, "timestamp_epoch": "1723680984.938687000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 212, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-4b6f3a5c6de79c948f0893b8", "kind": "directory_service", "frame_number": 13684, "timestamp_epoch": "1723680984.939080000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 212, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-9893e681ea6c1b8e136db0b5", "kind": "directory_service", "frame_number": 13685, "timestamp_epoch": "1723680984.939327000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 212, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-e211369a525f2d9e42723d4b", "kind": "directory_service", "frame_number": 13686, "timestamp_epoch": "1723680984.939542000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 212, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-742d8521b1585579a9e0421a", "kind": "directory_service", "frame_number": 13689, "timestamp_epoch": "1723680984.940868000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 212, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-8f6a189cfe862541f8f9231f", "kind": "directory_service", "frame_number": 13690, "timestamp_epoch": "1723680984.941065000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 212, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-ba1e8a155a1bf1c2abe5e6d1", "kind": "directory_service", "frame_number": 13691, "timestamp_epoch": "1723680984.941263000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 212, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-8f83801fecafe12162f16887", "kind": "directory_service", "frame_number": 13692, "timestamp_epoch": "1723680984.941557000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 212, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-2005e31284ddb9c335ef87e2", "kind": "directory_service", "frame_number": 13693, "timestamp_epoch": "1723680984.941752000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 212, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-90c8544805d3364c214f1532", "kind": "directory_service", "frame_number": 13694, "timestamp_epoch": "1723680984.941918000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 212, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-e2cbf1373f3e3165ff258308", "kind": "directory_service", "frame_number": 13698, "timestamp_epoch": "1723680984.944075000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 213, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-ec3fc55ab74ad49a36655f79", "kind": "directory_service", "frame_number": 13700, "timestamp_epoch": "1723680984.944342000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 213, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-f81cbe95fdf9b42b61a0c50a", "kind": "directory_service", "frame_number": 13703, "timestamp_epoch": "1723680984.945127000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 213, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-4455f226da89d01efb4669c9", "kind": "directory_service", "frame_number": 13705, "timestamp_epoch": "1723680984.945807000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 213, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-1bca5d5d8d829dc4ebf13d8e", "kind": "directory_service", "frame_number": 13706, "timestamp_epoch": "1723680984.946117000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 213, "udp_stream": null, "fields": {} }, { "event_id": "evt-f606e84ecf50dba5608c1a94", "kind": "directory_service", "frame_number": 13707, "timestamp_epoch": "1723680984.946341000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 213, "udp_stream": null, "fields": {} }, { "event_id": "evt-c03bcd5dd3abaff9874631b4", "kind": "directory_service", "frame_number": 13708, "timestamp_epoch": "1723680984.946537000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 213, "udp_stream": null, "fields": {} }, { "event_id": "evt-df9b29e5812b3b66df84f27d", "kind": "directory_service", "frame_number": 13709, "timestamp_epoch": "1723680984.946751000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 213, "udp_stream": null, "fields": {} }, { "event_id": "evt-d3dfcf5d46bc8fd14134508b", "kind": "directory_service", "frame_number": 13710, "timestamp_epoch": "1723680984.946934000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 213, "udp_stream": null, "fields": {} }, { "event_id": "evt-da2a8c08b355f3c3716db2c3", "kind": "directory_service", "frame_number": 13711, "timestamp_epoch": "1723680984.947134000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 213, "udp_stream": null, "fields": {} }, { "event_id": "evt-12a86c9fa996a6e03badd0be", "kind": "directory_service", "frame_number": 13716, "timestamp_epoch": "1723680984.949622000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 214, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-657476abbe9f4a71e28e25a6", "kind": "directory_service", "frame_number": 13718, "timestamp_epoch": "1723680984.950226000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 214, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-ac17a346e9341ae0eccee786", "kind": "directory_service", "frame_number": 13719, "timestamp_epoch": "1723680984.950526000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 214, "udp_stream": null, "fields": {} }, { "event_id": "evt-c148c3536210d1fe59be6134", "kind": "directory_service", "frame_number": 13722, "timestamp_epoch": "1723680984.950762000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 214, "udp_stream": null, "fields": {} }, { "event_id": "evt-ff577edc4e4c689e2af7ace4", "kind": "directory_service", "frame_number": 13724, "timestamp_epoch": "1723680984.951060000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 214, "udp_stream": null, "fields": {} }, { "event_id": "evt-c9290e10a4853970cce0e44f", "kind": "directory_service", "frame_number": 13725, "timestamp_epoch": "1723680984.951327000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 214, "udp_stream": null, "fields": {} }, { "event_id": "evt-35c012a52fe20e870978bd39", "kind": "directory_service", "frame_number": 13726, "timestamp_epoch": "1723680984.951531000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 214, "udp_stream": null, "fields": {} }, { "event_id": "evt-fbb881bb963f1a24e9d4844c", "kind": "directory_service", "frame_number": 13730, "timestamp_epoch": "1723680984.951799000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 213, "udp_stream": null, "fields": {} }, { "event_id": "evt-80e5775cc99ce043b8c8fa21", "kind": "directory_service", "frame_number": 13766, "timestamp_epoch": "1723680987.861060000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 217, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-4ccd59ce48b9c3c958a30a8e", "kind": "directory_service", "frame_number": 13767, "timestamp_epoch": "1723680987.861338000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 217, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-c7500ff3f9eed640112f61e3", "kind": "directory_service", "frame_number": 13768, "timestamp_epoch": "1723680987.861627000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 217, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-237b836980555e3c1e01b191", "kind": "directory_service", "frame_number": 13769, "timestamp_epoch": "1723680987.862048000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 217, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-2761423e495a564983eb0a15", "kind": "directory_service", "frame_number": 13770, "timestamp_epoch": "1723680987.862317000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 217, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-701655f10d48a8fc338e0b33", "kind": "directory_service", "frame_number": 13771, "timestamp_epoch": "1723680987.862579000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 217, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-58bbe58e2bf4c17b82604631", "kind": "directory_service", "frame_number": 13774, "timestamp_epoch": "1723680987.864133000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 217, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-dcbf4aa4a85a2318e24b3b56", "kind": "directory_service", "frame_number": 13775, "timestamp_epoch": "1723680987.864410000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 217, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-043d304f690c47a552fa2cd2", "kind": "directory_service", "frame_number": 13776, "timestamp_epoch": "1723680987.864658000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 217, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-68cac10c0e8464c51183f7f5", "kind": "directory_service", "frame_number": 13777, "timestamp_epoch": "1723680987.864959000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 217, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-caa411d1cb41af24eebba4f1", "kind": "directory_service", "frame_number": 13778, "timestamp_epoch": "1723680987.865145000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 217, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-6dfd2fa73cbf56ceacec1542", "kind": "directory_service", "frame_number": 13779, "timestamp_epoch": "1723680987.865321000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 217, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-a065ed07b2a6f279bc101c3c", "kind": "directory_service", "frame_number": 13783, "timestamp_epoch": "1723680987.867460000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 218, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-67bc2295cf2a86e093060b78", "kind": "directory_service", "frame_number": 13785, "timestamp_epoch": "1723680987.867807000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 218, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-416d68d63d6a94bb46fba194", "kind": "directory_service", "frame_number": 13788, "timestamp_epoch": "1723680987.868608000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 218, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-507b9bdc674f2ea8ad6947cb", "kind": "directory_service", "frame_number": 13790, "timestamp_epoch": "1723680987.869256000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 218, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-0cf5a60221d97224e7127e87", "kind": "directory_service", "frame_number": 13791, "timestamp_epoch": "1723680987.869654000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 218, "udp_stream": null, "fields": {} }, { "event_id": "evt-81261b5b741b26268e01fcfe", "kind": "directory_service", "frame_number": 13792, "timestamp_epoch": "1723680987.869912000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 218, "udp_stream": null, "fields": {} }, { "event_id": "evt-83e81f83a88f1e9aa521ba15", "kind": "directory_service", "frame_number": 13793, "timestamp_epoch": "1723680987.870105000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 218, "udp_stream": null, "fields": {} }, { "event_id": "evt-9fbc49c4f403e192a468a03a", "kind": "directory_service", "frame_number": 13794, "timestamp_epoch": "1723680987.870334000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 218, "udp_stream": null, "fields": {} }, { "event_id": "evt-595a4b1ecfa83ed28e12ba02", "kind": "directory_service", "frame_number": 13795, "timestamp_epoch": "1723680987.870612000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 218, "udp_stream": null, "fields": {} }, { "event_id": "evt-11f1ec6dacf2b9f62b524c1b", "kind": "directory_service", "frame_number": 13796, "timestamp_epoch": "1723680987.870831000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 218, "udp_stream": null, "fields": {} }, { "event_id": "evt-ffa2f4f6c6a81a789ffd5c18", "kind": "directory_service", "frame_number": 13801, "timestamp_epoch": "1723680987.873924000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 219, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-65fb777f2ab23485c488b06c", "kind": "directory_service", "frame_number": 13803, "timestamp_epoch": "1723680987.874664000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 219, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-fd3b0eb9d009ac94e36312c9", "kind": "directory_service", "frame_number": 13804, "timestamp_epoch": "1723680987.875069000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 219, "udp_stream": null, "fields": {} }, { "event_id": "evt-8d45ad42cff1d937cbbd076f", "kind": "directory_service", "frame_number": 13807, "timestamp_epoch": "1723680987.875277000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 219, "udp_stream": null, "fields": {} }, { "event_id": "evt-dadf1d0a0e24b55871dfd15b", "kind": "directory_service", "frame_number": 13809, "timestamp_epoch": "1723680987.875643000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 219, "udp_stream": null, "fields": {} }, { "event_id": "evt-98bb6f379b630c18fb332ec1", "kind": "directory_service", "frame_number": 13810, "timestamp_epoch": "1723680987.876160000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 219, "udp_stream": null, "fields": {} }, { "event_id": "evt-cfb3b8f75d612b81a55b451c", "kind": "directory_service", "frame_number": 13811, "timestamp_epoch": "1723680987.876525000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 219, "udp_stream": null, "fields": {} }, { "event_id": "evt-fe79b11df3079fe1ddb1dd7a", "kind": "directory_service", "frame_number": 13815, "timestamp_epoch": "1723680987.877521000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 218, "udp_stream": null, "fields": {} }, { "event_id": "evt-e7121af5552926266fd9aa79", "kind": "directory_service", "frame_number": 15960, "timestamp_epoch": "1723681540.375207000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 345, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-e9d49723e28d4df14c545a13", "kind": "directory_service", "frame_number": 15962, "timestamp_epoch": "1723681540.375669000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 345, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-27f1d3abc79dc1977efd6054", "kind": "directory_service", "frame_number": 15965, "timestamp_epoch": "1723681540.377502000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 345, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-31092f5f1e18b272f1807894", "kind": "directory_service", "frame_number": 15967, "timestamp_epoch": "1723681540.378380000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 345, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-583992efc14f74bfc850bd6a", "kind": "directory_service", "frame_number": 15968, "timestamp_epoch": "1723681540.380048000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 345, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Pierce Lucero,CN=Users,DC=lafontainebleu,DC=org", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-ac4466d3e3d43764f3b2961f", "kind": "directory_service", "frame_number": 15969, "timestamp_epoch": "1723681540.380433000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 345, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-97f9e0b5868e4080d9452427", "kind": "directory_service", "frame_number": 15970, "timestamp_epoch": "1723681540.380907000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 345, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-d5e463f545497d52176e8e30", "kind": "directory_service", "frame_number": 15978, "timestamp_epoch": "1723681540.394297000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 346, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-b8063190c48d1a81e065aaa8", "kind": "directory_service", "frame_number": 15980, "timestamp_epoch": "1723681540.395140000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 346, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-79167e66f46db6024d198aaa", "kind": "directory_service", "frame_number": 15981, "timestamp_epoch": "1723681540.395548000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 346, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Pierce Lucero,CN=Users,DC=lafontainebleu,DC=org", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-8085e6082a98e4672e51589d", "kind": "directory_service", "frame_number": 15982, "timestamp_epoch": "1723681540.395838000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": null, "dst_port": null, "tcp_stream": 346, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-f885242b996b3bcf006f67d3", "kind": "directory_service", "frame_number": 15983, "timestamp_epoch": "1723681540.397052000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": null, "dst_port": null, "tcp_stream": 346, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } } ], "unclassified_tcp": [ { "event_id": "evt-fa1f2cc7f71dbff12b15a143", "kind": "unclassified_tcp", "frame_number": 6086, "timestamp_epoch": "1723680652.203224000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49670, "dst_port": 445, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-798d48121a4959b553c4a5fa", "kind": "unclassified_tcp", "frame_number": 6205, "timestamp_epoch": "1723680655.653715000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49725, "dst_port": 445, "tcp_stream": 52, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-5fa1f079ea2d2e0b0bb2edf0", "kind": "unclassified_tcp", "frame_number": 9000, "timestamp_epoch": "1723680682.216975000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49670, "dst_port": 445, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-65f4cfa241c04ced99700430", "kind": "unclassified_tcp", "frame_number": 10277, "timestamp_epoch": "1723680701.378299000", "src_ip": "10.8.15.133", "dst_ip": "20.42.72.131", "src_port": 49782, "dst_port": 443, "tcp_stream": 109, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-937aabf54e2a428cbdaf4eb8", "kind": "unclassified_tcp", "frame_number": 10400, "timestamp_epoch": "1723680708.269615000", "src_ip": "10.8.15.133", "dst_ip": "20.25.227.174", "src_port": 49784, "dst_port": 443, "tcp_stream": 111, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1949bdd1de52894e0eb01789", "kind": "unclassified_tcp", "frame_number": 10437, "timestamp_epoch": "1723680709.083865000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-da32a2c1f772e46c4634695b", "kind": "unclassified_tcp", "frame_number": 10480, "timestamp_epoch": "1723680710.334576000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 49783, "dst_port": 443, "tcp_stream": 110, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-93a3567524d9f092bd7443fc", "kind": "unclassified_tcp", "frame_number": 10481, "timestamp_epoch": "1723680710.927613000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49725, "dst_port": 445, "tcp_stream": 52, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-b78b27393dca0bf7064f1215", "kind": "unclassified_tcp", "frame_number": 10581, "timestamp_epoch": "1723680712.227034000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49670, "dst_port": 445, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-57637ad2fb42cf2fcb9144c8", "kind": "unclassified_tcp", "frame_number": 10584, "timestamp_epoch": "1723680713.765852000", "src_ip": "10.8.15.133", "dst_ip": "104.40.82.182", "src_port": 49787, "dst_port": 443, "tcp_stream": 114, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-040cfe793c871989e1e944c3", "kind": "unclassified_tcp", "frame_number": 10868, "timestamp_epoch": "1723680726.519561000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-0004e08eba72af205f9cfc31", "kind": "unclassified_tcp", "frame_number": 10874, "timestamp_epoch": "1723680726.941674000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.239", "src_port": 49793, "dst_port": 443, "tcp_stream": 120, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a944c843ef718bf7fac8d293", "kind": "unclassified_tcp", "frame_number": 10891, "timestamp_epoch": "1723680740.941617000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49725, "dst_port": 445, "tcp_stream": 52, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-866af40f7532bccef82cf4d1", "kind": "unclassified_tcp", "frame_number": 10894, "timestamp_epoch": "1723680742.243265000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 445, "dst_port": 49670, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ebe5dd0677d024ee4ea52892", "kind": "unclassified_tcp", "frame_number": 10896, "timestamp_epoch": "1723680742.244018000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49670, "dst_port": 445, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-48ae7d4731c7c52e2a654e32", "kind": "unclassified_tcp", "frame_number": 10902, "timestamp_epoch": "1723680746.379332000", "src_ip": "10.8.15.133", "dst_ip": "20.42.72.131", "src_port": 49782, "dst_port": 443, "tcp_stream": 109, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-7a46691d661bb3998241b449", "kind": "unclassified_tcp", "frame_number": 10932, "timestamp_epoch": "1723680753.270064000", "src_ip": "10.8.15.133", "dst_ip": "20.25.227.174", "src_port": 49784, "dst_port": 443, "tcp_stream": 111, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-994d8ec3bacf41e4d4f48f63", "kind": "unclassified_tcp", "frame_number": 10979, "timestamp_epoch": "1723680754.112356000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ed8634c9defb96bc68ac0e96", "kind": "unclassified_tcp", "frame_number": 11009, "timestamp_epoch": "1723680755.348733000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.203", "src_port": 49783, "dst_port": 443, "tcp_stream": 110, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1590599092ed911a402d05f3", "kind": "unclassified_tcp", "frame_number": 11011, "timestamp_epoch": "1723680758.771971000", "src_ip": "10.8.15.133", "dst_ip": "104.40.82.182", "src_port": 49787, "dst_port": 443, "tcp_stream": 114, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-f27c0df692c8c5a2da085197", "kind": "unclassified_tcp", "frame_number": 11013, "timestamp_epoch": "1723680759.646618000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.239", "src_port": 49794, "dst_port": 443, "tcp_stream": 121, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-3525f367a6ea85f8ff15c3a8", "kind": "unclassified_tcp", "frame_number": 11016, "timestamp_epoch": "1723680771.535578000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e2acd768347fe01bcc8522ce", "kind": "unclassified_tcp", "frame_number": 11018, "timestamp_epoch": "1723680771.943937000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.239", "src_port": 49793, "dst_port": 443, "tcp_stream": 120, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-b184946cfcd0807ad8cd3b82", "kind": "unclassified_tcp", "frame_number": 11020, "timestamp_epoch": "1723680772.254472000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49670, "dst_port": 445, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-3c9411385955b67cfc317e48", "kind": "unclassified_tcp", "frame_number": 11765, "timestamp_epoch": "1723680798.271597000", "src_ip": "10.8.15.133", "dst_ip": "20.25.227.174", "src_port": 49784, "dst_port": 443, "tcp_stream": 111, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8b81950c653bd6a352d27b46", "kind": "unclassified_tcp", "frame_number": 11838, "timestamp_epoch": "1723680799.115654000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-9ae316a8f859aab9486bdc77", "kind": "unclassified_tcp", "frame_number": 11868, "timestamp_epoch": "1723680800.961468000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 445, "dst_port": 49725, "tcp_stream": 52, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-7af713c24aba5b867dcd21ff", "kind": "unclassified_tcp", "frame_number": 11897, "timestamp_epoch": "1723680802.256112000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49670, "dst_port": 445, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4b65035259b92a9212151be8", "kind": "unclassified_tcp", "frame_number": 11957, "timestamp_epoch": "1723680803.787398000", "src_ip": "10.8.15.133", "dst_ip": "104.40.82.182", "src_port": 49787, "dst_port": 443, "tcp_stream": 114, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-318c5d96b1807c7ebb5fce4c", "kind": "unclassified_tcp", "frame_number": 11968, "timestamp_epoch": "1723680804.662241000", "src_ip": "10.8.15.133", "dst_ip": "204.79.197.239", "src_port": 49794, "dst_port": 443, "tcp_stream": 121, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-25a567cf0075f3f7e118c1be", "kind": "unclassified_tcp", "frame_number": 11988, "timestamp_epoch": "1723680816.551245000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-02861cc2c24e8a5dc7972d87", "kind": "unclassified_tcp", "frame_number": 12027, "timestamp_epoch": "1723680832.270753000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49670, "dst_port": 445, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-029091f91164b3ddf52452a2", "kind": "unclassified_tcp", "frame_number": 12066, "timestamp_epoch": "1723680844.130280000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-b2e32dac78fc0d40dc2d88b1", "kind": "unclassified_tcp", "frame_number": 12078, "timestamp_epoch": "1723680848.802258000", "src_ip": "10.8.15.133", "dst_ip": "104.40.82.182", "src_port": 49787, "dst_port": 443, "tcp_stream": 114, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4449437f01d42be914ff579d", "kind": "unclassified_tcp", "frame_number": 12135, "timestamp_epoch": "1723680861.567997000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-51be40ebaa64524f9487ef37", "kind": "unclassified_tcp", "frame_number": 12143, "timestamp_epoch": "1723680862.260157000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 445, "dst_port": 49670, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-27388c4dd486b050e1cfc886", "kind": "unclassified_tcp", "frame_number": 12145, "timestamp_epoch": "1723680862.302390000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49670, "dst_port": 445, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-6fd94aa293e949cf8b588b47", "kind": "unclassified_tcp", "frame_number": 12160, "timestamp_epoch": "1723680871.349319000", "src_ip": "10.8.15.133", "dst_ip": "20.10.31.115", "src_port": 49731, "dst_port": 443, "tcp_stream": 58, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-378e1ed71e4e9d663ee06360", "kind": "unclassified_tcp", "frame_number": 12170, "timestamp_epoch": "1723680874.349420000", "src_ip": "10.8.15.133", "dst_ip": "20.10.31.115", "src_port": 49731, "dst_port": 443, "tcp_stream": 58, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-5593d803113e3805a382d022", "kind": "unclassified_tcp", "frame_number": 12192, "timestamp_epoch": "1723680889.160908000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-0c76c79e216129a9118f5d4f", "kind": "unclassified_tcp", "frame_number": 12194, "timestamp_epoch": "1723680892.318329000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49670, "dst_port": 445, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a59d72cfe47b3efc67f7dfde", "kind": "unclassified_tcp", "frame_number": 12248, "timestamp_epoch": "1723680906.583962000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-080653b2c14e810fc8180f07", "kind": "unclassified_tcp", "frame_number": 13585, "timestamp_epoch": "1723680916.728609000", "src_ip": "10.8.15.133", "dst_ip": "20.10.31.115", "src_port": 49792, "dst_port": 443, "tcp_stream": 119, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-820eb1ac3eb1c978e35b6c88", "kind": "unclassified_tcp", "frame_number": 13599, "timestamp_epoch": "1723680919.730331000", "src_ip": "10.8.15.133", "dst_ip": "20.10.31.115", "src_port": 49792, "dst_port": 443, "tcp_stream": 119, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4340976074abcd0651b0d23c", "kind": "unclassified_tcp", "frame_number": 13601, "timestamp_epoch": "1723680920.979389000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 445, "dst_port": 49725, "tcp_stream": 52, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-afc46034d840dba8d451a388", "kind": "unclassified_tcp", "frame_number": 13603, "timestamp_epoch": "1723680922.337809000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49670, "dst_port": 445, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a75578d47443e95ef9b371cb", "kind": "unclassified_tcp", "frame_number": 13613, "timestamp_epoch": "1723680934.167022000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1700e343232a1e7d34b99842", "kind": "unclassified_tcp", "frame_number": 13617, "timestamp_epoch": "1723680941.074234000", "src_ip": "10.8.15.133", "dst_ip": "13.107.21.239", "src_port": 49858, "dst_port": 443, "tcp_stream": 182, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-b7ac287eb74d561aac34aafb", "kind": "unclassified_tcp", "frame_number": 13618, "timestamp_epoch": "1723680951.604756000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-f107d88ed2f3b3b135d74911", "kind": "unclassified_tcp", "frame_number": 13620, "timestamp_epoch": "1723680952.339069000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49670, "dst_port": 445, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-37678318e635c0c36d74a6cd", "kind": "unclassified_tcp", "frame_number": 13642, "timestamp_epoch": "1723680979.168463000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-c55d99d8a165b963b1c7ad9e", "kind": "unclassified_tcp", "frame_number": 13649, "timestamp_epoch": "1723680982.277035000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 445, "dst_port": 49670, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-21a134da52b123f22d1a8c24", "kind": "unclassified_tcp", "frame_number": 13651, "timestamp_epoch": "1723680982.355014000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49670, "dst_port": 445, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-394703d35cf367454811e4e9", "kind": "unclassified_tcp", "frame_number": 13734, "timestamp_epoch": "1723680986.074460000", "src_ip": "10.8.15.133", "dst_ip": "13.107.21.239", "src_port": 49858, "dst_port": 443, "tcp_stream": 182, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-b0afc1620795df77c86533cf", "kind": "unclassified_tcp", "frame_number": 14078, "timestamp_epoch": "1723680996.616753000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8de4c77eddd0e2107fe1e773", "kind": "unclassified_tcp", "frame_number": 14173, "timestamp_epoch": "1723681012.382563000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49670, "dst_port": 445, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-bf9e0e8fe2f0c091e2169846", "kind": "unclassified_tcp", "frame_number": 14196, "timestamp_epoch": "1723681024.195203000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-2f6904790f4bfe689b1df143", "kind": "unclassified_tcp", "frame_number": 14245, "timestamp_epoch": "1723681040.980845000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 445, "dst_port": 49725, "tcp_stream": 52, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-bc0312708f0b699a51f21ee5", "kind": "unclassified_tcp", "frame_number": 14247, "timestamp_epoch": "1723681041.633181000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1b3260edf966c24943cfad0a", "kind": "unclassified_tcp", "frame_number": 14249, "timestamp_epoch": "1723681042.414184000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49670, "dst_port": 445, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-9a8a8348ce483f12d9b767f5", "kind": "unclassified_tcp", "frame_number": 14296, "timestamp_epoch": "1723681069.211339000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-c6d779503706e627424af8eb", "kind": "unclassified_tcp", "frame_number": 14307, "timestamp_epoch": "1723681072.445748000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49670, "dst_port": 445, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1667e7470f6e6a5b7595917f", "kind": "unclassified_tcp", "frame_number": 14330, "timestamp_epoch": "1723681086.664673000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-79110ef7c85974f882970a5b", "kind": "unclassified_tcp", "frame_number": 14366, "timestamp_epoch": "1723681102.293937000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 445, "dst_port": 49670, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-9c96fc88c53d2236a3eeea6e", "kind": "unclassified_tcp", "frame_number": 14368, "timestamp_epoch": "1723681102.476389000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49670, "dst_port": 445, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-36e72454c20a112e4df3f181", "kind": "unclassified_tcp", "frame_number": 14401, "timestamp_epoch": "1723681114.243031000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ce280c3d4091e178c6a55095", "kind": "unclassified_tcp", "frame_number": 14430, "timestamp_epoch": "1723681131.665933000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-3d04b82b6402616ff6076404", "kind": "unclassified_tcp", "frame_number": 14432, "timestamp_epoch": "1723681132.493148000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49670, "dst_port": 445, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-c4a7df6ccc10eeacd976a804", "kind": "unclassified_tcp", "frame_number": 14670, "timestamp_epoch": "1723681159.259070000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-19d6644e8fa07e85cefe7133", "kind": "unclassified_tcp", "frame_number": 14681, "timestamp_epoch": "1723681160.997073000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 445, "dst_port": 49725, "tcp_stream": 52, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-bc938b8eb291183c84eae109", "kind": "unclassified_tcp", "frame_number": 14683, "timestamp_epoch": "1723681162.509341000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49670, "dst_port": 445, "tcp_stream": 1, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-c4f5d9ef5bcec1ba5766f92f", "kind": "unclassified_tcp", "frame_number": 14685, "timestamp_epoch": "1723681164.743726000", "src_ip": "10.8.15.133", "dst_ip": "20.10.31.115", "src_port": 49792, "dst_port": 443, "tcp_stream": 119, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-caa1f26394a1cfa24d470f8a", "kind": "unclassified_tcp", "frame_number": 14713, "timestamp_epoch": "1723681176.681388000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8147c9b8f2c0d82cf63323bd", "kind": "unclassified_tcp", "frame_number": 14843, "timestamp_epoch": "1723681204.275283000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-45c0d5f82f462e314df8b9aa", "kind": "unclassified_tcp", "frame_number": 14957, "timestamp_epoch": "1723681214.618653000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49725, "dst_port": 445, "tcp_stream": 52, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-0cddf957f73142ce07a8c3a3", "kind": "unclassified_tcp", "frame_number": 14985, "timestamp_epoch": "1723681226.620091000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a817189b287a0eb160ee5f59", "kind": "unclassified_tcp", "frame_number": 14995, "timestamp_epoch": "1723681232.885569000", "src_ip": "10.8.15.133", "dst_ip": "20.10.31.115", "src_port": 49731, "dst_port": 443, "tcp_stream": 58, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a3a8595f31840c2a2deaa47b", "kind": "unclassified_tcp", "frame_number": 15005, "timestamp_epoch": "1723681235.885600000", "src_ip": "10.8.15.133", "dst_ip": "20.10.31.115", "src_port": 49731, "dst_port": 443, "tcp_stream": 58, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-b23b94d2c589b56788674dbb", "kind": "unclassified_tcp", "frame_number": 15017, "timestamp_epoch": "1723681244.621018000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49725, "dst_port": 445, "tcp_stream": 52, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-c979d04af9afc9668f7fbfe5", "kind": "unclassified_tcp", "frame_number": 15033, "timestamp_epoch": "1723681249.300120000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-2ffbb88c696520c1aa9c228d", "kind": "unclassified_tcp", "frame_number": 15084, "timestamp_epoch": "1723681271.663261000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-2f8e163b22899b51d5fe5580", "kind": "unclassified_tcp", "frame_number": 15202, "timestamp_epoch": "1723681294.350800000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e3ca57d03881891b457ee261", "kind": "unclassified_tcp", "frame_number": 15245, "timestamp_epoch": "1723681304.704478000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 445, "dst_port": 49725, "tcp_stream": 52, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8326745c22cf5243fad71099", "kind": "unclassified_tcp", "frame_number": 15305, "timestamp_epoch": "1723681316.683265000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e5521f2a04d1c7ae32e31f02", "kind": "unclassified_tcp", "frame_number": 15384, "timestamp_epoch": "1723681339.363699000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-055fbe1be7c87a73bcd0774c", "kind": "unclassified_tcp", "frame_number": 15429, "timestamp_epoch": "1723681361.692115000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-65004dd894b77f748c684d17", "kind": "unclassified_tcp", "frame_number": 15499, "timestamp_epoch": "1723681384.367754000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-69aa3230e0c9ba06dc60f24d", "kind": "unclassified_tcp", "frame_number": 15542, "timestamp_epoch": "1723681406.696665000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8527b5c9f5870a36704b0c2c", "kind": "unclassified_tcp", "frame_number": 15544, "timestamp_epoch": "1723681409.790070000", "src_ip": "10.8.15.133", "dst_ip": "20.10.31.115", "src_port": 49792, "dst_port": 443, "tcp_stream": 119, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-c015a88704a6ce3fea408b1d", "kind": "unclassified_tcp", "frame_number": 15575, "timestamp_epoch": "1723681424.709003000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 445, "dst_port": 49725, "tcp_stream": 52, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-c25516acf9b27ca2a1004af5", "kind": "unclassified_tcp", "frame_number": 15586, "timestamp_epoch": "1723681429.384369000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-bb35fac6b988efc72743b8bc", "kind": "unclassified_tcp", "frame_number": 15634, "timestamp_epoch": "1723681451.710375000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a9af4f91c1e8349eb2ed408b", "kind": "unclassified_tcp", "frame_number": 15678, "timestamp_epoch": "1723681474.398267000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8775bdc420eca90ca55bf2f1", "kind": "unclassified_tcp", "frame_number": 15682, "timestamp_epoch": "1723681480.931680000", "src_ip": "10.8.15.133", "dst_ip": "20.10.31.115", "src_port": 49731, "dst_port": 443, "tcp_stream": 58, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-6da0dafc1b3e114df9336c7e", "kind": "unclassified_tcp", "frame_number": 15733, "timestamp_epoch": "1723681496.726940000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-23b9d63145219522748314e8", "kind": "unclassified_tcp", "frame_number": 15901, "timestamp_epoch": "1723681519.414472000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-be426d77529d6222f1fd75e4", "kind": "unclassified_tcp", "frame_number": 16018, "timestamp_epoch": "1723681541.729145000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e4076a165d9b17c318d42a04", "kind": "unclassified_tcp", "frame_number": 16029, "timestamp_epoch": "1723681544.741377000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 445, "dst_port": 49725, "tcp_stream": 52, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-d867c86bf0efa67c0d6a8875", "kind": "unclassified_tcp", "frame_number": 16071, "timestamp_epoch": "1723681564.431040000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-5497300f46d834d227d416f6", "kind": "unclassified_tcp", "frame_number": 16111, "timestamp_epoch": "1723681586.744036000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a700194ec9a0513dd35aa9cf", "kind": "unclassified_tcp", "frame_number": 16149, "timestamp_epoch": "1723681609.446979000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-0208c79fa8448949213ec608", "kind": "unclassified_tcp", "frame_number": 16186, "timestamp_epoch": "1723681631.746703000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-044229f8637a61ebf896ebb5", "kind": "unclassified_tcp", "frame_number": 16237, "timestamp_epoch": "1723681654.449726000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ab5482cef2d12881f00e823b", "kind": "unclassified_tcp", "frame_number": 16239, "timestamp_epoch": "1723681654.809929000", "src_ip": "10.8.15.133", "dst_ip": "20.10.31.115", "src_port": 49792, "dst_port": 443, "tcp_stream": 119, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-0ddab410827cc261e4488299", "kind": "unclassified_tcp", "frame_number": 16256, "timestamp_epoch": "1723681664.745218000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 445, "dst_port": 49725, "tcp_stream": 52, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-95a72fede6cfb02a59b4b7f9", "kind": "unclassified_tcp", "frame_number": 16328, "timestamp_epoch": "1723681676.761433000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-d051815b958e46a9352761a5", "kind": "unclassified_tcp", "frame_number": 16377, "timestamp_epoch": "1723681699.465201000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-80590c7808f8556315e86010", "kind": "unclassified_tcp", "frame_number": 16412, "timestamp_epoch": "1723681721.763600000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4c63e282ac1a27244c5f3613", "kind": "unclassified_tcp", "frame_number": 16442, "timestamp_epoch": "1723681744.481495000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-85ed4d40c73dcc23e34bc059", "kind": "unclassified_tcp", "frame_number": 16480, "timestamp_epoch": "1723681766.778673000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-eab08a874befe5654efda00b", "kind": "unclassified_tcp", "frame_number": 16509, "timestamp_epoch": "1723681784.763025000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 445, "dst_port": 49725, "tcp_stream": 52, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-db924a0e594629fa876c9dfe", "kind": "unclassified_tcp", "frame_number": 16523, "timestamp_epoch": "1723681789.497856000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-09dd6fb01da40e265d9a1c9f", "kind": "unclassified_tcp", "frame_number": 16545, "timestamp_epoch": "1723681796.685673000", "src_ip": "10.8.15.133", "dst_ip": "20.10.31.115", "src_port": 49731, "dst_port": 443, "tcp_stream": 58, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-6a6efa35f0d52ad01afbc3a0", "kind": "unclassified_tcp", "frame_number": 16555, "timestamp_epoch": "1723681799.686163000", "src_ip": "10.8.15.133", "dst_ip": "20.10.31.115", "src_port": 49731, "dst_port": 443, "tcp_stream": 58, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-c76046fd6b0ce6481f5896a3", "kind": "unclassified_tcp", "frame_number": 16606, "timestamp_epoch": "1723681811.804875000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8ec68f00c032d8961f78add9", "kind": "unclassified_tcp", "frame_number": 16619, "timestamp_epoch": "1723681815.023842000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49725, "dst_port": 445, "tcp_stream": 52, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-0b567463ea87fff5da2a59ef", "kind": "unclassified_tcp", "frame_number": 16655, "timestamp_epoch": "1723681834.507937000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a3eca75839f4ec12f2806293", "kind": "unclassified_tcp", "frame_number": 16675, "timestamp_epoch": "1723681845.053557000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49725, "dst_port": 445, "tcp_stream": 52, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ea38e68531b0c94659cf3b8b", "kind": "unclassified_tcp", "frame_number": 16698, "timestamp_epoch": "1723681856.808323000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-80bf79fdfdbbb564aa151f73", "kind": "unclassified_tcp", "frame_number": 16732, "timestamp_epoch": "1723681879.524922000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-f384b846170ba40782de17b2", "kind": "unclassified_tcp", "frame_number": 16764, "timestamp_epoch": "1723681899.822217000", "src_ip": "10.8.15.133", "dst_ip": "20.10.31.115", "src_port": 49792, "dst_port": 443, "tcp_stream": 119, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-88c27979b742a3cf25a2b13d", "kind": "unclassified_tcp", "frame_number": 16766, "timestamp_epoch": "1723681901.822335000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-f31f54e97dfdc9f6815b9517", "kind": "unclassified_tcp", "frame_number": 16777, "timestamp_epoch": "1723681905.078216000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 445, "dst_port": 49725, "tcp_stream": 52, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-882705351d739bc7a4bde122", "kind": "unclassified_tcp", "frame_number": 16847, "timestamp_epoch": "1723681924.541388000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-cb7bfb7109c41057912cf48b", "kind": "unclassified_tcp", "frame_number": 16897, "timestamp_epoch": "1723681946.837514000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-784fcaf57445423b89f197b3", "kind": "unclassified_tcp", "frame_number": 16938, "timestamp_epoch": "1723681969.542254000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-7e3715f07a49471222288244", "kind": "unclassified_tcp", "frame_number": 16983, "timestamp_epoch": "1723681991.842083000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-255483ec4b2efb4ffcdd4e1e", "kind": "unclassified_tcp", "frame_number": 17029, "timestamp_epoch": "1723682014.558735000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-fab4b7b3cf8d629c501104be", "kind": "unclassified_tcp", "frame_number": 17040, "timestamp_epoch": "1723682025.096090000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 445, "dst_port": 49725, "tcp_stream": 52, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-c43df46c79b057abe27c026a", "kind": "unclassified_tcp", "frame_number": 17063, "timestamp_epoch": "1723682036.869680000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-b7f7962c59db8280a65d3069", "kind": "unclassified_tcp", "frame_number": 17076, "timestamp_epoch": "1723682044.701072000", "src_ip": "10.8.15.133", "dst_ip": "20.10.31.115", "src_port": 49731, "dst_port": 443, "tcp_stream": 58, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-6066120d8fa05db1db6c22a3", "kind": "unclassified_tcp", "frame_number": 17107, "timestamp_epoch": "1723682059.573429000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-aebcd64318e96a6d86dac745", "kind": "unclassified_tcp", "frame_number": 17180, "timestamp_epoch": "1723682081.888141000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4e33e7951914e5955d0c313e", "kind": "unclassified_tcp", "frame_number": 17220, "timestamp_epoch": "1723682104.590955000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-f9c17cdf4f1aa5523fb5cdb8", "kind": "unclassified_tcp", "frame_number": 17260, "timestamp_epoch": "1723682126.902740000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-77e1ca017e8a5044510fcf0e", "kind": "unclassified_tcp", "frame_number": 17303, "timestamp_epoch": "1723682145.112205000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 445, "dst_port": 49725, "tcp_stream": 52, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-5f1b6f43843f48ff3f8e90a6", "kind": "unclassified_tcp", "frame_number": 17323, "timestamp_epoch": "1723682149.593999000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-70b5ffc8ef0ceca964d2170d", "kind": "unclassified_tcp", "frame_number": 17354, "timestamp_epoch": "1723682171.905244000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-9390dd75fbe20d6b32a74717", "kind": "unclassified_tcp", "frame_number": 17400, "timestamp_epoch": "1723682194.609082000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4082105c1430ffd820fbd7fa", "kind": "unclassified_tcp", "frame_number": 17440, "timestamp_epoch": "1723682216.922457000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-c7a0d16dd84583fbf0d84fc7", "kind": "unclassified_tcp", "frame_number": 17478, "timestamp_epoch": "1723682239.641493000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-3c09288151a7dba2cd5142c5", "kind": "unclassified_tcp", "frame_number": 17525, "timestamp_epoch": "1723682261.937070000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ce721cbcd3d24b3b82f4d768", "kind": "unclassified_tcp", "frame_number": 17527, "timestamp_epoch": "1723682265.116301000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 445, "dst_port": 49725, "tcp_stream": 52, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-bfb740c9634e1e317adbc7a5", "kind": "unclassified_tcp", "frame_number": 17568, "timestamp_epoch": "1723682284.657980000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-663f817c333408149f986f68", "kind": "unclassified_tcp", "frame_number": 17579, "timestamp_epoch": "1723682289.720636000", "src_ip": "10.8.15.133", "dst_ip": "20.10.31.115", "src_port": 49731, "dst_port": 443, "tcp_stream": 58, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-681f7b6a02aa2c30a563fa0d", "kind": "unclassified_tcp", "frame_number": 17601, "timestamp_epoch": "1723682299.736420000", "src_ip": "10.8.15.133", "dst_ip": "20.10.31.115", "src_port": 49792, "dst_port": 443, "tcp_stream": 119, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e37b5d1a2c6d9df9d33338a5", "kind": "unclassified_tcp", "frame_number": 17605, "timestamp_epoch": "1723682302.751743000", "src_ip": "10.8.15.133", "dst_ip": "20.10.31.115", "src_port": 49792, "dst_port": 443, "tcp_stream": 119, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-018a0e3264f8ba7b7cc931f7", "kind": "unclassified_tcp", "frame_number": 17616, "timestamp_epoch": "1723682306.955249000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-63815af6e2d99accad39bf41", "kind": "unclassified_tcp", "frame_number": 17655, "timestamp_epoch": "1723682329.689129000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4469923392ecefcd9666dcbb", "kind": "unclassified_tcp", "frame_number": 17693, "timestamp_epoch": "1723682351.970706000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8f2b374ee5dbabd86f236f28", "kind": "unclassified_tcp", "frame_number": 17731, "timestamp_epoch": "1723682374.705584000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-83d4a941592b0da01c52e148", "kind": "unclassified_tcp", "frame_number": 17759, "timestamp_epoch": "1723682385.133388000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 445, "dst_port": 49725, "tcp_stream": 52, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-05f74e9e9ffc4ef036905983", "kind": "unclassified_tcp", "frame_number": 17840, "timestamp_epoch": "1723682396.972609000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e65df6984f49d03a40f2fec2", "kind": "unclassified_tcp", "frame_number": 17905, "timestamp_epoch": "1723682415.410457000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49725, "dst_port": 445, "tcp_stream": 52, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-34d532f731557fb1ff14f648", "kind": "unclassified_tcp", "frame_number": 17910, "timestamp_epoch": "1723682419.707238000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-3bab304ca2dbc53cdb646a62", "kind": "unclassified_tcp", "frame_number": 17950, "timestamp_epoch": "1723682441.989179000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1fd6bdfd097f4917dd285b4e", "kind": "unclassified_tcp", "frame_number": 17967, "timestamp_epoch": "1723682445.426809000", "src_ip": "10.8.15.133", "dst_ip": "10.8.15.4", "src_port": 49725, "dst_port": 445, "tcp_stream": 52, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1b028d3e1d0058ec9e506fae", "kind": "unclassified_tcp", "frame_number": 18023, "timestamp_epoch": "1723682464.722183000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8e3b55256d55bcb2ac0cac0c", "kind": "unclassified_tcp", "frame_number": 18062, "timestamp_epoch": "1723682487.019307000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-dcc4defbf76393807f35ad66", "kind": "unclassified_tcp", "frame_number": 18098, "timestamp_epoch": "1723682505.432461000", "src_ip": "10.8.15.4", "dst_ip": "10.8.15.133", "src_port": 445, "dst_port": 49725, "tcp_stream": 52, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e5ae39c3e4aa09cd0679654a", "kind": "unclassified_tcp", "frame_number": 18109, "timestamp_epoch": "1723682509.723740000", "src_ip": "10.8.15.133", "dst_ip": "104.21.55.70", "src_port": 49785, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-959642b86a62234070208a59", "kind": "unclassified_tcp", "frame_number": 18156, "timestamp_epoch": "1723682532.036518000", "src_ip": "10.8.15.133", "dst_ip": "23.215.55.139", "src_port": 49795, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tcp.payload": "00" } } ] }, "artifacts": [ { "artifact_id": "artifact-82693d03230b29d1a84e3e66", "type": "http-exported-object", "filename": "managements%3f16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215", "filenames": [ "managements%3f16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215" ], "occurrences": 1, "static_features": { "content_kind": "zip", "inspected_bytes": 262144, "inspection_truncated": true, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 2767804, "sha256": "798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-6a7013f40e98c8ac566dd3af", "type": "http-exported-object", "filename": "0f60a3e7baecf2748b1c8183ed37d1e4", "filenames": [ "0f60a3e7baecf2748b1c8183ed37d1e4" ], "occurrences": 1, "static_features": { "content_kind": "pe", "inspected_bytes": 159232, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 159232, "sha256": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-7dda5d6d20ead492a77e1269", "type": "http-exported-object", "filename": "%2f(3)", "filenames": [ "%2f(3)" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 262144, "inspection_truncated": true, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 305148, "sha256": "261daf6d8ef4a2ea145dbcd589a3808af3d734af40319248dbf81746bab0f594", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-4dfb6619d91e00def004f454", "type": "http-exported-object", "filename": "f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d(3)", "filenames": [ "f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d(3)" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 108543, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 108543, "sha256": "8fcd6135214262cc9ef17efb67055b2a1baa9036a22325d8679192683c025e47", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-bcfbe9fa1545669101eac2ec", "type": "http-exported-object", "filename": "f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d(2)", "filenames": [ "f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d(2)" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 29990, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 29990, "sha256": "6a42906135e357167d748aee9f36cb40bf5ba4584e85e7e1df4433ee8f38680c", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-8991c11376e0ba833b381a71", "type": "http-exported-object", "filename": "f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d", "filenames": [ "f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 18882, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 18882, "sha256": "f8313d5ec5090e37e52eef9455de8085810a8362db2e1226f3dc42f747651332", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-92eb79afacf5e470bf9e792d", "type": "http-exported-object", "filename": "f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d(1)", "filenames": [ "f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d(1)" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 13809, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 13809, "sha256": "be2882b8c36a2a65594e72f3cedb87b34523d2a8b13e23e902c4cd952a0a4252", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-bd2ce25940d789b12c4f79b2", "type": "http-exported-object", "filename": "8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d(3)", "filenames": [ "8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d(3)" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 7930, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 7930, "sha256": "9579dca191a7420bab906998ffd624709de7deda27481b53f6da693765f03499", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-a14e0ced8cfa4b619e58e9c0", "type": "http-exported-object", "filename": "8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d(2)", "filenames": [ "8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d(2)" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 4630, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 4630, "sha256": "41e87d5cfc89b6168dd794c2b32cdf83bff7fe164a603416d5d7d7e399109c9b", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-81d38c4bdd1064aa87f238e6", "type": "http-exported-object", "filename": "MFQwUjBQME4wTDAJBgUrDgMCGgUABBR2JNtr0JxEvYySpbyBWaqBmealCgQUzhUWO%2BoCo6Zr2tkr%2FeWMUr56UKgCEzMAPnPpacmgFoSqVQMAAAA%2Bc%2Bk%3D", "filenames": [ "MFQwUjBQME4wTDAJBgUrDgMCGgUABBR2JNtr0JxEvYySpbyBWaqBmealCgQUzhUWO%2BoCo6Zr2tkr%2FeWMUr56UKgCEzMAPnPpacmgFoSqVQMAAAA%2Bc%2Bk%3D" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 1782, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 1782, "sha256": "2ba81673f8cd827df283ad30f52bcaa0514fc065fef4398dafed3a0f612517f6", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-f418088b932533b9c4c671a5", "type": "http-exported-object", "filename": "8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d(1)", "filenames": [ "8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d(1)" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 1340, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 1340, "sha256": "0078330840159b7adc1ec144a36905642a0469d68c4879febf76dbda26ffd5b2", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-3f7eb057f5f252ca76a8f5c6", "type": "http-exported-object", "filename": "8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d", "filenames": [ "8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 1120, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 1120, "sha256": "c54e6bd06d5c09a075e274a55c6d3ce31a2fabebbea38ce7083a9ebb7034a110", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-415191c3d61d03eda7d9cf81", "type": "http-exported-object", "filename": "%2f(5)", "filenames": [ "%2f(5)" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 732, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 732, "sha256": "f300d3238190768cae396cbc02636955abc1d8d2a1d9cf2b27bbd1a4d691ea64", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-1bd046466e9506632d63e0e7", "type": "http-exported-object", "filename": "%2f(1)", "filenames": [ "%2f(1)" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 124, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 124, "sha256": "5e4b21db2742377a82d65f7553eb8d183f781a561ff60f9421baee33b743fac4", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-7893654ab9f44cdf7b6acf5a", "type": "http-exported-object", "filename": "%2f(10)", "filenames": [ "%2f(10)", "%2f(100)", "%2f(101)", "%2f(102)", "%2f(103)", "%2f(104)", "%2f(105)", "%2f(106)", "%2f(107)", "%2f(108)", "%2f(109)", "%2f(11)", "%2f(110)", "%2f(111)", "%2f(112)", "%2f(113)", "%2f(114)", "%2f(115)", "%2f(116)", "%2f(117)", "%2f(118)", "%2f(119)", "%2f(12)", "%2f(120)", "%2f(121)", "%2f(122)", "%2f(123)", "%2f(124)", "%2f(125)", "%2f(126)" ], "occurrences": 305, "static_features": { "content_kind": "unclassified", "inspected_bytes": 94, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 94, "sha256": "f394b14f8fb0b1d746f13e2acb5921e4c5962984836c1187147e341fcb693b0e", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-ea74cc4689a1cabb5f8fc9a3", "type": "http-exported-object", "filename": "%2f", "filenames": [ "%2f" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 32, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 32, "sha256": "dff7255b90139fbc8d3e76f31b480e65fc3eb7f49f70e7876cfb3f1cb56e5123", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-4cb50240de9ae0db273327a9", "type": "http-exported-object", "filename": "connecttest.txt", "filenames": [ "connecttest.txt" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 22, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 22, "sha256": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61", "media_type": "text/plain", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-f191a5f8018208969dce50f8", "type": "http-exported-object", "filename": "ProcessMAU.txt", "filenames": [ "ProcessMAU.txt" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 4, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 4, "sha256": "69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820", "media_type": "text/plain", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false } ], "observables": [ { "observable_id": "observable-017ebbadddefb267995d7066", "type": "domain", "value": "a1834.dscg2.akamai.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1723680647.655918000", "last_seen_epoch": "1723680913.153633000", "evidence": [ { "frame_number": 3816, "timestamp_epoch": "1723680647.655918000", "display_filter": "frame.number == 3816", "udp_stream": 47 }, { "frame_number": 3828, "timestamp_epoch": "1723680647.681941000", "display_filter": "frame.number == 3828", "udp_stream": 48 }, { "frame_number": 3829, "timestamp_epoch": "1723680647.682049000", "display_filter": "frame.number == 3829", "udp_stream": 48 }, { "frame_number": 12746, "timestamp_epoch": "1723680913.142907000", "display_filter": "frame.number == 12746", "udp_stream": 117 }, { "frame_number": 12747, "timestamp_epoch": "1723680913.153633000", "display_filter": "frame.number == 12747", "udp_stream": 116 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0da896c25955740331157dcc", "type": "domain", "value": "acroipm2.adobe.com", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1723681329.688680000", "last_seen_epoch": "1723681329.890743000", "evidence": [ { "frame_number": 15338, "timestamp_epoch": "1723681329.688680000", "display_filter": "frame.number == 15338", "udp_stream": 135 }, { "frame_number": 15339, "timestamp_epoch": "1723681329.745963000", "display_filter": "frame.number == 15339", "udp_stream": 135 }, { "frame_number": 15340, "timestamp_epoch": "1723681329.746257000", "display_filter": "frame.number == 15340", "udp_stream": 135 }, { "frame_number": 15341, "timestamp_epoch": "1723681329.746343000", "display_filter": "frame.number == 15341", "udp_stream": 135 }, { "frame_number": 15345, "timestamp_epoch": "1723681329.890743000", "display_filter": "frame.number == 15345", "tcp_stream": 300 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6492223fb15f40684f25de2f", "type": "domain", "value": "api.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680647.732029000", "last_seen_epoch": "1723680912.460984000", "evidence": [ { "frame_number": 3841, "timestamp_epoch": "1723680647.732029000", "display_filter": "frame.number == 3841", "udp_stream": 63 }, { "frame_number": 3842, "timestamp_epoch": "1723680647.732238000", "display_filter": "frame.number == 3842", "udp_stream": 64 }, { "frame_number": 3864, "timestamp_epoch": "1723680647.770709000", "display_filter": "frame.number == 3864", "udp_stream": 63 }, { "frame_number": 3884, "timestamp_epoch": "1723680647.809673000", "display_filter": "frame.number == 3884", "udp_stream": 64 }, { "frame_number": 12585, "timestamp_epoch": "1723680912.259888000", "display_filter": "frame.number == 12585", "udp_stream": 110 }, { "frame_number": 12586, "timestamp_epoch": "1723680912.260050000", "display_filter": "frame.number == 12586", "udp_stream": 111 }, { "frame_number": 12587, "timestamp_epoch": "1723680912.303311000", "display_filter": "frame.number == 12587", "udp_stream": 111 }, { "frame_number": 12588, "timestamp_epoch": "1723680912.303775000", "display_filter": "frame.number == 12588", "udp_stream": 110 }, { "frame_number": 3919, "timestamp_epoch": "1723680647.835099000", "display_filter": "frame.number == 3919", "tcp_stream": 98 }, { "frame_number": 3972, "timestamp_epoch": "1723680647.949563000", "display_filter": "frame.number == 3972", "tcp_stream": 98 }, { "frame_number": 12593, "timestamp_epoch": "1723680912.354568000", "display_filter": "frame.number == 12593", "tcp_stream": 200 }, { "frame_number": 12615, "timestamp_epoch": "1723680912.460984000", "display_filter": "frame.number == 12615", "tcp_stream": 200 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4faa621237d1fe2a32aecb1a", "type": "domain", "value": "app-edge.smartscreen.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680664.215425000", "last_seen_epoch": "1723680680.283981000", "evidence": [ { "frame_number": 8661, "timestamp_epoch": "1723680664.215425000", "display_filter": "frame.number == 8661", "udp_stream": 88 }, { "frame_number": 8662, "timestamp_epoch": "1723680664.215734000", "display_filter": "frame.number == 8662", "udp_stream": 89 }, { "frame_number": 8682, "timestamp_epoch": "1723680665.231999000", "display_filter": "frame.number == 8682", "udp_stream": 90 }, { "frame_number": 8683, "timestamp_epoch": "1723680665.233026000", "display_filter": "frame.number == 8683", "udp_stream": 91 }, { "frame_number": 8701, "timestamp_epoch": "1723680667.265972000", "display_filter": "frame.number == 8701", "udp_stream": 22 }, { "frame_number": 8718, "timestamp_epoch": "1723680668.267596000", "display_filter": "frame.number == 8718", "udp_stream": 22 }, { "frame_number": 8719, "timestamp_epoch": "1723680668.316350000", "display_filter": "frame.number == 8719", "udp_stream": 22 }, { "frame_number": 8897, "timestamp_epoch": "1723680680.276752000", "display_filter": "frame.number == 8897", "udp_stream": 91 }, { "frame_number": 8898, "timestamp_epoch": "1723680680.276879000", "display_filter": "frame.number == 8898", "udp_stream": 89 }, { "frame_number": 8899, "timestamp_epoch": "1723680680.276913000", "display_filter": "frame.number == 8899", "udp_stream": 91 }, { "frame_number": 8900, "timestamp_epoch": "1723680680.283851000", "display_filter": "frame.number == 8900", "udp_stream": 90 }, { "frame_number": 8901, "timestamp_epoch": "1723680680.283935000", "display_filter": "frame.number == 8901", "udp_stream": 22 }, { "frame_number": 8902, "timestamp_epoch": "1723680680.283981000", "display_filter": "frame.number == 8902", "udp_stream": 88 }, { "frame_number": 8724, "timestamp_epoch": "1723680668.416978000", "display_filter": "frame.number == 8724", "tcp_stream": 114 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ada6c60341341ad2d517b2d5", "type": "domain", "value": "armmf.adobe.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723681330.002305000", "last_seen_epoch": "1723681330.075840000", "evidence": [ { "frame_number": 15349, "timestamp_epoch": "1723681330.002305000", "display_filter": "frame.number == 15349", "udp_stream": 136 }, { "frame_number": 15350, "timestamp_epoch": "1723681330.035422000", "display_filter": "frame.number == 15350", "udp_stream": 136 }, { "frame_number": 15354, "timestamp_epoch": "1723681330.075840000", "display_filter": "frame.number == 15354", "tcp_stream": 301 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3cb00d6fa4673487ba6fa7f8", "type": "domain", "value": "assets.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680610.846039000", "last_seen_epoch": "1723681381.492002000", "evidence": [ { "frame_number": 1286, "timestamp_epoch": "1723680610.846039000", "display_filter": "frame.number == 1286", "udp_stream": 14 }, { "frame_number": 1293, "timestamp_epoch": "1723680610.884498000", "display_filter": "frame.number == 1293", "udp_stream": 14 }, { "frame_number": 3833, "timestamp_epoch": "1723680647.707158000", "display_filter": "frame.number == 3833", "udp_stream": 61 }, { "frame_number": 3834, "timestamp_epoch": "1723680647.707250000", "display_filter": "frame.number == 3834", "udp_stream": 62 }, { "frame_number": 3845, "timestamp_epoch": "1723680647.738191000", "display_filter": "frame.number == 3845", "udp_stream": 62 }, { "frame_number": 3853, "timestamp_epoch": "1723680647.756613000", "display_filter": "frame.number == 3853", "udp_stream": 61 }, { "frame_number": 8890, "timestamp_epoch": "1723680677.670259000", "display_filter": "frame.number == 8890", "udp_stream": 14 }, { "frame_number": 8891, "timestamp_epoch": "1723680678.670302000", "display_filter": "frame.number == 8891", "udp_stream": 14 }, { "frame_number": 8894, "timestamp_epoch": "1723680679.670382000", "display_filter": "frame.number == 8894", "udp_stream": 14 }, { "frame_number": 8980, "timestamp_epoch": "1723680681.686186000", "display_filter": "frame.number == 8980", "udp_stream": 14 }, { "frame_number": 9002, "timestamp_epoch": "1723680682.288508000", "display_filter": "frame.number == 9002", "udp_stream": 14 }, { "frame_number": 12574, "timestamp_epoch": "1723680912.166445000", "display_filter": "frame.number == 12574", "udp_stream": 108 }, { "frame_number": 12575, "timestamp_epoch": "1723680912.166716000", "display_filter": "frame.number == 12575", "udp_stream": 109 }, { "frame_number": 12576, "timestamp_epoch": "1723680912.167089000", "display_filter": "frame.number == 12576", "udp_stream": 109 }, { "frame_number": 12577, "timestamp_epoch": "1723680912.207185000", "display_filter": "frame.number == 12577", "udp_stream": 108 }, { "frame_number": 15469, "timestamp_epoch": "1723681381.384878000", "display_filter": "frame.number == 15469", "udp_stream": 136 }, { "frame_number": 15470, "timestamp_epoch": "1723681381.435487000", "display_filter": "frame.number == 15470", "udp_stream": 136 }, { "frame_number": 1308, "timestamp_epoch": "1723680611.061775000", "display_filter": "frame.number == 1308", "tcp_stream": 59 }, { "frame_number": 2025, "timestamp_epoch": "1723680616.146838000", "display_filter": "frame.number == 2025", "tcp_stream": 71 }, { "frame_number": 3893, "timestamp_epoch": "1723680647.820816000", "display_filter": "frame.number == 3893", "tcp_stream": 95 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-00ff1b2a9c6a19e19c2c27e2", "type": "domain", "value": "blob.mwh03prdstf02a.store.core.windows.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1723680857.763655000", "last_seen_epoch": "1723680857.763655000", "evidence": [ { "frame_number": 12103, "timestamp_epoch": "1723680857.763655000", "display_filter": "frame.number == 12103", "udp_stream": 99 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-291721be60ad521d9e27be10", "type": "domain", "value": "browser.events.data.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680647.633735000", "last_seen_epoch": "1723680656.218317000", "evidence": [ { "frame_number": 3803, "timestamp_epoch": "1723680647.633735000", "display_filter": "frame.number == 3803", "udp_stream": 53 }, { "frame_number": 3804, "timestamp_epoch": "1723680647.633897000", "display_filter": "frame.number == 3804", "udp_stream": 54 }, { "frame_number": 3823, "timestamp_epoch": "1723680647.679002000", "display_filter": "frame.number == 3823", "udp_stream": 53 }, { "frame_number": 3835, "timestamp_epoch": "1723680647.712629000", "display_filter": "frame.number == 3835", "udp_stream": 54 }, { "frame_number": 3855, "timestamp_epoch": "1723680647.757376000", "display_filter": "frame.number == 3855", "tcp_stream": 90 }, { "frame_number": 3946, "timestamp_epoch": "1723680647.901167000", "display_filter": "frame.number == 3946", "tcp_stream": 90 }, { "frame_number": 6211, "timestamp_epoch": "1723680655.749003000", "display_filter": "frame.number == 6211", "tcp_stream": 108 }, { "frame_number": 6215, "timestamp_epoch": "1723680655.900384000", "display_filter": "frame.number == 6215", "tcp_stream": 108 }, { "frame_number": 6278, "timestamp_epoch": "1723680656.055329000", "display_filter": "frame.number == 6278", "tcp_stream": 109 }, { "frame_number": 6291, "timestamp_epoch": "1723680656.218317000", "display_filter": "frame.number == 6291", "tcp_stream": 109 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c78dba769f06418e7867c8c2", "type": "domain", "value": "business.bing.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680646.155440000", "last_seen_epoch": "1723680650.245055000", "evidence": [ { "frame_number": 3662, "timestamp_epoch": "1723680646.155440000", "display_filter": "frame.number == 3662", "udp_stream": 45 }, { "frame_number": 3663, "timestamp_epoch": "1723680646.155667000", "display_filter": "frame.number == 3663", "udp_stream": 46 }, { "frame_number": 3664, "timestamp_epoch": "1723680646.404859000", "display_filter": "frame.number == 3664", "udp_stream": 45 }, { "frame_number": 5368, "timestamp_epoch": "1723680650.245055000", "display_filter": "frame.number == 5368", "udp_stream": 46 }, { "frame_number": 3672, "timestamp_epoch": "1723680646.525338000", "display_filter": "frame.number == 3672", "tcp_stream": 89 }, { "frame_number": 3676, "timestamp_epoch": "1723680646.525783000", "display_filter": "frame.number == 3676", "tcp_stream": 88 }, { "frame_number": 3681, "timestamp_epoch": "1723680646.658199000", "display_filter": "frame.number == 3681", "tcp_stream": 89 }, { "frame_number": 3683, "timestamp_epoch": "1723680646.659078000", "display_filter": "frame.number == 3683", "tcp_stream": 88 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-557d5edf147136bd011b6bac", "type": "domain", "value": "business.checkfedexexp.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680683.970135000", "last_seen_epoch": "1723680684.086873000", "evidence": [ { "frame_number": 9026, "timestamp_epoch": "1723680683.970135000", "display_filter": "frame.number == 9026", "udp_stream": 38 }, { "frame_number": 9027, "timestamp_epoch": "1723680684.025067000", "display_filter": "frame.number == 9027", "udp_stream": 38 }, { "frame_number": 9031, "timestamp_epoch": "1723680684.086873000", "display_filter": "frame.number == 9031", "tcp_stream": 124 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9d931480ed232d233907e914", "type": "domain", "value": "bzib.nelreports.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680680.969233000", "last_seen_epoch": "1723680681.092569000", "evidence": [ { "frame_number": 8906, "timestamp_epoch": "1723680680.969233000", "display_filter": "frame.number == 8906", "udp_stream": 93 }, { "frame_number": 8907, "timestamp_epoch": "1723680680.969419000", "display_filter": "frame.number == 8907", "udp_stream": 94 }, { "frame_number": 8908, "timestamp_epoch": "1723680681.020509000", "display_filter": "frame.number == 8908", "udp_stream": 94 }, { "frame_number": 8910, "timestamp_epoch": "1723680681.044086000", "display_filter": "frame.number == 8910", "udp_stream": 93 }, { "frame_number": 8922, "timestamp_epoch": "1723680681.092569000", "display_filter": "frame.number == 8922", "tcp_stream": 122 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-84af1ed8e91da49ff4e34f5e", "type": "domain", "value": "c-msn-com-nsatc.trafficmanager.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1723680647.730583000", "last_seen_epoch": "1723680647.730733000", "evidence": [ { "frame_number": 3838, "timestamp_epoch": "1723680647.730583000", "display_filter": "frame.number == 3838", "udp_stream": 57 }, { "frame_number": 3839, "timestamp_epoch": "1723680647.730733000", "display_filter": "frame.number == 3839", "udp_stream": 58 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9badfd36cfc590bc3e1113d0", "type": "domain", "value": "c-ring.msedge.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680798.231667000", "last_seen_epoch": "1723680798.387308000", "evidence": [ { "frame_number": 11763, "timestamp_epoch": "1723680798.231667000", "display_filter": "frame.number == 11763", "udp_stream": 99 }, { "frame_number": 11764, "timestamp_epoch": "1723680798.271398000", "display_filter": "frame.number == 11764", "udp_stream": 99 }, { "frame_number": 11770, "timestamp_epoch": "1723680798.323436000", "display_filter": "frame.number == 11770", "tcp_stream": 158 }, { "frame_number": 11774, "timestamp_epoch": "1723680798.387308000", "display_filter": "frame.number == 11774", "tcp_stream": 158 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-fef396f70e547011a38f9326", "type": "domain", "value": "c.bing.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680647.680678000", "last_seen_epoch": "1723680647.883892000", "evidence": [ { "frame_number": 3826, "timestamp_epoch": "1723680647.680678000", "display_filter": "frame.number == 3826", "udp_stream": 59 }, { "frame_number": 3827, "timestamp_epoch": "1723680647.680817000", "display_filter": "frame.number == 3827", "udp_stream": 60 }, { "frame_number": 3836, "timestamp_epoch": "1723680647.712660000", "display_filter": "frame.number == 3836", "udp_stream": 59 }, { "frame_number": 3850, "timestamp_epoch": "1723680647.745289000", "display_filter": "frame.number == 3850", "udp_stream": 60 }, { "frame_number": 3868, "timestamp_epoch": "1723680647.778061000", "display_filter": "frame.number == 3868", "tcp_stream": 92 }, { "frame_number": 3940, "timestamp_epoch": "1723680647.883892000", "display_filter": "frame.number == 3940", "tcp_stream": 92 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e0002d40fba1dac4ae78e2f9", "type": "domain", "value": "c.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680647.679975000", "last_seen_epoch": "1723680647.821904000", "evidence": [ { "frame_number": 3824, "timestamp_epoch": "1723680647.679975000", "display_filter": "frame.number == 3824", "udp_stream": 57 }, { "frame_number": 3825, "timestamp_epoch": "1723680647.680212000", "display_filter": "frame.number == 3825", "udp_stream": 58 }, { "frame_number": 3838, "timestamp_epoch": "1723680647.730583000", "display_filter": "frame.number == 3838", "udp_stream": 57 }, { "frame_number": 3839, "timestamp_epoch": "1723680647.730733000", "display_filter": "frame.number == 3839", "udp_stream": 58 }, { "frame_number": 3905, "timestamp_epoch": "1723680647.821904000", "display_filter": "frame.number == 3905", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-101d233c6d28277aa106d411", "type": "domain", "value": "client.wns.windows.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680610.515418000", "last_seen_epoch": "1723680671.326251000", "evidence": [ { "frame_number": 1238, "timestamp_epoch": "1723680610.515418000", "display_filter": "frame.number == 1238", "udp_stream": 14 }, { "frame_number": 1241, "timestamp_epoch": "1723680610.587785000", "display_filter": "frame.number == 1241", "udp_stream": 14 }, { "frame_number": 1252, "timestamp_epoch": "1723680610.667382000", "display_filter": "frame.number == 1252", "tcp_stream": 58 }, { "frame_number": 8850, "timestamp_epoch": "1723680671.326251000", "display_filter": "frame.number == 8850", "tcp_stream": 119 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a2c13c57d6b8d073f70e57dd", "type": "domain", "value": "cxcs.microsoft.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680802.766808000", "last_seen_epoch": "1723680802.854082000", "evidence": [ { "frame_number": 11900, "timestamp_epoch": "1723680802.766808000", "display_filter": "frame.number == 11900", "udp_stream": 99 }, { "frame_number": 11902, "timestamp_epoch": "1723680802.828739000", "display_filter": "frame.number == 11902", "udp_stream": 99 }, { "frame_number": 11908, "timestamp_epoch": "1723680802.854082000", "display_filter": "frame.number == 11908", "tcp_stream": 162 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d5b218a43b0e2699700c2c1e", "type": "domain", "value": "default.exp-tas.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680626.033462000", "last_seen_epoch": "1723680626.259996000", "evidence": [ { "frame_number": 3541, "timestamp_epoch": "1723680626.033462000", "display_filter": "frame.number == 3541", "udp_stream": 38 }, { "frame_number": 3542, "timestamp_epoch": "1723680626.079863000", "display_filter": "frame.number == 3542", "udp_stream": 38 }, { "frame_number": 3546, "timestamp_epoch": "1723680626.203055000", "display_filter": "frame.number == 3546", "tcp_stream": 86 }, { "frame_number": 3549, "timestamp_epoch": "1723680626.259996000", "display_filter": "frame.number == 3549", "tcp_stream": 86 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-58ca6ac7d264fa2adede3176", "type": "domain", "value": "displaycatalog.mp.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680988.261653000", "last_seen_epoch": "1723680988.460545000", "evidence": [ { "frame_number": 13848, "timestamp_epoch": "1723680988.261653000", "display_filter": "frame.number == 13848", "udp_stream": 100 }, { "frame_number": 13849, "timestamp_epoch": "1723680988.309333000", "display_filter": "frame.number == 13849", "udp_stream": 100 }, { "frame_number": 13850, "timestamp_epoch": "1723680988.363063000", "display_filter": "frame.number == 13850", "udp_stream": 100 }, { "frame_number": 13854, "timestamp_epoch": "1723680988.460545000", "display_filter": "frame.number == 13854", "tcp_stream": 221 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c63920e47e9882dde07d83c6", "type": "domain", "value": "dl-edge.smartscreen.microsoft.com", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1723680663.071843000", "last_seen_epoch": "1723680663.113141000", "evidence": [ { "frame_number": 6474, "timestamp_epoch": "1723680663.071843000", "display_filter": "frame.number == 6474", "udp_stream": 86 }, { "frame_number": 6475, "timestamp_epoch": "1723680663.072024000", "display_filter": "frame.number == 6475", "udp_stream": 87 }, { "frame_number": 6476, "timestamp_epoch": "1723680663.104422000", "display_filter": "frame.number == 6476", "udp_stream": 86 }, { "frame_number": 6477, "timestamp_epoch": "1723680663.113141000", "display_filter": "frame.number == 6477", "udp_stream": 87 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-8c87a9d9b2fc116ef9b77e84", "type": "domain", "value": "dual-s-ring.msedge.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680797.495755000", "last_seen_epoch": "1723680797.597999000", "evidence": [ { "frame_number": 11691, "timestamp_epoch": "1723680797.495755000", "display_filter": "frame.number == 11691", "udp_stream": 99 }, { "frame_number": 11696, "timestamp_epoch": "1723680797.539068000", "display_filter": "frame.number == 11696", "udp_stream": 99 }, { "frame_number": 11700, "timestamp_epoch": "1723680797.564632000", "display_filter": "frame.number == 11700", "tcp_stream": 156 }, { "frame_number": 11704, "timestamp_epoch": "1723680797.597999000", "display_filter": "frame.number == 11704", "tcp_stream": 156 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-01c1d5c588301631290c4b44", "type": "domain", "value": "ecn-us.dev.virtualearth.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680650.426947000", "last_seen_epoch": "1723680650.553411000", "evidence": [ { "frame_number": 5420, "timestamp_epoch": "1723680650.426947000", "display_filter": "frame.number == 5420", "udp_stream": 75 }, { "frame_number": 5421, "timestamp_epoch": "1723680650.427087000", "display_filter": "frame.number == 5421", "udp_stream": 76 }, { "frame_number": 5423, "timestamp_epoch": "1723680650.427346000", "display_filter": "frame.number == 5423", "udp_stream": 76 }, { "frame_number": 5450, "timestamp_epoch": "1723680650.492145000", "display_filter": "frame.number == 5450", "udp_stream": 75 }, { "frame_number": 5509, "timestamp_epoch": "1723680650.553411000", "display_filter": "frame.number == 5509", "tcp_stream": 105 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1e6eae278141c6a6c0464b08", "type": "domain", "value": "ecs.office.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680622.291194000", "last_seen_epoch": "1723682445.474075000", "evidence": [ { "frame_number": 2997, "timestamp_epoch": "1723680622.291194000", "display_filter": "frame.number == 2997", "udp_stream": 14 }, { "frame_number": 3001, "timestamp_epoch": "1723680622.357369000", "display_filter": "frame.number == 3001", "udp_stream": 14 }, { "frame_number": 14634, "timestamp_epoch": "1723681155.362065000", "display_filter": "frame.number == 14634", "udp_stream": 131 }, { "frame_number": 14636, "timestamp_epoch": "1723681155.399633000", "display_filter": "frame.number == 14636", "udp_stream": 131 }, { "frame_number": 15758, "timestamp_epoch": "1723681510.149307000", "display_filter": "frame.number == 15758", "udp_stream": 136 }, { "frame_number": 15759, "timestamp_epoch": "1723681510.196760000", "display_filter": "frame.number == 15759", "udp_stream": 136 }, { "frame_number": 15760, "timestamp_epoch": "1723681510.197099000", "display_filter": "frame.number == 15760", "udp_stream": 136 }, { "frame_number": 15761, "timestamp_epoch": "1723681510.197245000", "display_filter": "frame.number == 15761", "udp_stream": 136 }, { "frame_number": 15762, "timestamp_epoch": "1723681510.197475000", "display_filter": "frame.number == 15762", "udp_stream": 136 }, { "frame_number": 17126, "timestamp_epoch": "1723682071.036990000", "display_filter": "frame.number == 17126", "udp_stream": 148 }, { "frame_number": 17127, "timestamp_epoch": "1723682071.094483000", "display_filter": "frame.number == 17127", "udp_stream": 148 }, { "frame_number": 17128, "timestamp_epoch": "1723682071.184741000", "display_filter": "frame.number == 17128", "udp_stream": 148 }, { "frame_number": 3007, "timestamp_epoch": "1723680622.426613000", "display_filter": "frame.number == 3007", "tcp_stream": 82 }, { "frame_number": 3018, "timestamp_epoch": "1723680622.491602000", "display_filter": "frame.number == 3018", "tcp_stream": 82 }, { "frame_number": 14640, "timestamp_epoch": "1723681155.458646000", "display_filter": "frame.number == 14640", "tcp_stream": 262 }, { "frame_number": 14643, "timestamp_epoch": "1723681155.519827000", "display_filter": "frame.number == 14643", "tcp_stream": 262 }, { "frame_number": 15771, "timestamp_epoch": "1723681512.285308000", "display_filter": "frame.number == 15771", "tcp_stream": 335 }, { "frame_number": 15772, "timestamp_epoch": "1723681512.285354000", "display_filter": "frame.number == 15772", "tcp_stream": 336 }, { "frame_number": 17132, "timestamp_epoch": "1723682071.235006000", "display_filter": "frame.number == 17132", "tcp_stream": 442 }, { "frame_number": 17136, "timestamp_epoch": "1723682071.296752000", "display_filter": "frame.number == 17136", "tcp_stream": 442 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-bbe380559ce7762f0271b8b7", "type": "domain", "value": "edge-consumer-static.azureedge.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680648.389188000", "last_seen_epoch": "1723680648.560629000", "evidence": [ { "frame_number": 4395, "timestamp_epoch": "1723680648.389188000", "display_filter": "frame.number == 4395", "udp_stream": 68 }, { "frame_number": 4396, "timestamp_epoch": "1723680648.389385000", "display_filter": "frame.number == 4396", "udp_stream": 69 }, { "frame_number": 4404, "timestamp_epoch": "1723680648.443397000", "display_filter": "frame.number == 4404", "udp_stream": 68 }, { "frame_number": 4413, "timestamp_epoch": "1723680648.484064000", "display_filter": "frame.number == 4413", "udp_stream": 69 }, { "frame_number": 4414, "timestamp_epoch": "1723680648.484222000", "display_filter": "frame.number == 4414", "udp_stream": 69 }, { "frame_number": 4419, "timestamp_epoch": "1723680648.494630000", "display_filter": "frame.number == 4419", "tcp_stream": 99 }, { "frame_number": 4432, "timestamp_epoch": "1723680648.560629000", "display_filter": "frame.number == 4432", "tcp_stream": 99 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a6ad868c7d3d09204d3ceb95", "type": "domain", "value": "edge-microsoft-com.dual-a-0036.a-msedge.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1723680618.962508000", "last_seen_epoch": "1723680618.962508000", "evidence": [ { "frame_number": 2109, "timestamp_epoch": "1723680618.962508000", "display_filter": "frame.number == 2109", "udp_stream": 25 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1467d193187b048eac3a37ec", "type": "domain", "value": "edge.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680618.962098000", "last_seen_epoch": "1723680895.824113000", "evidence": [ { "frame_number": 2107, "timestamp_epoch": "1723680618.962098000", "display_filter": "frame.number == 2107", "udp_stream": 24 }, { "frame_number": 2108, "timestamp_epoch": "1723680618.962307000", "display_filter": "frame.number == 2108", "udp_stream": 25 }, { "frame_number": 2109, "timestamp_epoch": "1723680618.962508000", "display_filter": "frame.number == 2109", "udp_stream": 25 }, { "frame_number": 2115, "timestamp_epoch": "1723680619.000623000", "display_filter": "frame.number == 2115", "udp_stream": 24 }, { "frame_number": 2280, "timestamp_epoch": "1723680619.360469000", "display_filter": "frame.number == 2280", "udp_stream": 28 }, { "frame_number": 2281, "timestamp_epoch": "1723680619.360576000", "display_filter": "frame.number == 2281", "udp_stream": 29 }, { "frame_number": 2282, "timestamp_epoch": "1723680619.360829000", "display_filter": "frame.number == 2282", "udp_stream": 28 }, { "frame_number": 2286, "timestamp_epoch": "1723680619.392816000", "display_filter": "frame.number == 2286", "udp_stream": 29 }, { "frame_number": 10235, "timestamp_epoch": "1723680693.779007000", "display_filter": "frame.number == 10235", "udp_stream": 96 }, { "frame_number": 10236, "timestamp_epoch": "1723680693.779153000", "display_filter": "frame.number == 10236", "udp_stream": 97 }, { "frame_number": 10245, "timestamp_epoch": "1723680693.831947000", "display_filter": "frame.number == 10245", "udp_stream": 96 }, { "frame_number": 10247, "timestamp_epoch": "1723680693.864576000", "display_filter": "frame.number == 10247", "udp_stream": 97 }, { "frame_number": 10248, "timestamp_epoch": "1723680693.864899000", "display_filter": "frame.number == 10248", "udp_stream": 97 }, { "frame_number": 12206, "timestamp_epoch": "1723680895.679744000", "display_filter": "frame.number == 12206", "udp_stream": 102 }, { "frame_number": 12207, "timestamp_epoch": "1723680895.680047000", "display_filter": "frame.number == 12207", "udp_stream": 103 }, { "frame_number": 12210, "timestamp_epoch": "1723680895.742669000", "display_filter": "frame.number == 12210", "udp_stream": 102 }, { "frame_number": 12212, "timestamp_epoch": "1723680895.806474000", "display_filter": "frame.number == 12212", "udp_stream": 103 }, { "frame_number": 12213, "timestamp_epoch": "1723680895.806761000", "display_filter": "frame.number == 12213", "udp_stream": 103 }, { "frame_number": 2147, "timestamp_epoch": "1723680619.054936000", "display_filter": "frame.number == 2147", "tcp_stream": 73 }, { "frame_number": 2293, "timestamp_epoch": "1723680619.424890000", "display_filter": "frame.number == 2293", "tcp_stream": 79 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-66289a646a3a0af4ef244304", "type": "domain", "value": "edgeservices.bing.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680619.724662000", "last_seen_epoch": "1723680620.447047000", "evidence": [ { "frame_number": 2314, "timestamp_epoch": "1723680619.724662000", "display_filter": "frame.number == 2314", "udp_stream": 30 }, { "frame_number": 2315, "timestamp_epoch": "1723680619.724901000", "display_filter": "frame.number == 2315", "udp_stream": 31 }, { "frame_number": 2316, "timestamp_epoch": "1723680619.725181000", "display_filter": "frame.number == 2316", "udp_stream": 30 }, { "frame_number": 2317, "timestamp_epoch": "1723680619.725298000", "display_filter": "frame.number == 2317", "udp_stream": 31 }, { "frame_number": 2329, "timestamp_epoch": "1723680619.794845000", "display_filter": "frame.number == 2329", "udp_stream": 32 }, { "frame_number": 2330, "timestamp_epoch": "1723680619.795182000", "display_filter": "frame.number == 2330", "udp_stream": 32 }, { "frame_number": 2331, "timestamp_epoch": "1723680619.795686000", "display_filter": "frame.number == 2331", "udp_stream": 33 }, { "frame_number": 2332, "timestamp_epoch": "1723680619.795941000", "display_filter": "frame.number == 2332", "udp_stream": 33 }, { "frame_number": 2334, "timestamp_epoch": "1723680619.796643000", "display_filter": "frame.number == 2334", "udp_stream": 34 }, { "frame_number": 2335, "timestamp_epoch": "1723680619.796873000", "display_filter": "frame.number == 2335", "udp_stream": 34 }, { "frame_number": 2398, "timestamp_epoch": "1723680620.446606000", "display_filter": "frame.number == 2398", "udp_stream": 35 }, { "frame_number": 2399, "timestamp_epoch": "1723680620.446770000", "display_filter": "frame.number == 2399", "udp_stream": 36 }, { "frame_number": 2400, "timestamp_epoch": "1723680620.447044000", "display_filter": "frame.number == 2400", "udp_stream": 35 }, { "frame_number": 2401, "timestamp_epoch": "1723680620.447047000", "display_filter": "frame.number == 2401", "udp_stream": 36 }, { "frame_number": 2325, "timestamp_epoch": "1723680619.755866000", "display_filter": "frame.number == 2325", "tcp_stream": 80 }, { "frame_number": 2345, "timestamp_epoch": "1723680619.855497000", "display_filter": "frame.number == 2345", "tcp_stream": 81 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4bcfc3ed1d4bffc90703c527", "type": "domain", "value": "fd.api.iris.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680610.533196000", "last_seen_epoch": "1723681540.812330000", "evidence": [ { "frame_number": 1239, "timestamp_epoch": "1723680610.533196000", "display_filter": "frame.number == 1239", "udp_stream": 22 }, { "frame_number": 1242, "timestamp_epoch": "1723680610.587790000", "display_filter": "frame.number == 1242", "udp_stream": 22 }, { "frame_number": 11684, "timestamp_epoch": "1723680796.408305000", "display_filter": "frame.number == 11684", "udp_stream": 38 }, { "frame_number": 11690, "timestamp_epoch": "1723680797.397984000", "display_filter": "frame.number == 11690", "udp_stream": 38 }, { "frame_number": 11776, "timestamp_epoch": "1723680798.412708000", "display_filter": "frame.number == 11776", "udp_stream": 38 }, { "frame_number": 11840, "timestamp_epoch": "1723680800.428651000", "display_filter": "frame.number == 11840", "udp_stream": 38 }, { "frame_number": 11866, "timestamp_epoch": "1723680800.899368000", "display_filter": "frame.number == 11866", "udp_stream": 38 }, { "frame_number": 15987, "timestamp_epoch": "1723681540.680496000", "display_filter": "frame.number == 15987", "udp_stream": 139 }, { "frame_number": 15988, "timestamp_epoch": "1723681540.729615000", "display_filter": "frame.number == 15988", "udp_stream": 139 }, { "frame_number": 15989, "timestamp_epoch": "1723681540.736897000", "display_filter": "frame.number == 15989", "udp_stream": 139 }, { "frame_number": 1250, "timestamp_epoch": "1723680610.664449000", "display_filter": "frame.number == 1250", "tcp_stream": 57 }, { "frame_number": 11872, "timestamp_epoch": "1723680800.965893000", "display_filter": "frame.number == 11872", "tcp_stream": 161 }, { "frame_number": 15993, "timestamp_epoch": "1723681540.812330000", "display_filter": "frame.number == 15993", "tcp_stream": 347 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-40eaa1e4184dd2d70f7bbecf", "type": "domain", "value": "fe2cr.update.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723681192.073450000", "last_seen_epoch": "1723681192.215237000", "evidence": [ { "frame_number": 14766, "timestamp_epoch": "1723681192.073450000", "display_filter": "frame.number == 14766", "udp_stream": 131 }, { "frame_number": 14767, "timestamp_epoch": "1723681192.120676000", "display_filter": "frame.number == 14767", "udp_stream": 131 }, { "frame_number": 14771, "timestamp_epoch": "1723681192.215237000", "display_filter": "frame.number == 14771", "tcp_stream": 269 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-73b345c91dbe896fba338c6d", "type": "domain", "value": "fe2cr.update.msft.com.trafficmanager.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1723681192.120676000", "last_seen_epoch": "1723681192.120676000", "evidence": [ { "frame_number": 14767, "timestamp_epoch": "1723681192.120676000", "display_filter": "frame.number == 14767", "udp_stream": 131 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ef8e0e6ee00ce5851545abdc", "type": "domain", "value": "fe3cr.delivery.mp.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680990.209907000", "last_seen_epoch": "1723680990.338471000", "evidence": [ { "frame_number": 13888, "timestamp_epoch": "1723680990.209907000", "display_filter": "frame.number == 13888", "udp_stream": 126 }, { "frame_number": 13889, "timestamp_epoch": "1723680990.271942000", "display_filter": "frame.number == 13889", "udp_stream": 126 }, { "frame_number": 13892, "timestamp_epoch": "1723680990.284320000", "display_filter": "frame.number == 13892", "udp_stream": 126 }, { "frame_number": 13898, "timestamp_epoch": "1723680990.338471000", "display_filter": "frame.number == 13898", "tcp_stream": 224 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-8d469c1ce777e252370d4e97", "type": "domain", "value": "fp.msedge.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680798.683610000", "last_seen_epoch": "1723680798.844463000", "evidence": [ { "frame_number": 11801, "timestamp_epoch": "1723680798.683610000", "display_filter": "frame.number == 11801", "udp_stream": 99 }, { "frame_number": 11802, "timestamp_epoch": "1723680798.727364000", "display_filter": "frame.number == 11802", "udp_stream": 99 }, { "frame_number": 11806, "timestamp_epoch": "1723680798.779829000", "display_filter": "frame.number == 11806", "tcp_stream": 159 }, { "frame_number": 11810, "timestamp_epoch": "1723680798.844463000", "display_filter": "frame.number == 11810", "tcp_stream": 159 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-673a04cf0e6f15ffb9dbe28c", "type": "domain", "value": "g.live.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680622.289222000", "last_seen_epoch": "1723681154.564163000", "evidence": [ { "frame_number": 2996, "timestamp_epoch": "1723680622.289222000", "display_filter": "frame.number == 2996", "udp_stream": 22 }, { "frame_number": 2999, "timestamp_epoch": "1723680622.344915000", "display_filter": "frame.number == 2999", "udp_stream": 22 }, { "frame_number": 14497, "timestamp_epoch": "1723681154.404442000", "display_filter": "frame.number == 14497", "udp_stream": 128 }, { "frame_number": 14498, "timestamp_epoch": "1723681154.462102000", "display_filter": "frame.number == 14498", "udp_stream": 128 }, { "frame_number": 14499, "timestamp_epoch": "1723681154.477536000", "display_filter": "frame.number == 14499", "udp_stream": 128 }, { "frame_number": 3015, "timestamp_epoch": "1723680622.466683000", "display_filter": "frame.number == 3015", "tcp_stream": 84 }, { "frame_number": 14503, "timestamp_epoch": "1723681154.564163000", "display_filter": "frame.number == 14503", "tcp_stream": 259 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0f3a473c17ce7c3ffc9fca23", "type": "domain", "value": "go.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680585.304554000", "last_seen_epoch": "1723680911.365627000", "evidence": [ { "frame_number": 72, "timestamp_epoch": "1723680585.304554000", "display_filter": "frame.number == 72", "udp_stream": 9 }, { "frame_number": 73, "timestamp_epoch": "1723680585.344967000", "display_filter": "frame.number == 73", "udp_stream": 9 }, { "frame_number": 77, "timestamp_epoch": "1723680585.479612000", "display_filter": "frame.number == 77", "tcp_stream": 3 }, { "frame_number": 107, "timestamp_epoch": "1723680585.799589000", "display_filter": "frame.number == 107", "tcp_stream": 4 }, { "frame_number": 1198, "timestamp_epoch": "1723680609.708445000", "display_filter": "frame.number == 1198", "tcp_stream": 55 }, { "frame_number": 12292, "timestamp_epoch": "1723680909.941165000", "display_filter": "frame.number == 12292", "tcp_stream": 186 }, { "frame_number": 12310, "timestamp_epoch": "1723680910.121849000", "display_filter": "frame.number == 12310", "tcp_stream": 187 }, { "frame_number": 12330, "timestamp_epoch": "1723680910.305652000", "display_filter": "frame.number == 12330", "tcp_stream": 188 }, { "frame_number": 12351, "timestamp_epoch": "1723680910.483204000", "display_filter": "frame.number == 12351", "tcp_stream": 189 }, { "frame_number": 12374, "timestamp_epoch": "1723680910.660614000", "display_filter": "frame.number == 12374", "tcp_stream": 190 }, { "frame_number": 12395, "timestamp_epoch": "1723680910.902863000", "display_filter": "frame.number == 12395", "tcp_stream": 191 }, { "frame_number": 12425, "timestamp_epoch": "1723680911.133796000", "display_filter": "frame.number == 12425", "tcp_stream": 192 }, { "frame_number": 12463, "timestamp_epoch": "1723680911.365627000", "display_filter": "frame.number == 12463", "tcp_stream": 195 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-31272808836a3ea3c3d13ac7", "type": "domain", "value": "img-s-msn-com.akamaized.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680647.617210000", "last_seen_epoch": "1723680913.202066000", "evidence": [ { "frame_number": 3797, "timestamp_epoch": "1723680647.617210000", "display_filter": "frame.number == 3797", "udp_stream": 47 }, { "frame_number": 3798, "timestamp_epoch": "1723680647.617356000", "display_filter": "frame.number == 3798", "udp_stream": 48 }, { "frame_number": 3816, "timestamp_epoch": "1723680647.655918000", "display_filter": "frame.number == 3816", "udp_stream": 47 }, { "frame_number": 3828, "timestamp_epoch": "1723680647.681941000", "display_filter": "frame.number == 3828", "udp_stream": 48 }, { "frame_number": 3829, "timestamp_epoch": "1723680647.682049000", "display_filter": "frame.number == 3829", "udp_stream": 48 }, { "frame_number": 12737, "timestamp_epoch": "1723680913.098044000", "display_filter": "frame.number == 12737", "udp_stream": 116 }, { "frame_number": 12738, "timestamp_epoch": "1723680913.098252000", "display_filter": "frame.number == 12738", "udp_stream": 117 }, { "frame_number": 12746, "timestamp_epoch": "1723680913.142907000", "display_filter": "frame.number == 12746", "udp_stream": 117 }, { "frame_number": 12747, "timestamp_epoch": "1723680913.153633000", "display_filter": "frame.number == 12747", "udp_stream": 116 }, { "frame_number": 3901, "timestamp_epoch": "1723680647.821571000", "display_filter": "frame.number == 3901", "tcp_stream": 97 }, { "frame_number": 12761, "timestamp_epoch": "1723680913.202066000", "display_filter": "frame.number == 12761", "tcp_stream": 203 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b4e070a8cda1df0014f4b7de", "type": "domain", "value": "img.s-msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680913.219315000", "last_seen_epoch": "1723680913.302499000", "evidence": [ { "frame_number": 12769, "timestamp_epoch": "1723680913.219315000", "display_filter": "frame.number == 12769", "udp_stream": 119 }, { "frame_number": 12770, "timestamp_epoch": "1723680913.234543000", "display_filter": "frame.number == 12770", "udp_stream": 120 }, { "frame_number": 12808, "timestamp_epoch": "1723680913.262783000", "display_filter": "frame.number == 12808", "udp_stream": 119 }, { "frame_number": 12878, "timestamp_epoch": "1723680913.301703000", "display_filter": "frame.number == 12878", "udp_stream": 120 }, { "frame_number": 12880, "timestamp_epoch": "1723680913.301933000", "display_filter": "frame.number == 12880", "udp_stream": 120 }, { "frame_number": 12885, "timestamp_epoch": "1723680913.302499000", "display_filter": "frame.number == 12885", "tcp_stream": 205 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0f8a57aeeb741c80428eafcb", "type": "domain", "value": "licensing.mp.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723681282.313529000", "last_seen_epoch": "1723681282.618242000", "evidence": [ { "frame_number": 15105, "timestamp_epoch": "1723681282.313529000", "display_filter": "frame.number == 15105", "udp_stream": 133 }, { "frame_number": 15106, "timestamp_epoch": "1723681282.373419000", "display_filter": "frame.number == 15106", "udp_stream": 133 }, { "frame_number": 15107, "timestamp_epoch": "1723681282.519199000", "display_filter": "frame.number == 15107", "udp_stream": 133 }, { "frame_number": 15111, "timestamp_epoch": "1723681282.618242000", "display_filter": "frame.number == 15111", "tcp_stream": 287 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-71aca3f8fe222b9a4097e328", "type": "domain", "value": "login.microsoftonline.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680619.207596000", "last_seen_epoch": "1723680988.047624000", "evidence": [ { "frame_number": 2244, "timestamp_epoch": "1723680619.207596000", "display_filter": "frame.number == 2244", "udp_stream": 14 }, { "frame_number": 2245, "timestamp_epoch": "1723680619.207937000", "display_filter": "frame.number == 2245", "udp_stream": 14 }, { "frame_number": 10379, "timestamp_epoch": "1723680707.940727000", "display_filter": "frame.number == 10379", "udp_stream": 38 }, { "frame_number": 10380, "timestamp_epoch": "1723680708.002327000", "display_filter": "frame.number == 10380", "udp_stream": 38 }, { "frame_number": 13820, "timestamp_epoch": "1723680987.913914000", "display_filter": "frame.number == 13820", "udp_stream": 100 }, { "frame_number": 13826, "timestamp_epoch": "1723680987.962385000", "display_filter": "frame.number == 13826", "udp_stream": 100 }, { "frame_number": 2256, "timestamp_epoch": "1723680619.247242000", "display_filter": "frame.number == 2256", "tcp_stream": 78 }, { "frame_number": 2263, "timestamp_epoch": "1723680619.286862000", "display_filter": "frame.number == 2263", "tcp_stream": 78 }, { "frame_number": 10384, "timestamp_epoch": "1723680708.054855000", "display_filter": "frame.number == 10384", "tcp_stream": 132 }, { "frame_number": 10388, "timestamp_epoch": "1723680708.107727000", "display_filter": "frame.number == 10388", "tcp_stream": 132 }, { "frame_number": 10850, "timestamp_epoch": "1723680726.367792000", "display_filter": "frame.number == 10850", "tcp_stream": 139 }, { "frame_number": 10854, "timestamp_epoch": "1723680726.407785000", "display_filter": "frame.number == 10854", "tcp_stream": 139 }, { "frame_number": 11599, "timestamp_epoch": "1723680793.686955000", "display_filter": "frame.number == 11599", "tcp_stream": 150 }, { "frame_number": 11603, "timestamp_epoch": "1723680793.756880000", "display_filter": "frame.number == 11603", "tcp_stream": 150 }, { "frame_number": 13831, "timestamp_epoch": "1723680988.001569000", "display_filter": "frame.number == 13831", "tcp_stream": 220 }, { "frame_number": 13836, "timestamp_epoch": "1723680988.047624000", "display_filter": "frame.number == 13836", "tcp_stream": 220 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d9f05a2f4f56195ea8b1c3bc", "type": "domain", "value": "mobile.events.data.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680588.022122000", "last_seen_epoch": "1723682400.232996000", "evidence": [ { "frame_number": 727, "timestamp_epoch": "1723680588.022122000", "display_filter": "frame.number == 727", "udp_stream": 14 }, { "frame_number": 728, "timestamp_epoch": "1723680588.065143000", "display_filter": "frame.number == 728", "udp_stream": 14 }, { "frame_number": 842, "timestamp_epoch": "1723680591.535572000", "display_filter": "frame.number == 842", "udp_stream": 14 }, { "frame_number": 843, "timestamp_epoch": "1723680591.535872000", "display_filter": "frame.number == 843", "udp_stream": 14 }, { "frame_number": 17805, "timestamp_epoch": "1723682392.071763000", "display_filter": "frame.number == 17805", "udp_stream": 151 }, { "frame_number": 17806, "timestamp_epoch": "1723682392.121072000", "display_filter": "frame.number == 17806", "udp_stream": 151 }, { "frame_number": 733, "timestamp_epoch": "1723680588.207325000", "display_filter": "frame.number == 733", "tcp_stream": 33 }, { "frame_number": 737, "timestamp_epoch": "1723680588.293463000", "display_filter": "frame.number == 737", "tcp_stream": 33 }, { "frame_number": 847, "timestamp_epoch": "1723680591.605442000", "display_filter": "frame.number == 847", "tcp_stream": 38 }, { "frame_number": 851, "timestamp_epoch": "1723680591.688217000", "display_filter": "frame.number == 851", "tcp_stream": 38 }, { "frame_number": 17810, "timestamp_epoch": "1723682392.322492000", "display_filter": "frame.number == 17810", "tcp_stream": 503 }, { "frame_number": 17814, "timestamp_epoch": "1723682392.527841000", "display_filter": "frame.number == 17814", "tcp_stream": 503 }, { "frame_number": 17855, "timestamp_epoch": "1723682399.982309000", "display_filter": "frame.number == 17855", "tcp_stream": 505 }, { "frame_number": 17859, "timestamp_epoch": "1723682400.232996000", "display_filter": "frame.number == 17859", "tcp_stream": 505 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b1a3d6cb3afe404f3bb99b95", "type": "domain", "value": "mrodevicemgr.officeapps.live.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680909.209122000", "last_seen_epoch": "1723680909.364796000", "evidence": [ { "frame_number": 12259, "timestamp_epoch": "1723680909.209122000", "display_filter": "frame.number == 12259", "udp_stream": 99 }, { "frame_number": 12260, "timestamp_epoch": "1723680909.256572000", "display_filter": "frame.number == 12260", "udp_stream": 99 }, { "frame_number": 12261, "timestamp_epoch": "1723680909.294038000", "display_filter": "frame.number == 12261", "udp_stream": 99 }, { "frame_number": 12265, "timestamp_epoch": "1723680909.364796000", "display_filter": "frame.number == 12265", "tcp_stream": 185 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-04ba006fad4ca6b8b3f869eb", "type": "domain", "value": "msedge.b.tlu.dl.delivery.mp.microsoft.com", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1723680685.713930000", "last_seen_epoch": "1723680711.070632000", "evidence": [ { "frame_number": 10193, "timestamp_epoch": "1723680685.713930000", "display_filter": "frame.number == 10193", "udp_stream": 38 }, { "frame_number": 10194, "timestamp_epoch": "1723680685.765017000", "display_filter": "frame.number == 10194", "udp_stream": 38 }, { "frame_number": 10281, "timestamp_epoch": "1723680706.485092000", "display_filter": "frame.number == 10281", "udp_stream": 38 }, { "frame_number": 10283, "timestamp_epoch": "1723680706.544699000", "display_filter": "frame.number == 10283", "udp_stream": 38 }, { "frame_number": 10198, "timestamp_epoch": "1723680685.801254000", "display_filter": "frame.number == 10198", "tcp_stream": 127 }, { "frame_number": 10201, "timestamp_epoch": "1723680685.861043000", "display_filter": "frame.number == 10201", "tcp_stream": 127 }, { "frame_number": 10209, "timestamp_epoch": "1723680687.970979000", "display_filter": "frame.number == 10209", "tcp_stream": 127 }, { "frame_number": 10214, "timestamp_epoch": "1723680689.189501000", "display_filter": "frame.number == 10214", "tcp_stream": 127 }, { "frame_number": 10222, "timestamp_epoch": "1723680690.407477000", "display_filter": "frame.number == 10222", "tcp_stream": 127 }, { "frame_number": 10278, "timestamp_epoch": "1723680706.416178000", "display_filter": "frame.number == 10278", "tcp_stream": 127 }, { "frame_number": 10284, "timestamp_epoch": "1723680706.545976000", "display_filter": "frame.number == 10284", "tcp_stream": 127 }, { "frame_number": 10407, "timestamp_epoch": "1723680708.884758000", "display_filter": "frame.number == 10407", "tcp_stream": 127 }, { "frame_number": 10454, "timestamp_epoch": "1723680709.993124000", "display_filter": "frame.number == 10454", "tcp_stream": 127 }, { "frame_number": 10483, "timestamp_epoch": "1723680711.070632000", "display_filter": "frame.number == 10483", "tcp_stream": 127 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1547edd2baa8dcfcf91d3d6d", "type": "domain", "value": "nav-edge.smartscreen.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680657.268388000", "last_seen_epoch": "1723680657.384830000", "evidence": [ { "frame_number": 6371, "timestamp_epoch": "1723680657.268388000", "display_filter": "frame.number == 6371", "udp_stream": 84 }, { "frame_number": 6372, "timestamp_epoch": "1723680657.268615000", "display_filter": "frame.number == 6372", "udp_stream": 85 }, { "frame_number": 6373, "timestamp_epoch": "1723680657.315924000", "display_filter": "frame.number == 6373", "udp_stream": 84 }, { "frame_number": 6374, "timestamp_epoch": "1723680657.315929000", "display_filter": "frame.number == 6374", "udp_stream": 85 }, { "frame_number": 6379, "timestamp_epoch": "1723680657.384830000", "display_filter": "frame.number == 6379", "tcp_stream": 111 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-44d826eef0198147d01911ab", "type": "domain", "value": "nav.smartscreen.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723681517.318589000", "last_seen_epoch": "1723681517.499945000", "evidence": [ { "frame_number": 15865, "timestamp_epoch": "1723681517.318589000", "display_filter": "frame.number == 15865", "udp_stream": 139 }, { "frame_number": 15866, "timestamp_epoch": "1723681517.377217000", "display_filter": "frame.number == 15866", "udp_stream": 139 }, { "frame_number": 15870, "timestamp_epoch": "1723681517.499945000", "display_filter": "frame.number == 15870", "tcp_stream": 338 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d8934bcf36bf799e6bac0797", "type": "domain", "value": "ntp.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680646.086019000", "last_seen_epoch": "1723680650.180626000", "evidence": [ { "frame_number": 3654, "timestamp_epoch": "1723680646.086019000", "display_filter": "frame.number == 3654", "udp_stream": 42 }, { "frame_number": 3655, "timestamp_epoch": "1723680646.086144000", "display_filter": "frame.number == 3655", "udp_stream": 43 }, { "frame_number": 3656, "timestamp_epoch": "1723680646.086404000", "display_filter": "frame.number == 3656", "udp_stream": 42 }, { "frame_number": 3657, "timestamp_epoch": "1723680646.093113000", "display_filter": "frame.number == 3657", "udp_stream": 44 }, { "frame_number": 3658, "timestamp_epoch": "1723680646.093457000", "display_filter": "frame.number == 3658", "udp_stream": 44 }, { "frame_number": 5162, "timestamp_epoch": "1723680650.180461000", "display_filter": "frame.number == 5162", "udp_stream": 43 }, { "frame_number": 5164, "timestamp_epoch": "1723680650.180626000", "display_filter": "frame.number == 5164", "udp_stream": 43 }, { "frame_number": 3732, "timestamp_epoch": "1723680647.157232000", "display_filter": "frame.number == 3732", "tcp_stream": 87 }, { "frame_number": 3736, "timestamp_epoch": "1723680647.285461000", "display_filter": "frame.number == 3736", "tcp_stream": 87 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f2553675930f6222b289b9c3", "type": "domain", "value": "odc.officeapps.live.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680613.672233000", "last_seen_epoch": "1723680622.465634000", "evidence": [ { "frame_number": 1491, "timestamp_epoch": "1723680613.672233000", "display_filter": "frame.number == 1491", "udp_stream": 22 }, { "frame_number": 1540, "timestamp_epoch": "1723680613.861164000", "display_filter": "frame.number == 1540", "udp_stream": 22 }, { "frame_number": 2998, "timestamp_epoch": "1723680622.306637000", "display_filter": "frame.number == 2998", "udp_stream": 38 }, { "frame_number": 3000, "timestamp_epoch": "1723680622.357357000", "display_filter": "frame.number == 3000", "udp_stream": 38 }, { "frame_number": 1585, "timestamp_epoch": "1723680613.969136000", "display_filter": "frame.number == 1585", "tcp_stream": 63 }, { "frame_number": 3013, "timestamp_epoch": "1723680622.465634000", "display_filter": "frame.number == 3013", "tcp_stream": 83 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b3557f649641e40d735d9c7b", "type": "domain", "value": "officeclient.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680586.972529000", "last_seen_epoch": "1723680613.362451000", "evidence": [ { "frame_number": 513, "timestamp_epoch": "1723680586.972529000", "display_filter": "frame.number == 513", "udp_stream": 14 }, { "frame_number": 623, "timestamp_epoch": "1723680587.162563000", "display_filter": "frame.number == 623", "udp_stream": 14 }, { "frame_number": 1345, "timestamp_epoch": "1723680613.163355000", "display_filter": "frame.number == 1345", "udp_stream": 22 }, { "frame_number": 1348, "timestamp_epoch": "1723680613.191028000", "display_filter": "frame.number == 1348", "udp_stream": 22 }, { "frame_number": 671, "timestamp_epoch": "1723680587.233268000", "display_filter": "frame.number == 671", "tcp_stream": 32 }, { "frame_number": 1441, "timestamp_epoch": "1723680613.362451000", "display_filter": "frame.number == 1441", "tcp_stream": 61 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-fbbd842d48028e128611fc93", "type": "domain", "value": "oneclient.sfx.ms", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680622.787624000", "last_seen_epoch": "1723681154.958021000", "evidence": [ { "frame_number": 3063, "timestamp_epoch": "1723680622.787624000", "display_filter": "frame.number == 3063", "udp_stream": 22 }, { "frame_number": 3065, "timestamp_epoch": "1723680622.844577000", "display_filter": "frame.number == 3065", "udp_stream": 22 }, { "frame_number": 14524, "timestamp_epoch": "1723681154.855956000", "display_filter": "frame.number == 14524", "udp_stream": 130 }, { "frame_number": 14526, "timestamp_epoch": "1723681154.915494000", "display_filter": "frame.number == 14526", "udp_stream": 130 }, { "frame_number": 14527, "timestamp_epoch": "1723681154.917557000", "display_filter": "frame.number == 14527", "udp_stream": 130 }, { "frame_number": 3073, "timestamp_epoch": "1723680623.071041000", "display_filter": "frame.number == 3073", "tcp_stream": 85 }, { "frame_number": 14531, "timestamp_epoch": "1723681154.958021000", "display_filter": "frame.number == 14531", "tcp_stream": 260 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b40984890de9ec4872127d25", "type": "domain", "value": "oneocsp.microsoft.com", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1723681517.584186000", "last_seen_epoch": "1723681517.670816000", "evidence": [ { "frame_number": 15879, "timestamp_epoch": "1723681517.584186000", "display_filter": "frame.number == 15879", "udp_stream": 139 }, { "frame_number": 15880, "timestamp_epoch": "1723681517.617614000", "display_filter": "frame.number == 15880", "udp_stream": 139 }, { "frame_number": 15884, "timestamp_epoch": "1723681517.670816000", "display_filter": "frame.number == 15884", "tcp_stream": 339 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0c16d52e051b8a600d070b3b", "type": "domain", "value": "ow1.res.office365.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680797.768357000", "last_seen_epoch": "1723680797.856635000", "evidence": [ { "frame_number": 11731, "timestamp_epoch": "1723680797.768357000", "display_filter": "frame.number == 11731", "udp_stream": 99 }, { "frame_number": 11732, "timestamp_epoch": "1723680797.801043000", "display_filter": "frame.number == 11732", "udp_stream": 99 }, { "frame_number": 11736, "timestamp_epoch": "1723680797.856635000", "display_filter": "frame.number == 11736", "tcp_stream": 157 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-97da4440057c1e166ecbc3ea", "type": "domain", "value": "prod.mrodevicemgr.live.com.akadns.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1723680909.294038000", "last_seen_epoch": "1723680909.294038000", "evidence": [ { "frame_number": 12261, "timestamp_epoch": "1723680909.294038000", "display_filter": "frame.number == 12261", "udp_stream": 99 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d2c58cfcfd78bcc372c1be13", "type": "domain", "value": "pti.store.microsoft.com", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1723680987.992265000", "last_seen_epoch": "1723680988.023398000", "evidence": [ { "frame_number": 13828, "timestamp_epoch": "1723680987.992265000", "display_filter": "frame.number == 13828", "udp_stream": 100 }, { "frame_number": 13833, "timestamp_epoch": "1723680988.023398000", "display_filter": "frame.number == 13833", "udp_stream": 100 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0695c6d0a4c2aad3939e813c", "type": "domain", "value": "quote.checkfedexexp.com", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1723680655.252841000", "last_seen_epoch": "1723680658.536866000", "evidence": [ { "frame_number": 6200, "timestamp_epoch": "1723680655.252841000", "display_filter": "frame.number == 6200", "udp_stream": 77 }, { "frame_number": 6201, "timestamp_epoch": "1723680655.253474000", "display_filter": "frame.number == 6201", "udp_stream": 78 }, { "frame_number": 6202, "timestamp_epoch": "1723680655.259919000", "display_filter": "frame.number == 6202", "udp_stream": 79 }, { "frame_number": 6317, "timestamp_epoch": "1723680656.264200000", "display_filter": "frame.number == 6317", "udp_stream": 81 }, { "frame_number": 6318, "timestamp_epoch": "1723680656.264628000", "display_filter": "frame.number == 6318", "udp_stream": 82 }, { "frame_number": 6319, "timestamp_epoch": "1723680656.280145000", "display_filter": "frame.number == 6319", "udp_stream": 83 }, { "frame_number": 6403, "timestamp_epoch": "1723680658.296347000", "display_filter": "frame.number == 6403", "udp_stream": 22 }, { "frame_number": 6404, "timestamp_epoch": "1723680658.485902000", "display_filter": "frame.number == 6404", "udp_stream": 79 }, { "frame_number": 6405, "timestamp_epoch": "1723680658.485954000", "display_filter": "frame.number == 6405", "udp_stream": 81 }, { "frame_number": 6406, "timestamp_epoch": "1723680658.486039000", "display_filter": "frame.number == 6406", "udp_stream": 83 }, { "frame_number": 6407, "timestamp_epoch": "1723680658.486084000", "display_filter": "frame.number == 6407", "udp_stream": 22 }, { "frame_number": 6408, "timestamp_epoch": "1723680658.486173000", "display_filter": "frame.number == 6408", "udp_stream": 77 }, { "frame_number": 6409, "timestamp_epoch": "1723680658.486185000", "display_filter": "frame.number == 6409", "udp_stream": 79 }, { "frame_number": 6412, "timestamp_epoch": "1723680658.527301000", "display_filter": "frame.number == 6412", "udp_stream": 82 }, { "frame_number": 6413, "timestamp_epoch": "1723680658.527356000", "display_filter": "frame.number == 6413", "udp_stream": 78 }, { "frame_number": 6418, "timestamp_epoch": "1723680658.536866000", "display_filter": "frame.number == 6418", "tcp_stream": 112 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-93ec3a9876d2a21df284cb28", "type": "domain", "value": "r-msftstatic-com.a-0016.a-msedge.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1723680649.669924000", "last_seen_epoch": "1723680649.669924000", "evidence": [ { "frame_number": 4772, "timestamp_epoch": "1723680649.669924000", "display_filter": "frame.number == 4772", "udp_stream": 73 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ee6c00c22070ff0cd9cc239a", "type": "domain", "value": "r.bing.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680649.628039000", "last_seen_epoch": "1723680649.780711000", "evidence": [ { "frame_number": 4684, "timestamp_epoch": "1723680649.628039000", "display_filter": "frame.number == 4684", "udp_stream": 70 }, { "frame_number": 4685, "timestamp_epoch": "1723680649.628122000", "display_filter": "frame.number == 4685", "udp_stream": 71 }, { "frame_number": 4774, "timestamp_epoch": "1723680649.671886000", "display_filter": "frame.number == 4774", "udp_stream": 70 }, { "frame_number": 4778, "timestamp_epoch": "1723680649.682080000", "display_filter": "frame.number == 4778", "udp_stream": 71 }, { "frame_number": 4855, "timestamp_epoch": "1723680649.739700000", "display_filter": "frame.number == 4855", "tcp_stream": 102 }, { "frame_number": 4871, "timestamp_epoch": "1723680649.780711000", "display_filter": "frame.number == 4871", "tcp_stream": 103 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-04d1911f6013c289e4d1ca3c", "type": "domain", "value": "r.msftstatic.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680649.628579000", "last_seen_epoch": "1723680649.961673000", "evidence": [ { "frame_number": 4686, "timestamp_epoch": "1723680649.628579000", "display_filter": "frame.number == 4686", "udp_stream": 72 }, { "frame_number": 4687, "timestamp_epoch": "1723680649.628681000", "display_filter": "frame.number == 4687", "udp_stream": 73 }, { "frame_number": 4772, "timestamp_epoch": "1723680649.669924000", "display_filter": "frame.number == 4772", "udp_stream": 73 }, { "frame_number": 4773, "timestamp_epoch": "1723680649.669936000", "display_filter": "frame.number == 4773", "udp_stream": 72 }, { "frame_number": 4864, "timestamp_epoch": "1723680649.765409000", "display_filter": "frame.number == 4864", "tcp_stream": 101 }, { "frame_number": 4951, "timestamp_epoch": "1723680649.813502000", "display_filter": "frame.number == 4951", "tcp_stream": 104 }, { "frame_number": 4986, "timestamp_epoch": "1723680649.895760000", "display_filter": "frame.number == 4986", "tcp_stream": 101 }, { "frame_number": 5083, "timestamp_epoch": "1723680649.961673000", "display_filter": "frame.number == 5083", "tcp_stream": 104 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4cc26afc4bd5b99db35a3490", "type": "domain", "value": "sb.scorecardresearch.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680647.617991000", "last_seen_epoch": "1723680647.822273000", "evidence": [ { "frame_number": 3799, "timestamp_epoch": "1723680647.617991000", "display_filter": "frame.number == 3799", "udp_stream": 49 }, { "frame_number": 3800, "timestamp_epoch": "1723680647.618121000", "display_filter": "frame.number == 3800", "udp_stream": 50 }, { "frame_number": 3815, "timestamp_epoch": "1723680647.652290000", "display_filter": "frame.number == 3815", "udp_stream": 50 }, { "frame_number": 3822, "timestamp_epoch": "1723680647.678854000", "display_filter": "frame.number == 3822", "udp_stream": 49 }, { "frame_number": 3909, "timestamp_epoch": "1723680647.822273000", "display_filter": "frame.number == 3909", "tcp_stream": 96 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-22e283029407181640bea3aa", "type": "domain", "value": "settings-win.data.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680708.820866000", "last_seen_epoch": "1723680990.287103000", "evidence": [ { "frame_number": 10406, "timestamp_epoch": "1723680708.820866000", "display_filter": "frame.number == 10406", "udp_stream": 38 }, { "frame_number": 10409, "timestamp_epoch": "1723680708.899414000", "display_filter": "frame.number == 10409", "udp_stream": 38 }, { "frame_number": 13884, "timestamp_epoch": "1723680989.989230000", "display_filter": "frame.number == 13884", "udp_stream": 125 }, { "frame_number": 13885, "timestamp_epoch": "1723680990.037397000", "display_filter": "frame.number == 13885", "udp_stream": 125 }, { "frame_number": 13886, "timestamp_epoch": "1723680990.182754000", "display_filter": "frame.number == 13886", "udp_stream": 125 }, { "frame_number": 10429, "timestamp_epoch": "1723680708.980841000", "display_filter": "frame.number == 10429", "tcp_stream": 133 }, { "frame_number": 13893, "timestamp_epoch": "1723680990.287103000", "display_filter": "frame.number == 13893", "tcp_stream": 223 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1ef56f13ae5ef3bb79c599ea", "type": "domain", "value": "srtb.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680648.357201000", "last_seen_epoch": "1723680913.074674000", "evidence": [ { "frame_number": 4384, "timestamp_epoch": "1723680648.357201000", "display_filter": "frame.number == 4384", "udp_stream": 66 }, { "frame_number": 4385, "timestamp_epoch": "1723680648.357394000", "display_filter": "frame.number == 4385", "udp_stream": 67 }, { "frame_number": 4386, "timestamp_epoch": "1723680648.357602000", "display_filter": "frame.number == 4386", "udp_stream": 66 }, { "frame_number": 4387, "timestamp_epoch": "1723680648.357606000", "display_filter": "frame.number == 4387", "udp_stream": 67 }, { "frame_number": 12713, "timestamp_epoch": "1723680912.900370000", "display_filter": "frame.number == 12713", "udp_stream": 112 }, { "frame_number": 12714, "timestamp_epoch": "1723680912.900658000", "display_filter": "frame.number == 12714", "udp_stream": 113 }, { "frame_number": 12715, "timestamp_epoch": "1723680912.900953000", "display_filter": "frame.number == 12715", "udp_stream": 112 }, { "frame_number": 12716, "timestamp_epoch": "1723680912.900993000", "display_filter": "frame.number == 12716", "udp_stream": 113 }, { "frame_number": 4483, "timestamp_epoch": "1723680649.064441000", "display_filter": "frame.number == 4483", "tcp_stream": 100 }, { "frame_number": 4489, "timestamp_epoch": "1723680649.193613000", "display_filter": "frame.number == 4489", "tcp_stream": 100 }, { "frame_number": 6306, "timestamp_epoch": "1723680656.244920000", "display_filter": "frame.number == 6306", "tcp_stream": 110 }, { "frame_number": 6338, "timestamp_epoch": "1723680656.355466000", "display_filter": "frame.number == 6338", "tcp_stream": 110 }, { "frame_number": 12722, "timestamp_epoch": "1723680912.962917000", "display_filter": "frame.number == 12722", "tcp_stream": 201 }, { "frame_number": 12733, "timestamp_epoch": "1723680913.074674000", "display_filter": "frame.number == 12733", "tcp_stream": 201 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4b53992095ef1ddc4a0c7fd6", "type": "domain", "value": "storecatalogrevocation.storequality.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723681286.063208000", "last_seen_epoch": "1723681289.668145000", "evidence": [ { "frame_number": 15160, "timestamp_epoch": "1723681286.063208000", "display_filter": "frame.number == 15160", "udp_stream": 134 }, { "frame_number": 15161, "timestamp_epoch": "1723681286.126339000", "display_filter": "frame.number == 15161", "udp_stream": 134 }, { "frame_number": 15164, "timestamp_epoch": "1723681287.132932000", "display_filter": "frame.number == 15164", "udp_stream": 134 }, { "frame_number": 15176, "timestamp_epoch": "1723681289.147160000", "display_filter": "frame.number == 15176", "udp_stream": 134 }, { "frame_number": 15177, "timestamp_epoch": "1723681289.634667000", "display_filter": "frame.number == 15177", "udp_stream": 134 }, { "frame_number": 15181, "timestamp_epoch": "1723681289.668145000", "display_filter": "frame.number == 15181", "tcp_stream": 289 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-75b5aba8159e443fc0488466", "type": "domain", "value": "th.bing.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680613.967415000", "last_seen_epoch": "1723680913.241765000", "evidence": [ { "frame_number": 1584, "timestamp_epoch": "1723680613.967415000", "display_filter": "frame.number == 1584", "udp_stream": 14 }, { "frame_number": 1592, "timestamp_epoch": "1723680614.030530000", "display_filter": "frame.number == 1592", "udp_stream": 14 }, { "frame_number": 3146, "timestamp_epoch": "1723680623.819087000", "display_filter": "frame.number == 3146", "udp_stream": 39 }, { "frame_number": 3147, "timestamp_epoch": "1723680623.819219000", "display_filter": "frame.number == 3147", "udp_stream": 40 }, { "frame_number": 3148, "timestamp_epoch": "1723680623.819458000", "display_filter": "frame.number == 3148", "udp_stream": 39 }, { "frame_number": 3149, "timestamp_epoch": "1723680623.819510000", "display_filter": "frame.number == 3149", "udp_stream": 40 }, { "frame_number": 3801, "timestamp_epoch": "1723680647.618882000", "display_filter": "frame.number == 3801", "udp_stream": 51 }, { "frame_number": 3802, "timestamp_epoch": "1723680647.618976000", "display_filter": "frame.number == 3802", "udp_stream": 52 }, { "frame_number": 3817, "timestamp_epoch": "1723680647.663999000", "display_filter": "frame.number == 3817", "udp_stream": 52 }, { "frame_number": 3821, "timestamp_epoch": "1723680647.678840000", "display_filter": "frame.number == 3821", "udp_stream": 51 }, { "frame_number": 12735, "timestamp_epoch": "1723680913.097542000", "display_filter": "frame.number == 12735", "udp_stream": 114 }, { "frame_number": 12736, "timestamp_epoch": "1723680913.097679000", "display_filter": "frame.number == 12736", "udp_stream": 115 }, { "frame_number": 12745, "timestamp_epoch": "1723680913.142890000", "display_filter": "frame.number == 12745", "udp_stream": 114 }, { "frame_number": 12749, "timestamp_epoch": "1723680913.162609000", "display_filter": "frame.number == 12749", "udp_stream": 115 }, { "frame_number": 1615, "timestamp_epoch": "1723680614.062603000", "display_filter": "frame.number == 1615", "tcp_stream": 65 }, { "frame_number": 1627, "timestamp_epoch": "1723680614.071134000", "display_filter": "frame.number == 1627", "tcp_stream": 69 }, { "frame_number": 1629, "timestamp_epoch": "1723680614.072320000", "display_filter": "frame.number == 1629", "tcp_stream": 67 }, { "frame_number": 1633, "timestamp_epoch": "1723680614.073430000", "display_filter": "frame.number == 1633", "tcp_stream": 68 }, { "frame_number": 1635, "timestamp_epoch": "1723680614.074372000", "display_filter": "frame.number == 1635", "tcp_stream": 66 }, { "frame_number": 1637, "timestamp_epoch": "1723680614.075259000", "display_filter": "frame.number == 1637", "tcp_stream": 70 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-bd49ccfb6c0f375601b98819", "type": "domain", "value": "v10.events.data.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680752.995003000", "last_seen_epoch": "1723681909.618984000", "evidence": [ { "frame_number": 10904, "timestamp_epoch": "1723680752.995003000", "display_filter": "frame.number == 10904", "udp_stream": 38 }, { "frame_number": 10905, "timestamp_epoch": "1723680753.042487000", "display_filter": "frame.number == 10905", "udp_stream": 38 }, { "frame_number": 14085, "timestamp_epoch": "1723680998.875866000", "display_filter": "frame.number == 14085", "udp_stream": 127 }, { "frame_number": 14086, "timestamp_epoch": "1723680998.928817000", "display_filter": "frame.number == 14086", "udp_stream": 127 }, { "frame_number": 14088, "timestamp_epoch": "1723680999.929164000", "display_filter": "frame.number == 14088", "udp_stream": 127 }, { "frame_number": 14097, "timestamp_epoch": "1723681001.929216000", "display_filter": "frame.number == 14097", "udp_stream": 127 }, { "frame_number": 14098, "timestamp_epoch": "1723681003.136912000", "display_filter": "frame.number == 14098", "udp_stream": 127 }, { "frame_number": 14144, "timestamp_epoch": "1723681007.156999000", "display_filter": "frame.number == 14144", "udp_stream": 128 }, { "frame_number": 14145, "timestamp_epoch": "1723681007.203647000", "display_filter": "frame.number == 14145", "udp_stream": 128 }, { "frame_number": 14914, "timestamp_epoch": "1723681207.008309000", "display_filter": "frame.number == 14914", "udp_stream": 131 }, { "frame_number": 14915, "timestamp_epoch": "1723681207.056999000", "display_filter": "frame.number == 14915", "udp_stream": 131 }, { "frame_number": 14917, "timestamp_epoch": "1723681208.072665000", "display_filter": "frame.number == 14917", "udp_stream": 131 }, { "frame_number": 14927, "timestamp_epoch": "1723681209.832030000", "display_filter": "frame.number == 14927", "udp_stream": 131 }, { "frame_number": 15274, "timestamp_epoch": "1723681312.748430000", "display_filter": "frame.number == 15274", "udp_stream": 135 }, { "frame_number": 15275, "timestamp_epoch": "1723681312.791282000", "display_filter": "frame.number == 15275", "udp_stream": 135 }, { "frame_number": 16265, "timestamp_epoch": "1723681669.530149000", "display_filter": "frame.number == 16265", "udp_stream": 142 }, { "frame_number": 16266, "timestamp_epoch": "1723681669.591009000", "display_filter": "frame.number == 16266", "udp_stream": 142 }, { "frame_number": 16267, "timestamp_epoch": "1723681670.591287000", "display_filter": "frame.number == 16267", "udp_stream": 142 }, { "frame_number": 16279, "timestamp_epoch": "1723681672.605396000", "display_filter": "frame.number == 16279", "udp_stream": 142 }, { "frame_number": 16280, "timestamp_epoch": "1723681672.618317000", "display_filter": "frame.number == 16280", "udp_stream": 142 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4b67e14e87063ee8d88006f5", "type": "domain", "value": "v20.events.data.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680609.647203000", "last_seen_epoch": "1723680753.503071000", "evidence": [ { "frame_number": 1192, "timestamp_epoch": "1723680609.647203000", "display_filter": "frame.number == 1192", "udp_stream": 14 }, { "frame_number": 1194, "timestamp_epoch": "1723680609.679431000", "display_filter": "frame.number == 1194", "udp_stream": 14 }, { "frame_number": 10937, "timestamp_epoch": "1723680753.377987000", "display_filter": "frame.number == 10937", "udp_stream": 38 }, { "frame_number": 10939, "timestamp_epoch": "1723680753.424669000", "display_filter": "frame.number == 10939", "udp_stream": 38 }, { "frame_number": 1217, "timestamp_epoch": "1723680609.858336000", "display_filter": "frame.number == 1217", "tcp_stream": 56 }, { "frame_number": 10943, "timestamp_epoch": "1723680753.503071000", "display_filter": "frame.number == 10943", "tcp_stream": 141 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d578bd209a6916224c5dfe2b", "type": "domain", "value": "weathermapdata.blob.core.windows.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680857.693121000", "last_seen_epoch": "1723680857.925217000", "evidence": [ { "frame_number": 12102, "timestamp_epoch": "1723680857.693121000", "display_filter": "frame.number == 12102", "udp_stream": 99 }, { "frame_number": 12103, "timestamp_epoch": "1723680857.763655000", "display_filter": "frame.number == 12103", "udp_stream": 99 }, { "frame_number": 12107, "timestamp_epoch": "1723680857.844217000", "display_filter": "frame.number == 12107", "tcp_stream": 175 }, { "frame_number": 12111, "timestamp_epoch": "1723680857.925217000", "display_filter": "frame.number == 12111", "tcp_stream": 175 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1c403dfc0d3c331ae7b2b46e", "type": "domain", "value": "win-jegjix7q9rs.lafontainebleu.org", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1723680584.185334000", "last_seen_epoch": "1723680586.702046000", "evidence": [ { "frame_number": 22, "timestamp_epoch": "1723680584.185334000", "display_filter": "frame.number == 22", "udp_stream": 4 }, { "frame_number": 23, "timestamp_epoch": "1723680584.185623000", "display_filter": "frame.number == 23", "udp_stream": 4 }, { "frame_number": 472, "timestamp_epoch": "1723680586.701803000", "display_filter": "frame.number == 472", "udp_stream": 14 }, { "frame_number": 473, "timestamp_epoch": "1723680586.702046000", "display_filter": "frame.number == 473", "udp_stream": 14 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-913f287501a0562b72e8e23d", "type": "domain", "value": "windows.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680613.588748000", "last_seen_epoch": "1723681810.744481000", "evidence": [ { "frame_number": 1484, "timestamp_epoch": "1723680613.588748000", "display_filter": "frame.number == 1484", "udp_stream": 14 }, { "frame_number": 1485, "timestamp_epoch": "1723680613.622537000", "display_filter": "frame.number == 1485", "udp_stream": 14 }, { "frame_number": 12411, "timestamp_epoch": "1723680911.070171000", "display_filter": "frame.number == 12411", "udp_stream": 100 }, { "frame_number": 12416, "timestamp_epoch": "1723680911.073896000", "display_filter": "frame.number == 12416", "udp_stream": 104 }, { "frame_number": 12417, "timestamp_epoch": "1723680911.074019000", "display_filter": "frame.number == 12417", "udp_stream": 105 }, { "frame_number": 12419, "timestamp_epoch": "1723680911.102840000", "display_filter": "frame.number == 12419", "udp_stream": 104 }, { "frame_number": 12420, "timestamp_epoch": "1723680911.102883000", "display_filter": "frame.number == 12420", "udp_stream": 100 }, { "frame_number": 12427, "timestamp_epoch": "1723680911.152944000", "display_filter": "frame.number == 12427", "udp_stream": 105 }, { "frame_number": 12428, "timestamp_epoch": "1723680911.153097000", "display_filter": "frame.number == 12428", "udp_stream": 105 }, { "frame_number": 1494, "timestamp_epoch": "1723680613.709107000", "display_filter": "frame.number == 1494", "tcp_stream": 62 }, { "frame_number": 1510, "timestamp_epoch": "1723680613.768959000", "display_filter": "frame.number == 1510", "tcp_stream": 62 }, { "frame_number": 12436, "timestamp_epoch": "1723680911.245372000", "display_filter": "frame.number == 12436", "tcp_stream": 193 }, { "frame_number": 12440, "timestamp_epoch": "1723680911.245835000", "display_filter": "frame.number == 12440", "tcp_stream": 194 }, { "frame_number": 12465, "timestamp_epoch": "1723680911.367043000", "display_filter": "frame.number == 12465", "tcp_stream": 193 }, { "frame_number": 12467, "timestamp_epoch": "1723680911.367720000", "display_filter": "frame.number == 12467", "tcp_stream": 194 }, { "frame_number": 16578, "timestamp_epoch": "1723681810.679494000", "display_filter": "frame.number == 16578", "tcp_stream": 396 }, { "frame_number": 16582, "timestamp_epoch": "1723681810.744481000", "display_filter": "frame.number == 16582", "tcp_stream": 396 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-70d3d0ec34f01efda30dbb3f", "type": "domain", "value": "wns.notify.trafficmanager.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1723680610.587785000", "last_seen_epoch": "1723680610.587785000", "evidence": [ { "frame_number": 1241, "timestamp_epoch": "1723680610.587785000", "display_filter": "frame.number == 1241", "udp_stream": 14 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-eeb03df4311330d1de1f8ee4", "type": "domain", "value": "wpad.lafontainebleu.org", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1723680584.978235000", "last_seen_epoch": "1723682460.256763000", "evidence": [ { "frame_number": 55, "timestamp_epoch": "1723680584.978235000", "display_filter": "frame.number == 55", "udp_stream": 9 }, { "frame_number": 56, "timestamp_epoch": "1723680584.978533000", "display_filter": "frame.number == 56", "udp_stream": 9 }, { "frame_number": 59, "timestamp_epoch": "1723680584.996099000", "display_filter": "frame.number == 59", "udp_stream": 10 }, { "frame_number": 60, "timestamp_epoch": "1723680584.996370000", "display_filter": "frame.number == 60", "udp_stream": 10 }, { "frame_number": 961, "timestamp_epoch": "1723680599.997113000", "display_filter": "frame.number == 961", "udp_stream": 14 }, { "frame_number": 962, "timestamp_epoch": "1723680599.997451000", "display_filter": "frame.number == 962", "udp_stream": 14 }, { "frame_number": 963, "timestamp_epoch": "1723680600.043877000", "display_filter": "frame.number == 963", "udp_stream": 20 }, { "frame_number": 964, "timestamp_epoch": "1723680600.044261000", "display_filter": "frame.number == 964", "udp_stream": 20 }, { "frame_number": 2105, "timestamp_epoch": "1723680618.771992000", "display_filter": "frame.number == 2105", "udp_stream": 22 }, { "frame_number": 2106, "timestamp_epoch": "1723680618.772193000", "display_filter": "frame.number == 2106", "udp_stream": 22 }, { "frame_number": 3575, "timestamp_epoch": "1723680626.785346000", "display_filter": "frame.number == 3575", "udp_stream": 14 }, { "frame_number": 3576, "timestamp_epoch": "1723680626.785646000", "display_filter": "frame.number == 3576", "udp_stream": 14 }, { "frame_number": 6438, "timestamp_epoch": "1723680660.000064000", "display_filter": "frame.number == 6438", "udp_stream": 38 }, { "frame_number": 6439, "timestamp_epoch": "1723680660.000329000", "display_filter": "frame.number == 6439", "udp_stream": 38 }, { "frame_number": 6440, "timestamp_epoch": "1723680660.047727000", "display_filter": "frame.number == 6440", "udp_stream": 20 }, { "frame_number": 6441, "timestamp_epoch": "1723680660.047965000", "display_filter": "frame.number == 6441", "udp_stream": 20 }, { "frame_number": 6458, "timestamp_epoch": "1723680661.691806000", "display_filter": "frame.number == 6458", "udp_stream": 14 }, { "frame_number": 6459, "timestamp_epoch": "1723680661.692095000", "display_filter": "frame.number == 6459", "udp_stream": 14 }, { "frame_number": 12208, "timestamp_epoch": "1723680895.684241000", "display_filter": "frame.number == 12208", "udp_stream": 100 }, { "frame_number": 12209, "timestamp_epoch": "1723680895.684574000", "display_filter": "frame.number == 12209", "udp_stream": 100 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a21b26dc30630be176568534", "type": "domain", "value": "www.bing.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680609.315786000", "last_seen_epoch": "1723680913.536517000", "evidence": [ { "frame_number": 1158, "timestamp_epoch": "1723680609.315786000", "display_filter": "frame.number == 1158", "udp_stream": 14 }, { "frame_number": 1160, "timestamp_epoch": "1723680609.378919000", "display_filter": "frame.number == 1160", "udp_stream": 14 }, { "frame_number": 2110, "timestamp_epoch": "1723680618.967730000", "display_filter": "frame.number == 2110", "udp_stream": 26 }, { "frame_number": 2111, "timestamp_epoch": "1723680618.967976000", "display_filter": "frame.number == 2111", "udp_stream": 27 }, { "frame_number": 2112, "timestamp_epoch": "1723680618.968040000", "display_filter": "frame.number == 2112", "udp_stream": 26 }, { "frame_number": 2114, "timestamp_epoch": "1723680619.000574000", "display_filter": "frame.number == 2114", "udp_stream": 27 }, { "frame_number": 2116, "timestamp_epoch": "1723680619.000733000", "display_filter": "frame.number == 2116", "udp_stream": 27 }, { "frame_number": 3818, "timestamp_epoch": "1723680647.664993000", "display_filter": "frame.number == 3818", "udp_stream": 55 }, { "frame_number": 3819, "timestamp_epoch": "1723680647.665107000", "display_filter": "frame.number == 3819", "udp_stream": 56 }, { "frame_number": 3820, "timestamp_epoch": "1723680647.665273000", "display_filter": "frame.number == 3820", "udp_stream": 56 }, { "frame_number": 3831, "timestamp_epoch": "1723680647.704145000", "display_filter": "frame.number == 3831", "udp_stream": 55 }, { "frame_number": 11901, "timestamp_epoch": "1723680802.768051000", "display_filter": "frame.number == 11901", "udp_stream": 100 }, { "frame_number": 11904, "timestamp_epoch": "1723680802.830048000", "display_filter": "frame.number == 11904", "udp_stream": 100 }, { "frame_number": 13245, "timestamp_epoch": "1723680913.479286000", "display_filter": "frame.number == 13245", "udp_stream": 121 }, { "frame_number": 13246, "timestamp_epoch": "1723680913.479440000", "display_filter": "frame.number == 13246", "udp_stream": 122 }, { "frame_number": 13255, "timestamp_epoch": "1723680913.536302000", "display_filter": "frame.number == 13255", "udp_stream": 122 }, { "frame_number": 13256, "timestamp_epoch": "1723680913.536517000", "display_filter": "frame.number == 13256", "udp_stream": 121 }, { "frame_number": 1164, "timestamp_epoch": "1723680609.434827000", "display_filter": "frame.number == 1164", "tcp_stream": 54 }, { "frame_number": 1333, "timestamp_epoch": "1723680613.103739000", "display_filter": "frame.number == 1333", "tcp_stream": 60 }, { "frame_number": 2121, "timestamp_epoch": "1723680619.036309000", "display_filter": "frame.number == 2121", "tcp_stream": 72 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-97dac6aa27c2e52db0cd3e67", "type": "domain", "value": "www.msftconnecttest.com", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1723680585.022161000", "last_seen_epoch": "1723680585.124763000", "evidence": [ { "frame_number": 61, "timestamp_epoch": "1723680585.022161000", "display_filter": "frame.number == 61", "udp_stream": 10 }, { "frame_number": 62, "timestamp_epoch": "1723680585.064601000", "display_filter": "frame.number == 62", "udp_stream": 10 }, { "frame_number": 66, "timestamp_epoch": "1723680585.124763000", "display_filter": "frame.number == 66", "tcp_stream": 2 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e1f672123d7df39db96c0073", "type": "domain", "value": "www.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1723680614.023363000", "last_seen_epoch": "1723680911.963703000", "evidence": [ { "frame_number": 1589, "timestamp_epoch": "1723680614.023363000", "display_filter": "frame.number == 1589", "udp_stream": 22 }, { "frame_number": 1590, "timestamp_epoch": "1723680614.023628000", "display_filter": "frame.number == 1590", "udp_stream": 22 }, { "frame_number": 12534, "timestamp_epoch": "1723680911.786577000", "display_filter": "frame.number == 12534", "udp_stream": 106 }, { "frame_number": 12535, "timestamp_epoch": "1723680911.786702000", "display_filter": "frame.number == 12535", "udp_stream": 107 }, { "frame_number": 12536, "timestamp_epoch": "1723680911.786884000", "display_filter": "frame.number == 12536", "udp_stream": 106 }, { "frame_number": 12537, "timestamp_epoch": "1723680911.786888000", "display_filter": "frame.number == 12537", "udp_stream": 107 }, { "frame_number": 1639, "timestamp_epoch": "1723680614.076070000", "display_filter": "frame.number == 1639", "tcp_stream": 64 }, { "frame_number": 1807, "timestamp_epoch": "1723680614.147548000", "display_filter": "frame.number == 1807", "tcp_stream": 64 }, { "frame_number": 12542, "timestamp_epoch": "1723680911.842842000", "display_filter": "frame.number == 12542", "tcp_stream": 198 }, { "frame_number": 12546, "timestamp_epoch": "1723680911.963703000", "display_filter": "frame.number == 12546", "tcp_stream": 198 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c3ad89a4f897130c5fa6d1ad", "type": "ipv4", "value": "0.0.0.0", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-59a9102383e40368af5ff57b", "type": "ipv4", "value": "10.8.15.133", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-b2c1abbe0b5a09d8148ffcba", "type": "ipv4", "value": "10.8.15.255", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-2daf60c62bc96cd3a89c02fe", "type": "ipv4", "value": "10.8.15.4", "roles": [ "dns-answer", "network-endpoint" ], "is_private": true, "first_seen_epoch": "1723680584.163446000", "last_seen_epoch": "1723680984.804064000", "evidence": [ { "frame_number": 21, "timestamp_epoch": "1723680584.163446000", "display_filter": "frame.number == 21", "udp_stream": 4 }, { "frame_number": 23, "timestamp_epoch": "1723680584.185623000", "display_filter": "frame.number == 23", "udp_stream": 4 }, { "frame_number": 33, "timestamp_epoch": "1723680584.314689000", "display_filter": "frame.number == 33", "udp_stream": 4 }, { "frame_number": 111, "timestamp_epoch": "1723680585.919506000", "display_filter": "frame.number == 111", "udp_stream": 9 }, { "frame_number": 115, "timestamp_epoch": "1723680585.950206000", "display_filter": "frame.number == 115", "udp_stream": 9 }, { "frame_number": 125, "timestamp_epoch": "1723680585.976431000", "display_filter": "frame.number == 125", "udp_stream": 9 }, { "frame_number": 319, "timestamp_epoch": "1723680586.189773000", "display_filter": "frame.number == 319", "udp_stream": 9 }, { "frame_number": 372, "timestamp_epoch": "1723680586.334885000", "display_filter": "frame.number == 372", "udp_stream": 9 }, { "frame_number": 438, "timestamp_epoch": "1723680586.460882000", "display_filter": "frame.number == 438", "udp_stream": 14 }, { "frame_number": 473, "timestamp_epoch": "1723680586.702046000", "display_filter": "frame.number == 473", "udp_stream": 14 }, { "frame_number": 756, "timestamp_epoch": "1723680588.921441000", "display_filter": "frame.number == 756", "udp_stream": 14 }, { "frame_number": 8752, "timestamp_epoch": "1723680669.038090000", "display_filter": "frame.number == 8752", "udp_stream": 38 }, { "frame_number": 13662, "timestamp_epoch": "1723680984.804064000", "display_filter": "frame.number == 13662", "udp_stream": 100 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a1ed7d17defaff8d5da995a8", "type": "ipv4", "value": "104.21.55.70", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680658.485902000", "last_seen_epoch": "1723680684.025067000", "evidence": [ { "frame_number": 6404, "timestamp_epoch": "1723680658.485902000", "display_filter": "frame.number == 6404", "udp_stream": 79 }, { "frame_number": 6405, "timestamp_epoch": "1723680658.485954000", "display_filter": "frame.number == 6405", "udp_stream": 81 }, { "frame_number": 6406, "timestamp_epoch": "1723680658.486039000", "display_filter": "frame.number == 6406", "udp_stream": 83 }, { "frame_number": 6407, "timestamp_epoch": "1723680658.486084000", "display_filter": "frame.number == 6407", "udp_stream": 22 }, { "frame_number": 6408, "timestamp_epoch": "1723680658.486173000", "display_filter": "frame.number == 6408", "udp_stream": 77 }, { "frame_number": 6409, "timestamp_epoch": "1723680658.486185000", "display_filter": "frame.number == 6409", "udp_stream": 79 }, { "frame_number": 9027, "timestamp_epoch": "1723680684.025067000", "display_filter": "frame.number == 9027", "udp_stream": 38 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b222dea8e3f9f79d7d15ba35", "type": "ipv4", "value": "104.40.82.182", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680668.316350000", "last_seen_epoch": "1723680668.316350000", "evidence": [ { "frame_number": 8719, "timestamp_epoch": "1723680668.316350000", "display_filter": "frame.number == 8719", "udp_stream": 22 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-83bb66a881217606504597d3", "type": "ipv4", "value": "13.107.21.237", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680647.712660000", "last_seen_epoch": "1723680647.712660000", "evidence": [ { "frame_number": 3836, "timestamp_epoch": "1723680647.712660000", "display_filter": "frame.number == 3836", "udp_stream": 59 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ddc5d0d03f5808c532432f9b", "type": "ipv4", "value": "13.107.21.239", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680619.000623000", "last_seen_epoch": "1723680895.742669000", "evidence": [ { "frame_number": 2115, "timestamp_epoch": "1723680619.000623000", "display_filter": "frame.number == 2115", "udp_stream": 24 }, { "frame_number": 2282, "timestamp_epoch": "1723680619.360829000", "display_filter": "frame.number == 2282", "udp_stream": 28 }, { "frame_number": 10245, "timestamp_epoch": "1723680693.831947000", "display_filter": "frame.number == 10245", "udp_stream": 96 }, { "frame_number": 12210, "timestamp_epoch": "1723680895.742669000", "display_filter": "frame.number == 12210", "udp_stream": 102 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9b4542285b13424016b43caf", "type": "ipv4", "value": "13.107.246.57", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680648.443397000", "last_seen_epoch": "1723680648.443397000", "evidence": [ { "frame_number": 4404, "timestamp_epoch": "1723680648.443397000", "display_filter": "frame.number == 4404", "udp_stream": 68 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3799ea4d636ae20990ea3bc9", "type": "ipv4", "value": "13.107.4.254", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680798.271398000", "last_seen_epoch": "1723680798.271398000", "evidence": [ { "frame_number": 11764, "timestamp_epoch": "1723680798.271398000", "display_filter": "frame.number == 11764", "udp_stream": 99 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c0b9f5e873d0e4692a14e549", "type": "ipv4", "value": "13.107.5.93", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680626.079863000", "last_seen_epoch": "1723680626.079863000", "evidence": [ { "frame_number": 3542, "timestamp_epoch": "1723680626.079863000", "display_filter": "frame.number == 3542", "udp_stream": 38 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-56c5f99cb8a868fdad4e0798", "type": "ipv4", "value": "13.107.6.158", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680646.404859000", "last_seen_epoch": "1723680646.404859000", "evidence": [ { "frame_number": 3664, "timestamp_epoch": "1723680646.404859000", "display_filter": "frame.number == 3664", "udp_stream": 45 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-69f1874359892dcf7a7f2056", "type": "ipv4", "value": "13.70.79.200", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723682392.121072000", "last_seen_epoch": "1723682392.121072000", "evidence": [ { "frame_number": 17806, "timestamp_epoch": "1723682392.121072000", "display_filter": "frame.number == 17806", "udp_stream": 151 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-633713242b0df99baf9c83a7", "type": "ipv4", "value": "13.85.23.206", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680990.284320000", "last_seen_epoch": "1723680990.284320000", "evidence": [ { "frame_number": 13892, "timestamp_epoch": "1723680990.284320000", "display_filter": "frame.number == 13892", "udp_stream": 126 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3a0d8cc6e2e59934d305c26f", "type": "ipv4", "value": "13.89.179.13", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680588.065143000", "last_seen_epoch": "1723680591.535872000", "evidence": [ { "frame_number": 728, "timestamp_epoch": "1723680588.065143000", "display_filter": "frame.number == 728", "udp_stream": 14 }, { "frame_number": 843, "timestamp_epoch": "1723680591.535872000", "display_filter": "frame.number == 843", "udp_stream": 14 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d01e18acf34a7126437debe3", "type": "ipv4", "value": "172.67.170.159", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680658.485902000", "last_seen_epoch": "1723680684.025067000", "evidence": [ { "frame_number": 6404, "timestamp_epoch": "1723680658.485902000", "display_filter": "frame.number == 6404", "udp_stream": 79 }, { "frame_number": 6405, "timestamp_epoch": "1723680658.485954000", "display_filter": "frame.number == 6405", "udp_stream": 81 }, { "frame_number": 6406, "timestamp_epoch": "1723680658.486039000", "display_filter": "frame.number == 6406", "udp_stream": 83 }, { "frame_number": 6407, "timestamp_epoch": "1723680658.486084000", "display_filter": "frame.number == 6407", "udp_stream": 22 }, { "frame_number": 6408, "timestamp_epoch": "1723680658.486173000", "display_filter": "frame.number == 6408", "udp_stream": 77 }, { "frame_number": 6409, "timestamp_epoch": "1723680658.486185000", "display_filter": "frame.number == 6409", "udp_stream": 79 }, { "frame_number": 9027, "timestamp_epoch": "1723680684.025067000", "display_filter": "frame.number == 9027", "udp_stream": 38 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f20467d36bfc43af2f73cb52", "type": "ipv4", "value": "18.160.156.115", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680647.678854000", "last_seen_epoch": "1723680647.678854000", "evidence": [ { "frame_number": 3822, "timestamp_epoch": "1723680647.678854000", "display_filter": "frame.number == 3822", "udp_stream": 49 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-60c8086599353fc2d4d69e2d", "type": "ipv4", "value": "18.160.156.14", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680647.678854000", "last_seen_epoch": "1723680647.678854000", "evidence": [ { "frame_number": 3822, "timestamp_epoch": "1723680647.678854000", "display_filter": "frame.number == 3822", "udp_stream": 49 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a49a8cc9091551d75e31683b", "type": "ipv4", "value": "18.160.156.41", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680647.678854000", "last_seen_epoch": "1723680647.678854000", "evidence": [ { "frame_number": 3822, "timestamp_epoch": "1723680647.678854000", "display_filter": "frame.number == 3822", "udp_stream": 49 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-850a061b28cf270814dd513e", "type": "ipv4", "value": "18.160.156.89", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680647.678854000", "last_seen_epoch": "1723680647.678854000", "evidence": [ { "frame_number": 3822, "timestamp_epoch": "1723680647.678854000", "display_filter": "frame.number == 3822", "udp_stream": 49 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-760d2e905dbcd763cf63ff79", "type": "ipv4", "value": "199.232.210.172", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680685.765017000", "last_seen_epoch": "1723680706.544699000", "evidence": [ { "frame_number": 10194, "timestamp_epoch": "1723680685.765017000", "display_filter": "frame.number == 10194", "udp_stream": 38 }, { "frame_number": 10283, "timestamp_epoch": "1723680706.544699000", "display_filter": "frame.number == 10283", "udp_stream": 38 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-837bab65ae2713645e927dee", "type": "ipv4", "value": "199.232.214.172", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680685.765017000", "last_seen_epoch": "1723680706.544699000", "evidence": [ { "frame_number": 10194, "timestamp_epoch": "1723680685.765017000", "display_filter": "frame.number == 10194", "udp_stream": 38 }, { "frame_number": 10283, "timestamp_epoch": "1723680706.544699000", "display_filter": "frame.number == 10283", "udp_stream": 38 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-01a8f61bed73af3e1d5ee079", "type": "ipv4", "value": "20.10.31.115", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680610.587785000", "last_seen_epoch": "1723680610.587785000", "evidence": [ { "frame_number": 1241, "timestamp_epoch": "1723680610.587785000", "display_filter": "frame.number == 1241", "udp_stream": 14 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-acb722885e16bf3f481ed46e", "type": "ipv4", "value": "20.125.209.212", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680647.730583000", "last_seen_epoch": "1723680647.730583000", "evidence": [ { "frame_number": 3838, "timestamp_epoch": "1723680647.730583000", "display_filter": "frame.number == 3838", "udp_stream": 57 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a5304985a74b30f24046eed2", "type": "ipv4", "value": "20.163.45.186", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723681192.120676000", "last_seen_epoch": "1723681192.120676000", "evidence": [ { "frame_number": 14767, "timestamp_epoch": "1723681192.120676000", "display_filter": "frame.number == 14767", "udp_stream": 131 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d3abfa38a74cca02873651af", "type": "ipv4", "value": "20.189.173.9", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723681909.536295000", "last_seen_epoch": "1723681909.536295000", "evidence": [ { "frame_number": 16792, "timestamp_epoch": "1723681909.536295000", "display_filter": "frame.number == 16792", "udp_stream": 145 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-fe85cedfde1287d48f07c4b6", "type": "ipv4", "value": "20.190.157.9", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680619.207937000", "last_seen_epoch": "1723680987.962385000", "evidence": [ { "frame_number": 2245, "timestamp_epoch": "1723680619.207937000", "display_filter": "frame.number == 2245", "udp_stream": 14 }, { "frame_number": 10380, "timestamp_epoch": "1723680708.002327000", "display_filter": "frame.number == 10380", "udp_stream": 38 }, { "frame_number": 13826, "timestamp_epoch": "1723680987.962385000", "display_filter": "frame.number == 13826", "udp_stream": 100 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-fdd893229159079d114c170c", "type": "ipv4", "value": "20.241.44.114", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680622.344915000", "last_seen_epoch": "1723681154.477536000", "evidence": [ { "frame_number": 2999, "timestamp_epoch": "1723680622.344915000", "display_filter": "frame.number == 2999", "udp_stream": 22 }, { "frame_number": 14499, "timestamp_epoch": "1723681154.477536000", "display_filter": "frame.number == 14499", "udp_stream": 128 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5f799ca70090182328f4a65f", "type": "ipv4", "value": "20.25.227.174", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680657.315924000", "last_seen_epoch": "1723681517.377217000", "evidence": [ { "frame_number": 6373, "timestamp_epoch": "1723680657.315924000", "display_filter": "frame.number == 6373", "udp_stream": 84 }, { "frame_number": 6476, "timestamp_epoch": "1723680663.104422000", "display_filter": "frame.number == 6476", "udp_stream": 86 }, { "frame_number": 15866, "timestamp_epoch": "1723681517.377217000", "display_filter": "frame.number == 15866", "udp_stream": 139 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7caad296ff52b96572aa37a6", "type": "ipv4", "value": "20.3.0.251", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723681282.519199000", "last_seen_epoch": "1723681282.519199000", "evidence": [ { "frame_number": 15107, "timestamp_epoch": "1723681282.519199000", "display_filter": "frame.number == 15107", "udp_stream": 133 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ff6f813333f7bcf8829347ce", "type": "ipv4", "value": "20.42.65.88", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723681312.791282000", "last_seen_epoch": "1723681312.791282000", "evidence": [ { "frame_number": 15275, "timestamp_epoch": "1723681312.791282000", "display_filter": "frame.number == 15275", "udp_stream": 135 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7c75a942abbb34d59727903f", "type": "ipv4", "value": "20.42.65.94", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723681003.136912000", "last_seen_epoch": "1723681007.203647000", "evidence": [ { "frame_number": 14098, "timestamp_epoch": "1723681003.136912000", "display_filter": "frame.number == 14098", "udp_stream": 127 }, { "frame_number": 14145, "timestamp_epoch": "1723681007.203647000", "display_filter": "frame.number == 14145", "udp_stream": 128 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-55b1381f94840b3b66903702", "type": "ipv4", "value": "20.42.72.131", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680647.679002000", "last_seen_epoch": "1723680647.679002000", "evidence": [ { "frame_number": 3823, "timestamp_epoch": "1723680647.679002000", "display_filter": "frame.number == 3823", "udp_stream": 53 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0381a95a3fdeaf0fbc5bc01b", "type": "ipv4", "value": "20.44.10.122", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723681209.832030000", "last_seen_epoch": "1723681209.832030000", "evidence": [ { "frame_number": 14927, "timestamp_epoch": "1723681209.832030000", "display_filter": "frame.number == 14927", "udp_stream": 131 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-347ab94d4e8d2152c055a9d1", "type": "ipv4", "value": "20.60.228.1", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680857.763655000", "last_seen_epoch": "1723680857.763655000", "evidence": [ { "frame_number": 12103, "timestamp_epoch": "1723680857.763655000", "display_filter": "frame.number == 12103", "udp_stream": 99 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-db159577d4c1a13ae37fcf0a", "type": "ipv4", "value": "20.96.153.111", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680610.587790000", "last_seen_epoch": "1723681540.736897000", "evidence": [ { "frame_number": 1242, "timestamp_epoch": "1723680610.587790000", "display_filter": "frame.number == 1242", "udp_stream": 22 }, { "frame_number": 15989, "timestamp_epoch": "1723681540.736897000", "display_filter": "frame.number == 15989", "udp_stream": 139 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6af10bf4728d4c8d9cd52550", "type": "ipv4", "value": "20.99.184.37", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680988.363063000", "last_seen_epoch": "1723680988.363063000", "evidence": [ { "frame_number": 13850, "timestamp_epoch": "1723680988.363063000", "display_filter": "frame.number == 13850", "udp_stream": 100 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-afdf3702818dc38d4b9ff456", "type": "ipv4", "value": "204.79.197.203", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680613.622537000", "last_seen_epoch": "1723681517.617614000", "evidence": [ { "frame_number": 1485, "timestamp_epoch": "1723680613.622537000", "display_filter": "frame.number == 1485", "udp_stream": 14 }, { "frame_number": 1590, "timestamp_epoch": "1723680614.023628000", "display_filter": "frame.number == 1590", "udp_stream": 22 }, { "frame_number": 3656, "timestamp_epoch": "1723680646.086404000", "display_filter": "frame.number == 3656", "udp_stream": 42 }, { "frame_number": 3658, "timestamp_epoch": "1723680646.093457000", "display_filter": "frame.number == 3658", "udp_stream": 44 }, { "frame_number": 3864, "timestamp_epoch": "1723680647.770709000", "display_filter": "frame.number == 3864", "udp_stream": 63 }, { "frame_number": 4386, "timestamp_epoch": "1723680648.357602000", "display_filter": "frame.number == 4386", "udp_stream": 66 }, { "frame_number": 12419, "timestamp_epoch": "1723680911.102840000", "display_filter": "frame.number == 12419", "udp_stream": 104 }, { "frame_number": 12420, "timestamp_epoch": "1723680911.102883000", "display_filter": "frame.number == 12420", "udp_stream": 100 }, { "frame_number": 12536, "timestamp_epoch": "1723680911.786884000", "display_filter": "frame.number == 12536", "udp_stream": 106 }, { "frame_number": 12588, "timestamp_epoch": "1723680912.303775000", "display_filter": "frame.number == 12588", "udp_stream": 110 }, { "frame_number": 12715, "timestamp_epoch": "1723680912.900953000", "display_filter": "frame.number == 12715", "udp_stream": 112 }, { "frame_number": 15880, "timestamp_epoch": "1723681517.617614000", "display_filter": "frame.number == 15880", "udp_stream": 139 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-cd20b153c74b06b95ac7d30b", "type": "ipv4", "value": "204.79.197.219", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680649.669936000", "last_seen_epoch": "1723680649.669936000", "evidence": [ { "frame_number": 4773, "timestamp_epoch": "1723680649.669936000", "display_filter": "frame.number == 4773", "udp_stream": 72 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1a0c0bb132a3f50252e45b0b", "type": "ipv4", "value": "204.79.197.222", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680798.727364000", "last_seen_epoch": "1723680798.727364000", "evidence": [ { "frame_number": 11802, "timestamp_epoch": "1723680798.727364000", "display_filter": "frame.number == 11802", "udp_stream": 99 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1ab56c64ee3a9c8310ebb83c", "type": "ipv4", "value": "204.79.197.237", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680647.712660000", "last_seen_epoch": "1723680647.712660000", "evidence": [ { "frame_number": 3836, "timestamp_epoch": "1723680647.712660000", "display_filter": "frame.number == 3836", "udp_stream": 59 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3de060bb7a982b4fb953e9a1", "type": "ipv4", "value": "204.79.197.239", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680619.000623000", "last_seen_epoch": "1723680895.742669000", "evidence": [ { "frame_number": 2115, "timestamp_epoch": "1723680619.000623000", "display_filter": "frame.number == 2115", "udp_stream": 24 }, { "frame_number": 2282, "timestamp_epoch": "1723680619.360829000", "display_filter": "frame.number == 2282", "udp_stream": 28 }, { "frame_number": 10245, "timestamp_epoch": "1723680693.831947000", "display_filter": "frame.number == 10245", "udp_stream": 96 }, { "frame_number": 12210, "timestamp_epoch": "1723680895.742669000", "display_filter": "frame.number == 12210", "udp_stream": 102 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-039455c5eaa11225a5ba6670", "type": "ipv4", "value": "224.0.0.22", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-b8a47f5c7ae302a6e0d4f6a5", "type": "ipv4", "value": "224.0.0.251", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-d81dcc9968abba950011a1d4", "type": "ipv4", "value": "224.0.0.252", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-ab2facf6d5bd61592967f189", "type": "ipv4", "value": "23.194.68.140", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723681289.634667000", "last_seen_epoch": "1723681289.634667000", "evidence": [ { "frame_number": 15177, "timestamp_epoch": "1723681289.634667000", "display_filter": "frame.number == 15177", "udp_stream": 134 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-851eb0f3fa8162275a89af89", "type": "ipv4", "value": "23.195.200.230", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680802.828739000", "last_seen_epoch": "1723680802.828739000", "evidence": [ { "frame_number": 11902, "timestamp_epoch": "1723680802.828739000", "display_filter": "frame.number == 11902", "udp_stream": 99 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c0696d619a82e1a9831a8836", "type": "ipv4", "value": "23.205.110.12", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680647.655918000", "last_seen_epoch": "1723680913.153633000", "evidence": [ { "frame_number": 3816, "timestamp_epoch": "1723680647.655918000", "display_filter": "frame.number == 3816", "udp_stream": 47 }, { "frame_number": 12747, "timestamp_epoch": "1723680913.153633000", "display_filter": "frame.number == 12747", "udp_stream": 116 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d918538149dc1994eef0a3e4", "type": "ipv4", "value": "23.205.110.48", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680585.064601000", "last_seen_epoch": "1723680585.064601000", "evidence": [ { "frame_number": 62, "timestamp_epoch": "1723680585.064601000", "display_filter": "frame.number == 62", "udp_stream": 10 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-795fd84cb352386b5c53e752", "type": "ipv4", "value": "23.205.110.59", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680647.655918000", "last_seen_epoch": "1723680913.153633000", "evidence": [ { "frame_number": 3816, "timestamp_epoch": "1723680647.655918000", "display_filter": "frame.number == 3816", "udp_stream": 47 }, { "frame_number": 12747, "timestamp_epoch": "1723680913.153633000", "display_filter": "frame.number == 12747", "udp_stream": 116 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9ab4b48433d32bef435dfbbb", "type": "ipv4", "value": "23.205.110.62", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680585.064601000", "last_seen_epoch": "1723680585.064601000", "evidence": [ { "frame_number": 62, "timestamp_epoch": "1723680585.064601000", "display_filter": "frame.number == 62", "udp_stream": 10 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-93ddf619a44fe2a68eefe48f", "type": "ipv4", "value": "23.215.55.139", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680681.044086000", "last_seen_epoch": "1723680681.044086000", "evidence": [ { "frame_number": 8910, "timestamp_epoch": "1723680681.044086000", "display_filter": "frame.number == 8910", "udp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0ad05a2f88f3b422c0f84c15", "type": "ipv4", "value": "23.215.55.144", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680681.044086000", "last_seen_epoch": "1723680681.044086000", "evidence": [ { "frame_number": 8910, "timestamp_epoch": "1723680681.044086000", "display_filter": "frame.number == 8910", "udp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ab3320dbe32a01987e0fad18", "type": "ipv4", "value": "23.220.103.18", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680609.378919000", "last_seen_epoch": "1723680649.671886000", "evidence": [ { "frame_number": 1160, "timestamp_epoch": "1723680609.378919000", "display_filter": "frame.number == 1160", "udp_stream": 14 }, { "frame_number": 1592, "timestamp_epoch": "1723680614.030530000", "display_filter": "frame.number == 1592", "udp_stream": 14 }, { "frame_number": 2112, "timestamp_epoch": "1723680618.968040000", "display_filter": "frame.number == 2112", "udp_stream": 26 }, { "frame_number": 2316, "timestamp_epoch": "1723680619.725181000", "display_filter": "frame.number == 2316", "udp_stream": 30 }, { "frame_number": 2330, "timestamp_epoch": "1723680619.795182000", "display_filter": "frame.number == 2330", "udp_stream": 32 }, { "frame_number": 2335, "timestamp_epoch": "1723680619.796873000", "display_filter": "frame.number == 2335", "udp_stream": 34 }, { "frame_number": 2400, "timestamp_epoch": "1723680620.447044000", "display_filter": "frame.number == 2400", "udp_stream": 35 }, { "frame_number": 2401, "timestamp_epoch": "1723680620.447047000", "display_filter": "frame.number == 2401", "udp_stream": 36 }, { "frame_number": 3148, "timestamp_epoch": "1723680623.819458000", "display_filter": "frame.number == 3148", "udp_stream": 39 }, { "frame_number": 3821, "timestamp_epoch": "1723680647.678840000", "display_filter": "frame.number == 3821", "udp_stream": 51 }, { "frame_number": 3831, "timestamp_epoch": "1723680647.704145000", "display_filter": "frame.number == 3831", "udp_stream": 55 }, { "frame_number": 4774, "timestamp_epoch": "1723680649.671886000", "display_filter": "frame.number == 4774", "udp_stream": 70 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b14d12134a42e4ab64da5411", "type": "ipv4", "value": "23.220.103.72", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680802.830048000", "last_seen_epoch": "1723680913.536517000", "evidence": [ { "frame_number": 11904, "timestamp_epoch": "1723680802.830048000", "display_filter": "frame.number == 11904", "udp_stream": 100 }, { "frame_number": 12745, "timestamp_epoch": "1723680913.142890000", "display_filter": "frame.number == 12745", "udp_stream": 114 }, { "frame_number": 13256, "timestamp_epoch": "1723680913.536517000", "display_filter": "frame.number == 13256", "udp_stream": 121 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5c2d4038c021a0fe127ee101", "type": "ipv4", "value": "23.220.103.78", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680802.830048000", "last_seen_epoch": "1723680913.536517000", "evidence": [ { "frame_number": 11904, "timestamp_epoch": "1723680802.830048000", "display_filter": "frame.number == 11904", "udp_stream": 100 }, { "frame_number": 12745, "timestamp_epoch": "1723680913.142890000", "display_filter": "frame.number == 12745", "udp_stream": 114 }, { "frame_number": 13256, "timestamp_epoch": "1723680913.536517000", "display_filter": "frame.number == 13256", "udp_stream": 121 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2b492b812d1f680af87f3944", "type": "ipv4", "value": "23.220.103.8", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680609.378919000", "last_seen_epoch": "1723680649.671886000", "evidence": [ { "frame_number": 1160, "timestamp_epoch": "1723680609.378919000", "display_filter": "frame.number == 1160", "udp_stream": 14 }, { "frame_number": 1592, "timestamp_epoch": "1723680614.030530000", "display_filter": "frame.number == 1592", "udp_stream": 14 }, { "frame_number": 2112, "timestamp_epoch": "1723680618.968040000", "display_filter": "frame.number == 2112", "udp_stream": 26 }, { "frame_number": 2316, "timestamp_epoch": "1723680619.725181000", "display_filter": "frame.number == 2316", "udp_stream": 30 }, { "frame_number": 2330, "timestamp_epoch": "1723680619.795182000", "display_filter": "frame.number == 2330", "udp_stream": 32 }, { "frame_number": 2335, "timestamp_epoch": "1723680619.796873000", "display_filter": "frame.number == 2335", "udp_stream": 34 }, { "frame_number": 2400, "timestamp_epoch": "1723680620.447044000", "display_filter": "frame.number == 2400", "udp_stream": 35 }, { "frame_number": 2401, "timestamp_epoch": "1723680620.447047000", "display_filter": "frame.number == 2401", "udp_stream": 36 }, { "frame_number": 3148, "timestamp_epoch": "1723680623.819458000", "display_filter": "frame.number == 3148", "udp_stream": 39 }, { "frame_number": 3821, "timestamp_epoch": "1723680647.678840000", "display_filter": "frame.number == 3821", "udp_stream": 51 }, { "frame_number": 3831, "timestamp_epoch": "1723680647.704145000", "display_filter": "frame.number == 3831", "udp_stream": 55 }, { "frame_number": 4774, "timestamp_epoch": "1723680649.671886000", "display_filter": "frame.number == 4774", "udp_stream": 70 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ef6cc4102f47d7a471b4d79c", "type": "ipv4", "value": "23.220.251.196", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723681329.746257000", "last_seen_epoch": "1723681329.746343000", "evidence": [ { "frame_number": 15340, "timestamp_epoch": "1723681329.746257000", "display_filter": "frame.number == 15340", "udp_stream": 135 }, { "frame_number": 15341, "timestamp_epoch": "1723681329.746343000", "display_filter": "frame.number == 15341", "udp_stream": 135 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c388975a13d126bd6132fc71", "type": "ipv4", "value": "23.220.251.208", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723681329.746257000", "last_seen_epoch": "1723681329.746343000", "evidence": [ { "frame_number": 15340, "timestamp_epoch": "1723681329.746257000", "display_filter": "frame.number == 15340", "udp_stream": 135 }, { "frame_number": 15341, "timestamp_epoch": "1723681329.746343000", "display_filter": "frame.number == 15341", "udp_stream": 135 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2116744bd68270f7b8f044d5", "type": "ipv4", "value": "23.221.36.164", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723681330.035422000", "last_seen_epoch": "1723681330.035422000", "evidence": [ { "frame_number": 15350, "timestamp_epoch": "1723681330.035422000", "display_filter": "frame.number == 15350", "udp_stream": 136 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-bc4d38be390d8973ba418231", "type": "ipv4", "value": "23.223.31.29", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680912.207185000", "last_seen_epoch": "1723680912.207185000", "evidence": [ { "frame_number": 12577, "timestamp_epoch": "1723680912.207185000", "display_filter": "frame.number == 12577", "udp_stream": 108 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-73b6759fe36190639ad295c3", "type": "ipv4", "value": "23.223.31.31", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680912.207185000", "last_seen_epoch": "1723680912.207185000", "evidence": [ { "frame_number": 12577, "timestamp_epoch": "1723680912.207185000", "display_filter": "frame.number == 12577", "udp_stream": 108 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0455c0f24fb2db22001c9356", "type": "ipv4", "value": "23.223.31.32", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680912.207185000", "last_seen_epoch": "1723680912.207185000", "evidence": [ { "frame_number": 12577, "timestamp_epoch": "1723680912.207185000", "display_filter": "frame.number == 12577", "udp_stream": 108 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c3c54be770a65c3ee53ab74a", "type": "ipv4", "value": "23.223.31.33", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680912.207185000", "last_seen_epoch": "1723680912.207185000", "evidence": [ { "frame_number": 12577, "timestamp_epoch": "1723680912.207185000", "display_filter": "frame.number == 12577", "udp_stream": 108 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-05cc20382c42bf02f18e6463", "type": "ipv4", "value": "23.223.31.34", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680912.207185000", "last_seen_epoch": "1723680912.207185000", "evidence": [ { "frame_number": 12577, "timestamp_epoch": "1723680912.207185000", "display_filter": "frame.number == 12577", "udp_stream": 108 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-81676e42d2b066c66109a728", "type": "ipv4", "value": "23.223.31.36", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680912.207185000", "last_seen_epoch": "1723680912.207185000", "evidence": [ { "frame_number": 12577, "timestamp_epoch": "1723680912.207185000", "display_filter": "frame.number == 12577", "udp_stream": 108 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d76a36ea0f89bacd0f64747d", "type": "ipv4", "value": "23.223.31.37", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680912.207185000", "last_seen_epoch": "1723680912.207185000", "evidence": [ { "frame_number": 12577, "timestamp_epoch": "1723680912.207185000", "display_filter": "frame.number == 12577", "udp_stream": 108 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1a32cbe32128f16876152b67", "type": "ipv4", "value": "23.223.31.39", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680912.207185000", "last_seen_epoch": "1723680912.207185000", "evidence": [ { "frame_number": 12577, "timestamp_epoch": "1723680912.207185000", "display_filter": "frame.number == 12577", "udp_stream": 108 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-97e88f1636113b6b83e8a9cc", "type": "ipv4", "value": "23.223.31.40", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680912.207185000", "last_seen_epoch": "1723680912.207185000", "evidence": [ { "frame_number": 12577, "timestamp_epoch": "1723680912.207185000", "display_filter": "frame.number == 12577", "udp_stream": 108 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-30b31d4cde5d82c364fc8a08", "type": "ipv4", "value": "23.33.138.184", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680585.344967000", "last_seen_epoch": "1723680585.344967000", "evidence": [ { "frame_number": 73, "timestamp_epoch": "1723680585.344967000", "display_filter": "frame.number == 73", "udp_stream": 9 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-fe0e9586b346848075091b03", "type": "ipv4", "value": "23.43.244.167", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680650.492145000", "last_seen_epoch": "1723680650.492145000", "evidence": [ { "frame_number": 5450, "timestamp_epoch": "1723680650.492145000", "display_filter": "frame.number == 5450", "udp_stream": 75 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-70719a5eed294289178f6bef", "type": "ipv4", "value": "23.53.13.196", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680682.288508000", "last_seen_epoch": "1723680682.288508000", "evidence": [ { "frame_number": 9002, "timestamp_epoch": "1723680682.288508000", "display_filter": "frame.number == 9002", "udp_stream": 14 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2f3a968abe13aa11937b82fc", "type": "ipv4", "value": "23.53.13.197", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680610.884498000", "last_seen_epoch": "1723681381.435487000", "evidence": [ { "frame_number": 1293, "timestamp_epoch": "1723680610.884498000", "display_filter": "frame.number == 1293", "udp_stream": 14 }, { "frame_number": 3853, "timestamp_epoch": "1723680647.756613000", "display_filter": "frame.number == 3853", "udp_stream": 61 }, { "frame_number": 9002, "timestamp_epoch": "1723680682.288508000", "display_filter": "frame.number == 9002", "udp_stream": 14 }, { "frame_number": 15470, "timestamp_epoch": "1723681381.435487000", "display_filter": "frame.number == 15470", "udp_stream": 136 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a548c8937cae71c4143fc86b", "type": "ipv4", "value": "23.53.13.198", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680682.288508000", "last_seen_epoch": "1723680682.288508000", "evidence": [ { "frame_number": 9002, "timestamp_epoch": "1723680682.288508000", "display_filter": "frame.number == 9002", "udp_stream": 14 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0f3226cee29bf28991f56b90", "type": "ipv4", "value": "23.53.13.199", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680647.756613000", "last_seen_epoch": "1723680647.756613000", "evidence": [ { "frame_number": 3853, "timestamp_epoch": "1723680647.756613000", "display_filter": "frame.number == 3853", "udp_stream": 61 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-820cf889e8c8bb0e402e20d1", "type": "ipv4", "value": "23.53.13.200", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680647.756613000", "last_seen_epoch": "1723680682.288508000", "evidence": [ { "frame_number": 3853, "timestamp_epoch": "1723680647.756613000", "display_filter": "frame.number == 3853", "udp_stream": 61 }, { "frame_number": 9002, "timestamp_epoch": "1723680682.288508000", "display_filter": "frame.number == 9002", "udp_stream": 14 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4db6a5a24ad112150851e27a", "type": "ipv4", "value": "23.53.13.202", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680647.756613000", "last_seen_epoch": "1723680682.288508000", "evidence": [ { "frame_number": 3853, "timestamp_epoch": "1723680647.756613000", "display_filter": "frame.number == 3853", "udp_stream": 61 }, { "frame_number": 9002, "timestamp_epoch": "1723680682.288508000", "display_filter": "frame.number == 9002", "udp_stream": 14 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-13de2a695c81eecfd630919a", "type": "ipv4", "value": "23.53.13.203", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680610.884498000", "last_seen_epoch": "1723680647.756613000", "evidence": [ { "frame_number": 1293, "timestamp_epoch": "1723680610.884498000", "display_filter": "frame.number == 1293", "udp_stream": 14 }, { "frame_number": 3853, "timestamp_epoch": "1723680647.756613000", "display_filter": "frame.number == 3853", "udp_stream": 61 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-70a559d91012c2c30f3b852b", "type": "ipv4", "value": "23.53.13.204", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680682.288508000", "last_seen_epoch": "1723680797.801043000", "evidence": [ { "frame_number": 9002, "timestamp_epoch": "1723680682.288508000", "display_filter": "frame.number == 9002", "udp_stream": 14 }, { "frame_number": 11732, "timestamp_epoch": "1723680797.801043000", "display_filter": "frame.number == 11732", "udp_stream": 99 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-fce49ee2b5aeb801ce9546eb", "type": "ipv4", "value": "23.53.13.205", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680682.288508000", "last_seen_epoch": "1723680797.801043000", "evidence": [ { "frame_number": 9002, "timestamp_epoch": "1723680682.288508000", "display_filter": "frame.number == 9002", "udp_stream": 14 }, { "frame_number": 11732, "timestamp_epoch": "1723680797.801043000", "display_filter": "frame.number == 11732", "udp_stream": 99 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-45469de9aabc8d38057449ab", "type": "ipv4", "value": "23.53.13.206", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680610.884498000", "last_seen_epoch": "1723680797.801043000", "evidence": [ { "frame_number": 1293, "timestamp_epoch": "1723680610.884498000", "display_filter": "frame.number == 1293", "udp_stream": 14 }, { "frame_number": 3853, "timestamp_epoch": "1723680647.756613000", "display_filter": "frame.number == 3853", "udp_stream": 61 }, { "frame_number": 9002, "timestamp_epoch": "1723680682.288508000", "display_filter": "frame.number == 9002", "udp_stream": 14 }, { "frame_number": 11732, "timestamp_epoch": "1723680797.801043000", "display_filter": "frame.number == 11732", "udp_stream": 99 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a6d9faa53be038770df3020a", "type": "ipv4", "value": "23.53.13.207", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680610.884498000", "last_seen_epoch": "1723681381.435487000", "evidence": [ { "frame_number": 1293, "timestamp_epoch": "1723680610.884498000", "display_filter": "frame.number == 1293", "udp_stream": 14 }, { "frame_number": 3853, "timestamp_epoch": "1723680647.756613000", "display_filter": "frame.number == 3853", "udp_stream": 61 }, { "frame_number": 9002, "timestamp_epoch": "1723680682.288508000", "display_filter": "frame.number == 9002", "udp_stream": 14 }, { "frame_number": 15470, "timestamp_epoch": "1723681381.435487000", "display_filter": "frame.number == 15470", "udp_stream": 136 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e4e0ead21077ac0d018b4d4a", "type": "ipv4", "value": "23.53.13.208", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680610.884498000", "last_seen_epoch": "1723681381.435487000", "evidence": [ { "frame_number": 1293, "timestamp_epoch": "1723680610.884498000", "display_filter": "frame.number == 1293", "udp_stream": 14 }, { "frame_number": 15470, "timestamp_epoch": "1723681381.435487000", "display_filter": "frame.number == 15470", "udp_stream": 136 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9b9c83da9eaeb712cb435af0", "type": "ipv4", "value": "23.56.233.15", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723681154.917557000", "last_seen_epoch": "1723681154.917557000", "evidence": [ { "frame_number": 14527, "timestamp_epoch": "1723681154.917557000", "display_filter": "frame.number == 14527", "udp_stream": 130 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5467e286a56f5458e3882891", "type": "ipv4", "value": "23.60.57.94", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680913.262783000", "last_seen_epoch": "1723680913.262783000", "evidence": [ { "frame_number": 12808, "timestamp_epoch": "1723680913.262783000", "display_filter": "frame.number == 12808", "udp_stream": 119 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b771b08b18decdec690035e1", "type": "ipv4", "value": "23.63.205.134", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680622.844577000", "last_seen_epoch": "1723680622.844577000", "evidence": [ { "frame_number": 3065, "timestamp_epoch": "1723680622.844577000", "display_filter": "frame.number == 3065", "udp_stream": 22 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6934c66135d79fd7c3baa8ef", "type": "ipv4", "value": "23.96.180.189", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680800.899368000", "last_seen_epoch": "1723680800.899368000", "evidence": [ { "frame_number": 11866, "timestamp_epoch": "1723680800.899368000", "display_filter": "frame.number == 11866", "udp_stream": 38 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-327a8bfce142f13c29e41828", "type": "ipv4", "value": "239.255.255.250", "roles": [ "http-host", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680618.769208000", "last_seen_epoch": "1723682541.976598000", "evidence": [ { "frame_number": 2104, "timestamp_epoch": "1723680618.769208000", "display_filter": "frame.number == 2104" }, { "frame_number": 2328, "timestamp_epoch": "1723680619.776640000", "display_filter": "frame.number == 2328" }, { "frame_number": 2700, "timestamp_epoch": "1723680620.776682000", "display_filter": "frame.number == 2700" }, { "frame_number": 2972, "timestamp_epoch": "1723680621.781943000", "display_filter": "frame.number == 2972" }, { "frame_number": 8977, "timestamp_epoch": "1723680681.507171000", "display_filter": "frame.number == 8977" }, { "frame_number": 8978, "timestamp_epoch": "1723680681.510601000", "display_filter": "frame.number == 8978" }, { "frame_number": 8982, "timestamp_epoch": "1723680681.717085000", "display_filter": "frame.number == 8982" }, { "frame_number": 9041, "timestamp_epoch": "1723680684.514513000", "display_filter": "frame.number == 9041" }, { "frame_number": 9042, "timestamp_epoch": "1723680684.514901000", "display_filter": "frame.number == 9042" }, { "frame_number": 9178, "timestamp_epoch": "1723680684.717004000", "display_filter": "frame.number == 9178" }, { "frame_number": 10207, "timestamp_epoch": "1723680687.529821000", "display_filter": "frame.number == 10207" }, { "frame_number": 10208, "timestamp_epoch": "1723680687.530376000", "display_filter": "frame.number == 10208" }, { "frame_number": 10886, "timestamp_epoch": "1723680738.774571000", "display_filter": "frame.number == 10886" }, { "frame_number": 10889, "timestamp_epoch": "1723680739.785805000", "display_filter": "frame.number == 10889" }, { "frame_number": 10890, "timestamp_epoch": "1723680740.801288000", "display_filter": "frame.number == 10890" }, { "frame_number": 10893, "timestamp_epoch": "1723680741.801367000", "display_filter": "frame.number == 10893" }, { "frame_number": 12132, "timestamp_epoch": "1723680858.790096000", "display_filter": "frame.number == 12132" }, { "frame_number": 12133, "timestamp_epoch": "1723680859.802600000", "display_filter": "frame.number == 12133" }, { "frame_number": 12134, "timestamp_epoch": "1723680860.818073000", "display_filter": "frame.number == 12134" }, { "frame_number": 12137, "timestamp_epoch": "1723680861.818104000", "display_filter": "frame.number == 12137" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7d3dc81e16274cd69f7c96a5", "type": "ipv4", "value": "255.255.255.255", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-1e63978528ce55e6c4351bc4", "type": "ipv4", "value": "40.126.29.10", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680619.207937000", "last_seen_epoch": "1723680987.962385000", "evidence": [ { "frame_number": 2245, "timestamp_epoch": "1723680619.207937000", "display_filter": "frame.number == 2245", "udp_stream": 14 }, { "frame_number": 10380, "timestamp_epoch": "1723680708.002327000", "display_filter": "frame.number == 10380", "udp_stream": 38 }, { "frame_number": 13826, "timestamp_epoch": "1723680987.962385000", "display_filter": "frame.number == 13826", "udp_stream": 100 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e6a2996d3cc44d12b80c1b82", "type": "ipv4", "value": "40.126.29.11", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680619.207937000", "last_seen_epoch": "1723680987.962385000", "evidence": [ { "frame_number": 2245, "timestamp_epoch": "1723680619.207937000", "display_filter": "frame.number == 2245", "udp_stream": 14 }, { "frame_number": 10380, "timestamp_epoch": "1723680708.002327000", "display_filter": "frame.number == 10380", "udp_stream": 38 }, { "frame_number": 13826, "timestamp_epoch": "1723680987.962385000", "display_filter": "frame.number == 13826", "udp_stream": 100 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-eb60625a682aca0f6385a01b", "type": "ipv4", "value": "40.126.29.12", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680708.002327000", "last_seen_epoch": "1723680987.962385000", "evidence": [ { "frame_number": 10380, "timestamp_epoch": "1723680708.002327000", "display_filter": "frame.number == 10380", "udp_stream": 38 }, { "frame_number": 13826, "timestamp_epoch": "1723680987.962385000", "display_filter": "frame.number == 13826", "udp_stream": 100 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e6cb30f3acc7ae2a1664024f", "type": "ipv4", "value": "40.126.29.13", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680619.207937000", "last_seen_epoch": "1723680619.207937000", "evidence": [ { "frame_number": 2245, "timestamp_epoch": "1723680619.207937000", "display_filter": "frame.number == 2245", "udp_stream": 14 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3e64fd216b767877c3b22821", "type": "ipv4", "value": "40.126.29.15", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680619.207937000", "last_seen_epoch": "1723680987.962385000", "evidence": [ { "frame_number": 2245, "timestamp_epoch": "1723680619.207937000", "display_filter": "frame.number == 2245", "udp_stream": 14 }, { "frame_number": 10380, "timestamp_epoch": "1723680708.002327000", "display_filter": "frame.number == 10380", "udp_stream": 38 }, { "frame_number": 13826, "timestamp_epoch": "1723680987.962385000", "display_filter": "frame.number == 13826", "udp_stream": 100 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e63d02651afc31c7c990c63c", "type": "ipv4", "value": "40.126.29.5", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680708.002327000", "last_seen_epoch": "1723680987.962385000", "evidence": [ { "frame_number": 10380, "timestamp_epoch": "1723680708.002327000", "display_filter": "frame.number == 10380", "udp_stream": 38 }, { "frame_number": 13826, "timestamp_epoch": "1723680987.962385000", "display_filter": "frame.number == 13826", "udp_stream": 100 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9b2f0d10bcaae8e1dab1449b", "type": "ipv4", "value": "40.126.29.6", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680619.207937000", "last_seen_epoch": "1723680987.962385000", "evidence": [ { "frame_number": 2245, "timestamp_epoch": "1723680619.207937000", "display_filter": "frame.number == 2245", "udp_stream": 14 }, { "frame_number": 10380, "timestamp_epoch": "1723680708.002327000", "display_filter": "frame.number == 10380", "udp_stream": 38 }, { "frame_number": 13826, "timestamp_epoch": "1723680987.962385000", "display_filter": "frame.number == 13826", "udp_stream": 100 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b30c98faea893cfe699b351e", "type": "ipv4", "value": "40.126.29.7", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680619.207937000", "last_seen_epoch": "1723680619.207937000", "evidence": [ { "frame_number": 2245, "timestamp_epoch": "1723680619.207937000", "display_filter": "frame.number == 2245", "udp_stream": 14 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-cdaf08bfc7b39dea188372c6", "type": "ipv4", "value": "40.126.29.8", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680708.002327000", "last_seen_epoch": "1723680987.962385000", "evidence": [ { "frame_number": 10380, "timestamp_epoch": "1723680708.002327000", "display_filter": "frame.number == 10380", "udp_stream": 38 }, { "frame_number": 13826, "timestamp_epoch": "1723680987.962385000", "display_filter": "frame.number == 13826", "udp_stream": 100 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-280c695edad20ee7f4a7556a", "type": "ipv4", "value": "40.126.29.9", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680619.207937000", "last_seen_epoch": "1723680619.207937000", "evidence": [ { "frame_number": 2245, "timestamp_epoch": "1723680619.207937000", "display_filter": "frame.number == 2245", "udp_stream": 14 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4dbe9d7e0ac1a9de4e5fed53", "type": "ipv4", "value": "51.116.253.170", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680609.679431000", "last_seen_epoch": "1723680609.679431000", "evidence": [ { "frame_number": 1194, "timestamp_epoch": "1723680609.679431000", "display_filter": "frame.number == 1194", "udp_stream": 14 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d3e0a53b4d7375e130ac2cd7", "type": "ipv4", "value": "52.109.0.136", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680909.294038000", "last_seen_epoch": "1723680909.294038000", "evidence": [ { "frame_number": 12261, "timestamp_epoch": "1723680909.294038000", "display_filter": "frame.number == 12261", "udp_stream": 99 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6bc46af269e3c0014b090a5c", "type": "ipv4", "value": "52.109.0.142", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680613.861164000", "last_seen_epoch": "1723680622.357357000", "evidence": [ { "frame_number": 1540, "timestamp_epoch": "1723680613.861164000", "display_filter": "frame.number == 1540", "udp_stream": 22 }, { "frame_number": 3000, "timestamp_epoch": "1723680622.357357000", "display_filter": "frame.number == 3000", "udp_stream": 38 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-51184f14a7e6bfa221dbf2cc", "type": "ipv4", "value": "52.109.20.38", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680587.162563000", "last_seen_epoch": "1723680613.191028000", "evidence": [ { "frame_number": 623, "timestamp_epoch": "1723680587.162563000", "display_filter": "frame.number == 623", "udp_stream": 14 }, { "frame_number": 1348, "timestamp_epoch": "1723680613.191028000", "display_filter": "frame.number == 1348", "udp_stream": 22 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5298605464869e0493b705e9", "type": "ipv4", "value": "52.113.194.132", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680622.357369000", "last_seen_epoch": "1723682071.184741000", "evidence": [ { "frame_number": 3001, "timestamp_epoch": "1723680622.357369000", "display_filter": "frame.number == 3001", "udp_stream": 14 }, { "frame_number": 14636, "timestamp_epoch": "1723681155.399633000", "display_filter": "frame.number == 14636", "udp_stream": 131 }, { "frame_number": 15759, "timestamp_epoch": "1723681510.196760000", "display_filter": "frame.number == 15759", "udp_stream": 136 }, { "frame_number": 15761, "timestamp_epoch": "1723681510.197245000", "display_filter": "frame.number == 15761", "udp_stream": 136 }, { "frame_number": 15762, "timestamp_epoch": "1723681510.197475000", "display_filter": "frame.number == 15762", "udp_stream": 136 }, { "frame_number": 17128, "timestamp_epoch": "1723682071.184741000", "display_filter": "frame.number == 17128", "udp_stream": 148 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5fd2f32c67a2967638553133", "type": "ipv4", "value": "52.123.128.254", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680797.539068000", "last_seen_epoch": "1723680797.539068000", "evidence": [ { "frame_number": 11696, "timestamp_epoch": "1723680797.539068000", "display_filter": "frame.number == 11696", "udp_stream": 99 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-bb0a067693610f42176df291", "type": "ipv4", "value": "52.123.129.254", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1723680797.539068000", "last_seen_epoch": "1723680797.539068000", "evidence": [ { "frame_number": 11696, "timestamp_epoch": "1723680797.539068000", "display_filter": "frame.number == 11696", "udp_stream": 99 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d3cf6cc5ae210e24e25ef1a2", "type": "ipv4", "value": "52.137.106.217", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680708.899414000", "last_seen_epoch": "1723680990.182754000", "evidence": [ { "frame_number": 10409, "timestamp_epoch": "1723680708.899414000", "display_filter": "frame.number == 10409", "udp_stream": 38 }, { "frame_number": 13886, "timestamp_epoch": "1723680990.182754000", "display_filter": "frame.number == 13886", "udp_stream": 125 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-71c3809f986506572d1810cb", "type": "ipv4", "value": "52.152.180.153", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723681192.120676000", "last_seen_epoch": "1723681192.120676000", "evidence": [ { "frame_number": 14767, "timestamp_epoch": "1723681192.120676000", "display_filter": "frame.number == 14767", "udp_stream": 131 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-fa72659e7f6d31353d9cde9c", "type": "ipv4", "value": "52.168.117.170", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723681672.618317000", "last_seen_epoch": "1723681672.618317000", "evidence": [ { "frame_number": 16280, "timestamp_epoch": "1723681672.618317000", "display_filter": "frame.number == 16280", "udp_stream": 142 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9c981767f1afeee8a452e62a", "type": "ipv4", "value": "52.182.143.215", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680753.042487000", "last_seen_epoch": "1723680753.424669000", "evidence": [ { "frame_number": 10905, "timestamp_epoch": "1723680753.042487000", "display_filter": "frame.number == 10905", "udp_stream": 38 }, { "frame_number": 10939, "timestamp_epoch": "1723680753.424669000", "display_filter": "frame.number == 10939", "udp_stream": 38 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-cbaca8feb6ef12a78342cd37", "type": "ipv4", "value": "72.5.43.29", "roles": [ "http-host", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1723680719.744428000", "last_seen_epoch": "1723682545.821716000", "evidence": [ { "frame_number": 10611, "timestamp_epoch": "1723680719.744428000", "display_filter": "frame.number == 10611", "tcp_stream": 134 }, { "frame_number": 10614, "timestamp_epoch": "1723680719.960393000", "display_filter": "frame.number == 10614", "tcp_stream": 134 }, { "frame_number": 11028, "timestamp_epoch": "1723680780.664378000", "display_filter": "frame.number == 11028", "tcp_stream": 142 }, { "frame_number": 11032, "timestamp_epoch": "1723680780.868295000", "display_filter": "frame.number == 11032", "tcp_stream": 142 }, { "frame_number": 11463, "timestamp_epoch": "1723680782.262324000", "display_filter": "frame.number == 11463", "tcp_stream": 143 }, { "frame_number": 11496, "timestamp_epoch": "1723680782.865019000", "display_filter": "frame.number == 11496", "tcp_stream": 144 }, { "frame_number": 11505, "timestamp_epoch": "1723680787.999666000", "display_filter": "frame.number == 11505", "tcp_stream": 145 }, { "frame_number": 11619, "timestamp_epoch": "1723680793.850601000", "display_filter": "frame.number == 11619", "tcp_stream": 151 }, { "frame_number": 11688, "timestamp_epoch": "1723680797.315577000", "display_filter": "frame.number == 11688", "tcp_stream": 155 }, { "frame_number": 11962, "timestamp_epoch": "1723680804.254102000", "display_filter": "frame.number == 11962", "tcp_stream": 164 }, { "frame_number": 11974, "timestamp_epoch": "1723680809.944683000", "display_filter": "frame.number == 11974", "tcp_stream": 165 }, { "frame_number": 11993, "timestamp_epoch": "1723680817.194861000", "display_filter": "frame.number == 11993", "tcp_stream": 166 }, { "frame_number": 12004, "timestamp_epoch": "1723680823.591854000", "display_filter": "frame.number == 12004", "tcp_stream": 167 }, { "frame_number": 12017, "timestamp_epoch": "1723680829.193045000", "display_filter": "frame.number == 12017", "tcp_stream": 168 }, { "frame_number": 12032, "timestamp_epoch": "1723680835.214191000", "display_filter": "frame.number == 12032", "tcp_stream": 169 }, { "frame_number": 12045, "timestamp_epoch": "1723680839.081492000", "display_filter": "frame.number == 12045", "tcp_stream": 170 }, { "frame_number": 12060, "timestamp_epoch": "1723680843.782430000", "display_filter": "frame.number == 12060", "tcp_stream": 171 }, { "frame_number": 12072, "timestamp_epoch": "1723680847.998603000", "display_filter": "frame.number == 12072", "tcp_stream": 172 }, { "frame_number": 12087, "timestamp_epoch": "1723680852.361708000", "display_filter": "frame.number == 12087", "tcp_stream": 173 }, { "frame_number": 12096, "timestamp_epoch": "1723680857.007048000", "display_filter": "frame.number == 12096", "tcp_stream": 174 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e292fce6bd1ba0c4cce4c8de", "type": "ja3", "value": "08c552d3bb717cfa625b1c2e6293fbc3", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680647.778061000", "last_seen_epoch": "1723680647.883892000", "evidence": [ { "frame_number": 3868, "timestamp_epoch": "1723680647.778061000", "display_filter": "frame.number == 3868", "tcp_stream": 92 }, { "frame_number": 3940, "timestamp_epoch": "1723680647.883892000", "display_filter": "frame.number == 3940", "tcp_stream": 92 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5adb6bd8e295dab1e70c4765", "type": "ja3", "value": "091f51a7a1c3a4504a224cc081ce9cee", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680587.233268000", "last_seen_epoch": "1723681909.618984000", "evidence": [ { "frame_number": 671, "timestamp_epoch": "1723680587.233268000", "display_filter": "frame.number == 671", "tcp_stream": 32 }, { "frame_number": 1217, "timestamp_epoch": "1723680609.858336000", "display_filter": "frame.number == 1217", "tcp_stream": 56 }, { "frame_number": 10429, "timestamp_epoch": "1723680708.980841000", "display_filter": "frame.number == 10429", "tcp_stream": 133 }, { "frame_number": 10909, "timestamp_epoch": "1723680753.106037000", "display_filter": "frame.number == 10909", "tcp_stream": 140 }, { "frame_number": 10943, "timestamp_epoch": "1723680753.503071000", "display_filter": "frame.number == 10943", "tcp_stream": 141 }, { "frame_number": 12265, "timestamp_epoch": "1723680909.364796000", "display_filter": "frame.number == 12265", "tcp_stream": 185 }, { "frame_number": 13893, "timestamp_epoch": "1723680990.287103000", "display_filter": "frame.number == 13893", "tcp_stream": 223 }, { "frame_number": 13898, "timestamp_epoch": "1723680990.338471000", "display_filter": "frame.number == 13898", "tcp_stream": 224 }, { "frame_number": 14102, "timestamp_epoch": "1723681003.222759000", "display_filter": "frame.number == 14102", "tcp_stream": 227 }, { "frame_number": 14149, "timestamp_epoch": "1723681007.284513000", "display_filter": "frame.number == 14149", "tcp_stream": 229 }, { "frame_number": 14771, "timestamp_epoch": "1723681192.215237000", "display_filter": "frame.number == 14771", "tcp_stream": 269 }, { "frame_number": 14931, "timestamp_epoch": "1723681209.903085000", "display_filter": "frame.number == 14931", "tcp_stream": 273 }, { "frame_number": 15279, "timestamp_epoch": "1723681312.866135000", "display_filter": "frame.number == 15279", "tcp_stream": 296 }, { "frame_number": 15870, "timestamp_epoch": "1723681517.499945000", "display_filter": "frame.number == 15870", "tcp_stream": 338 }, { "frame_number": 16284, "timestamp_epoch": "1723681672.709241000", "display_filter": "frame.number == 16284", "tcp_stream": 371 }, { "frame_number": 16796, "timestamp_epoch": "1723681909.618984000", "display_filter": "frame.number == 16796", "tcp_stream": 413 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b97afc69047815f5f895d46b", "type": "ja3", "value": "09218b185cadc5bc9ac32dd4af1d80ba", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680650.553411000", "last_seen_epoch": "1723680650.553411000", "evidence": [ { "frame_number": 5509, "timestamp_epoch": "1723680650.553411000", "display_filter": "frame.number == 5509", "tcp_stream": 105 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-38bd4c8580d9d6b2768b70ef", "type": "ja3", "value": "0940eef199c4e4a2d7fff1702ca8e267", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680912.354568000", "last_seen_epoch": "1723680912.460984000", "evidence": [ { "frame_number": 12593, "timestamp_epoch": "1723680912.354568000", "display_filter": "frame.number == 12593", "tcp_stream": 200 }, { "frame_number": 12615, "timestamp_epoch": "1723680912.460984000", "display_filter": "frame.number == 12615", "tcp_stream": 200 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e068ce9ead07cb2238df90f5", "type": "ja3", "value": "09d2a38ae19e8be7fa018ad87e43b2ff", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680657.384830000", "last_seen_epoch": "1723680657.384830000", "evidence": [ { "frame_number": 6379, "timestamp_epoch": "1723680657.384830000", "display_filter": "frame.number == 6379", "tcp_stream": 111 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ef7943a83ad1576b8c3eaafa", "type": "ja3", "value": "11156bf1dc969c54ae91bbfe52874a88", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680655.749003000", "last_seen_epoch": "1723680655.900384000", "evidence": [ { "frame_number": 6211, "timestamp_epoch": "1723680655.749003000", "display_filter": "frame.number == 6211", "tcp_stream": 108 }, { "frame_number": 6215, "timestamp_epoch": "1723680655.900384000", "display_filter": "frame.number == 6215", "tcp_stream": 108 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-021016877ff5f5fb4cd8a35c", "type": "ja3", "value": "11702f6f4b7b9c9b2999ebcf2c354984", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680647.821215000", "last_seen_epoch": "1723680647.821215000", "evidence": [ { "frame_number": 3897, "timestamp_epoch": "1723680647.821215000", "display_filter": "frame.number == 3897", "tcp_stream": 94 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-03e86bb5626b4041e412cdb4", "type": "ja3", "value": "173448d57b47fba3f0be89e6bd4599af", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680656.179337000", "last_seen_epoch": "1723680656.179337000", "evidence": [ { "frame_number": 6287, "timestamp_epoch": "1723680656.179337000", "display_filter": "frame.number == 6287" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6f91ce0832e084a2dc74abb4", "type": "ja3", "value": "218b9f26907447fdbf2c8a52418444b7", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680647.822273000", "last_seen_epoch": "1723680647.822273000", "evidence": [ { "frame_number": 3909, "timestamp_epoch": "1723680647.822273000", "display_filter": "frame.number == 3909", "tcp_stream": 96 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-047164fd4f3fc84aaf88bd8a", "type": "ja3", "value": "22833c8ba3c4d8d22ef4b3ff2fdd992e", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680681.044773000", "last_seen_epoch": "1723680681.044773000", "evidence": [ { "frame_number": 8913, "timestamp_epoch": "1723680681.044773000", "display_filter": "frame.number == 8913", "tcp_stream": 121 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4ff0d7a3e0bfb78a5395e153", "type": "ja3", "value": "258a5a1e95b8a911872bae9081526644", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723681512.285308000", "last_seen_epoch": "1723681512.285354000", "evidence": [ { "frame_number": 15771, "timestamp_epoch": "1723681512.285308000", "display_filter": "frame.number == 15771", "tcp_stream": 335 }, { "frame_number": 15772, "timestamp_epoch": "1723681512.285354000", "display_filter": "frame.number == 15772", "tcp_stream": 336 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0c37e29c132a09a931cfab1a", "type": "ja3", "value": "25e0b3677a2832677e0c136c73a02311", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680647.738589000", "last_seen_epoch": "1723680647.738589000", "evidence": [ { "frame_number": 3847, "timestamp_epoch": "1723680647.738589000", "display_filter": "frame.number == 3847", "tcp_stream": 91 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-36d1bfb960ca8184da7e0e04", "type": "ja3", "value": "26abc27bb714c3e30049154ed7f03422", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680647.820816000", "last_seen_epoch": "1723680647.820816000", "evidence": [ { "frame_number": 3893, "timestamp_epoch": "1723680647.820816000", "display_filter": "frame.number == 3893", "tcp_stream": 95 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-23c051310c9e5066c3ac77bf", "type": "ja3", "value": "2f7a1c53b0a1abfffcdeff101f69baf4", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680649.653743000", "last_seen_epoch": "1723680649.653743000", "evidence": [ { "frame_number": 4728, "timestamp_epoch": "1723680649.653743000", "display_filter": "frame.number == 4728" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-44e9824ce82cac7bea566be0", "type": "ja3", "value": "33717d60eef91a9c824c343c9b904387", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680649.765409000", "last_seen_epoch": "1723680649.895760000", "evidence": [ { "frame_number": 4864, "timestamp_epoch": "1723680649.765409000", "display_filter": "frame.number == 4864", "tcp_stream": 101 }, { "frame_number": 4986, "timestamp_epoch": "1723680649.895760000", "display_filter": "frame.number == 4986", "tcp_stream": 101 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a4f8ca24dbb46ad7dca3f53c", "type": "ja3", "value": "34f7d1c3fe8b7bb4b8cee1ceefa986a5", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680911.842842000", "last_seen_epoch": "1723680911.963703000", "evidence": [ { "frame_number": 12542, "timestamp_epoch": "1723680911.842842000", "display_filter": "frame.number == 12542", "tcp_stream": 198 }, { "frame_number": 12546, "timestamp_epoch": "1723680911.963703000", "display_filter": "frame.number == 12546", "tcp_stream": 198 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f73b427dfd8bbcef7484ea86", "type": "ja3", "value": "38ff17125ac547fdaf43cbc78d13056e", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680620.721662000", "last_seen_epoch": "1723680620.721662000", "evidence": [ { "frame_number": 2512, "timestamp_epoch": "1723680620.721662000", "display_filter": "frame.number == 2512" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2c8ddd2b61876f26af201b84", "type": "ja3", "value": "3c293bdf2a25c07559b560ba86debc77", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680588.207325000", "last_seen_epoch": "1723682071.296752000", "evidence": [ { "frame_number": 733, "timestamp_epoch": "1723680588.207325000", "display_filter": "frame.number == 733", "tcp_stream": 33 }, { "frame_number": 737, "timestamp_epoch": "1723680588.293463000", "display_filter": "frame.number == 737", "tcp_stream": 33 }, { "frame_number": 847, "timestamp_epoch": "1723680591.605442000", "display_filter": "frame.number == 847", "tcp_stream": 38 }, { "frame_number": 851, "timestamp_epoch": "1723680591.688217000", "display_filter": "frame.number == 851", "tcp_stream": 38 }, { "frame_number": 1308, "timestamp_epoch": "1723680611.061775000", "display_filter": "frame.number == 1308", "tcp_stream": 59 }, { "frame_number": 3007, "timestamp_epoch": "1723680622.426613000", "display_filter": "frame.number == 3007", "tcp_stream": 82 }, { "frame_number": 3013, "timestamp_epoch": "1723680622.465634000", "display_filter": "frame.number == 3013", "tcp_stream": 83 }, { "frame_number": 3015, "timestamp_epoch": "1723680622.466683000", "display_filter": "frame.number == 3015", "tcp_stream": 84 }, { "frame_number": 3018, "timestamp_epoch": "1723680622.491602000", "display_filter": "frame.number == 3018", "tcp_stream": 82 }, { "frame_number": 3073, "timestamp_epoch": "1723680623.071041000", "display_filter": "frame.number == 3073", "tcp_stream": 85 }, { "frame_number": 9006, "timestamp_epoch": "1723680682.359010000", "display_filter": "frame.number == 9006", "tcp_stream": 123 }, { "frame_number": 9031, "timestamp_epoch": "1723680684.086873000", "display_filter": "frame.number == 9031", "tcp_stream": 124 }, { "frame_number": 12107, "timestamp_epoch": "1723680857.844217000", "display_filter": "frame.number == 12107", "tcp_stream": 175 }, { "frame_number": 12111, "timestamp_epoch": "1723680857.925217000", "display_filter": "frame.number == 12111", "tcp_stream": 175 }, { "frame_number": 14640, "timestamp_epoch": "1723681155.458646000", "display_filter": "frame.number == 14640", "tcp_stream": 262 }, { "frame_number": 14643, "timestamp_epoch": "1723681155.519827000", "display_filter": "frame.number == 14643", "tcp_stream": 262 }, { "frame_number": 15354, "timestamp_epoch": "1723681330.075840000", "display_filter": "frame.number == 15354", "tcp_stream": 301 }, { "frame_number": 15474, "timestamp_epoch": "1723681381.492002000", "display_filter": "frame.number == 15474", "tcp_stream": 311 }, { "frame_number": 17132, "timestamp_epoch": "1723682071.235006000", "display_filter": "frame.number == 17132", "tcp_stream": 442 }, { "frame_number": 17136, "timestamp_epoch": "1723682071.296752000", "display_filter": "frame.number == 17136", "tcp_stream": 442 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4959245622aa09d08e26bd3d", "type": "ja3", "value": "3c4eb72b882d4d1442c67ce73f1292a9", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680626.203055000", "last_seen_epoch": "1723680626.259996000", "evidence": [ { "frame_number": 3546, "timestamp_epoch": "1723680626.203055000", "display_filter": "frame.number == 3546", "tcp_stream": 86 }, { "frame_number": 3549, "timestamp_epoch": "1723680626.259996000", "display_filter": "frame.number == 3549", "tcp_stream": 86 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-80922b305a79c0229e26a354", "type": "ja3", "value": "3ec074ef84f1118c439e56727227cea3", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680646.525783000", "last_seen_epoch": "1723680646.659078000", "evidence": [ { "frame_number": 3676, "timestamp_epoch": "1723680646.525783000", "display_filter": "frame.number == 3676", "tcp_stream": 88 }, { "frame_number": 3683, "timestamp_epoch": "1723680646.659078000", "display_filter": "frame.number == 3683", "tcp_stream": 88 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2f05d042c5ee4ecd09dff923", "type": "ja3", "value": "46a78af27de56cd4c85b04f57deb3f79", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680623.820524000", "last_seen_epoch": "1723680623.820524000", "evidence": [ { "frame_number": 3151, "timestamp_epoch": "1723680623.820524000", "display_filter": "frame.number == 3151" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a0a830466a660c6e59f76604", "type": "ja3", "value": "46f5131e766d248db0248a86c494b71c", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680585.799589000", "last_seen_epoch": "1723681810.744481000", "evidence": [ { "frame_number": 107, "timestamp_epoch": "1723680585.799589000", "display_filter": "frame.number == 107", "tcp_stream": 4 }, { "frame_number": 1198, "timestamp_epoch": "1723680609.708445000", "display_filter": "frame.number == 1198", "tcp_stream": 55 }, { "frame_number": 11844, "timestamp_epoch": "1723680800.501684000", "display_filter": "frame.number == 11844", "tcp_stream": 160 }, { "frame_number": 12292, "timestamp_epoch": "1723680909.941165000", "display_filter": "frame.number == 12292", "tcp_stream": 186 }, { "frame_number": 12310, "timestamp_epoch": "1723680910.121849000", "display_filter": "frame.number == 12310", "tcp_stream": 187 }, { "frame_number": 12330, "timestamp_epoch": "1723680910.305652000", "display_filter": "frame.number == 12330", "tcp_stream": 188 }, { "frame_number": 12351, "timestamp_epoch": "1723680910.483204000", "display_filter": "frame.number == 12351", "tcp_stream": 189 }, { "frame_number": 12374, "timestamp_epoch": "1723680910.660614000", "display_filter": "frame.number == 12374", "tcp_stream": 190 }, { "frame_number": 12395, "timestamp_epoch": "1723680910.902863000", "display_filter": "frame.number == 12395", "tcp_stream": 191 }, { "frame_number": 12425, "timestamp_epoch": "1723680911.133796000", "display_filter": "frame.number == 12425", "tcp_stream": 192 }, { "frame_number": 12463, "timestamp_epoch": "1723680911.365627000", "display_filter": "frame.number == 12463", "tcp_stream": 195 }, { "frame_number": 16578, "timestamp_epoch": "1723681810.679494000", "display_filter": "frame.number == 16578", "tcp_stream": 396 }, { "frame_number": 16582, "timestamp_epoch": "1723681810.744481000", "display_filter": "frame.number == 16582", "tcp_stream": 396 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-170bb9ae7073a3c425742007", "type": "ja3", "value": "48ae6b908317f4f14e23cfd06798d78a", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680619.054936000", "last_seen_epoch": "1723680619.054936000", "evidence": [ { "frame_number": 2147, "timestamp_epoch": "1723680619.054936000", "display_filter": "frame.number == 2147", "tcp_stream": 73 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-dd129fba4a4946697ca003c4", "type": "ja3", "value": "49122e3f86717743d247b0e57255881e", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680912.259202000", "last_seen_epoch": "1723680912.259202000", "evidence": [ { "frame_number": 12582, "timestamp_epoch": "1723680912.259202000", "display_filter": "frame.number == 12582", "tcp_stream": 199 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ff7ee4f5596cad9e7700a422", "type": "ja3", "value": "49a844a20d27ed5590377789c1ff9a1c", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680681.745462000", "last_seen_epoch": "1723680681.745462000", "evidence": [ { "frame_number": 8987, "timestamp_epoch": "1723680681.745462000", "display_filter": "frame.number == 8987", "tcp_stream": 120 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-8c3fedb3d4e5f7083671c4a9", "type": "ja3", "value": "4d09d5e0a7539f71bfd5ab61fc77938e", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680913.205044000", "last_seen_epoch": "1723680913.205044000", "evidence": [ { "frame_number": 12765, "timestamp_epoch": "1723680913.205044000", "display_filter": "frame.number == 12765" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-fc8823ebaac40d86697dfa16", "type": "ja3", "value": "4e00cf4e4608830803d4914864014e8c", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680681.092569000", "last_seen_epoch": "1723680681.092569000", "evidence": [ { "frame_number": 8922, "timestamp_epoch": "1723680681.092569000", "display_filter": "frame.number == 8922", "tcp_stream": 122 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-8c46d4791a8e7eb3a30b3f90", "type": "ja3", "value": "4e96df7dcbca32c279f0af5a0930aa87", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680649.813502000", "last_seen_epoch": "1723680649.961673000", "evidence": [ { "frame_number": 4951, "timestamp_epoch": "1723680649.813502000", "display_filter": "frame.number == 4951", "tcp_stream": 104 }, { "frame_number": 5083, "timestamp_epoch": "1723680649.961673000", "display_filter": "frame.number == 5083", "tcp_stream": 104 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-466778cad001fea8d367ef7b", "type": "ja3", "value": "589c33f5c966de68b38bf824fc667e6b", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680649.739700000", "last_seen_epoch": "1723680649.739700000", "evidence": [ { "frame_number": 4855, "timestamp_epoch": "1723680649.739700000", "display_filter": "frame.number == 4855", "tcp_stream": 102 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-42549ac9685f4420a57ff2ef", "type": "ja3", "value": "5919f6108f098e14c2f37619021ebd4d", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723681037.779398000", "last_seen_epoch": "1723682445.474075000", "evidence": [ { "frame_number": 14226, "timestamp_epoch": "1723681037.779398000", "display_filter": "frame.number == 14226", "tcp_stream": 235 }, { "frame_number": 17297, "timestamp_epoch": "1723682144.992328000", "display_filter": "frame.number == 17297", "tcp_stream": 456 }, { "frame_number": 17301, "timestamp_epoch": "1723682145.058887000", "display_filter": "frame.number == 17301", "tcp_stream": 456 }, { "frame_number": 17810, "timestamp_epoch": "1723682392.322492000", "display_filter": "frame.number == 17810", "tcp_stream": 503 }, { "frame_number": 17814, "timestamp_epoch": "1723682392.527841000", "display_filter": "frame.number == 17814", "tcp_stream": 503 }, { "frame_number": 17855, "timestamp_epoch": "1723682399.982309000", "display_filter": "frame.number == 17855", "tcp_stream": 505 }, { "frame_number": 17859, "timestamp_epoch": "1723682400.232996000", "display_filter": "frame.number == 17859", "tcp_stream": 505 }, { "frame_number": 17965, "timestamp_epoch": "1723682445.396810000", "display_filter": "frame.number == 17965", "tcp_stream": 514 }, { "frame_number": 17971, "timestamp_epoch": "1723682445.474075000", "display_filter": "frame.number == 17971", "tcp_stream": 514 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5abbc5a13ad0064c31e9a5e5", "type": "ja3", "value": "5c263245de4d50106d8e0d6087b0fcc5", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680911.245372000", "last_seen_epoch": "1723680911.367043000", "evidence": [ { "frame_number": 12436, "timestamp_epoch": "1723680911.245372000", "display_filter": "frame.number == 12436", "tcp_stream": 193 }, { "frame_number": 12465, "timestamp_epoch": "1723680911.367043000", "display_filter": "frame.number == 12465", "tcp_stream": 193 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c8fa92488c868aa60b35ccda", "type": "ja3", "value": "5c576ee905a82c07ad7987fce4f39cfe", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680619.855497000", "last_seen_epoch": "1723680619.855497000", "evidence": [ { "frame_number": 2345, "timestamp_epoch": "1723680619.855497000", "display_filter": "frame.number == 2345", "tcp_stream": 81 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-fe8c758dbf5dca56dd7a5a70", "type": "ja3", "value": "65005c9d9ae0f0ebeaf22c210571d482", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680585.479612000", "last_seen_epoch": "1723681540.812330000", "evidence": [ { "frame_number": 77, "timestamp_epoch": "1723680585.479612000", "display_filter": "frame.number == 77", "tcp_stream": 3 }, { "frame_number": 1164, "timestamp_epoch": "1723680609.434827000", "display_filter": "frame.number == 1164", "tcp_stream": 54 }, { "frame_number": 1250, "timestamp_epoch": "1723680610.664449000", "display_filter": "frame.number == 1250", "tcp_stream": 57 }, { "frame_number": 1333, "timestamp_epoch": "1723680613.103739000", "display_filter": "frame.number == 1333", "tcp_stream": 60 }, { "frame_number": 1441, "timestamp_epoch": "1723680613.362451000", "display_filter": "frame.number == 1441", "tcp_stream": 61 }, { "frame_number": 1494, "timestamp_epoch": "1723680613.709107000", "display_filter": "frame.number == 1494", "tcp_stream": 62 }, { "frame_number": 1510, "timestamp_epoch": "1723680613.768959000", "display_filter": "frame.number == 1510", "tcp_stream": 62 }, { "frame_number": 1585, "timestamp_epoch": "1723680613.969136000", "display_filter": "frame.number == 1585", "tcp_stream": 63 }, { "frame_number": 1615, "timestamp_epoch": "1723680614.062603000", "display_filter": "frame.number == 1615", "tcp_stream": 65 }, { "frame_number": 1627, "timestamp_epoch": "1723680614.071134000", "display_filter": "frame.number == 1627", "tcp_stream": 69 }, { "frame_number": 1629, "timestamp_epoch": "1723680614.072320000", "display_filter": "frame.number == 1629", "tcp_stream": 67 }, { "frame_number": 1633, "timestamp_epoch": "1723680614.073430000", "display_filter": "frame.number == 1633", "tcp_stream": 68 }, { "frame_number": 1635, "timestamp_epoch": "1723680614.074372000", "display_filter": "frame.number == 1635", "tcp_stream": 66 }, { "frame_number": 1637, "timestamp_epoch": "1723680614.075259000", "display_filter": "frame.number == 1637", "tcp_stream": 70 }, { "frame_number": 1639, "timestamp_epoch": "1723680614.076070000", "display_filter": "frame.number == 1639", "tcp_stream": 64 }, { "frame_number": 1807, "timestamp_epoch": "1723680614.147548000", "display_filter": "frame.number == 1807", "tcp_stream": 64 }, { "frame_number": 2025, "timestamp_epoch": "1723680616.146838000", "display_filter": "frame.number == 2025", "tcp_stream": 71 }, { "frame_number": 2256, "timestamp_epoch": "1723680619.247242000", "display_filter": "frame.number == 2256", "tcp_stream": 78 }, { "frame_number": 2263, "timestamp_epoch": "1723680619.286862000", "display_filter": "frame.number == 2263", "tcp_stream": 78 }, { "frame_number": 10384, "timestamp_epoch": "1723680708.054855000", "display_filter": "frame.number == 10384", "tcp_stream": 132 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4302c999c1498d1e86b449f0", "type": "ja3", "value": "68b1b54a6edfe7729708738380263a3a", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680647.821904000", "last_seen_epoch": "1723680647.821904000", "evidence": [ { "frame_number": 3905, "timestamp_epoch": "1723680647.821904000", "display_filter": "frame.number == 3905", "tcp_stream": 93 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-be1bd46478019eddb1266894", "type": "ja3", "value": "6925f81e11a98d706da3f0cd0f7bc648", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680647.761701000", "last_seen_epoch": "1723680647.761701000", "evidence": [ { "frame_number": 3861, "timestamp_epoch": "1723680647.761701000", "display_filter": "frame.number == 3861" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d58e2030465127db2567dabb", "type": "ja3", "value": "6a5d235ee78c6aede6a61448b4e9ff1e", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680610.667382000", "last_seen_epoch": "1723680671.326251000", "evidence": [ { "frame_number": 1252, "timestamp_epoch": "1723680610.667382000", "display_filter": "frame.number == 1252", "tcp_stream": 58 }, { "frame_number": 8850, "timestamp_epoch": "1723680671.326251000", "display_filter": "frame.number == 8850", "tcp_stream": 119 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4f850f6433cbaa7b2f90972b", "type": "ja3", "value": "736a3b58b94abd6c394392ae94f501c3", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680619.755866000", "last_seen_epoch": "1723680619.755866000", "evidence": [ { "frame_number": 2325, "timestamp_epoch": "1723680619.755866000", "display_filter": "frame.number == 2325", "tcp_stream": 80 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c31df3a38faab5027e14aeec", "type": "ja3", "value": "775ceba0b13f74a42447a14045d31fcc", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680646.525338000", "last_seen_epoch": "1723680646.658199000", "evidence": [ { "frame_number": 3672, "timestamp_epoch": "1723680646.525338000", "display_filter": "frame.number == 3672", "tcp_stream": 89 }, { "frame_number": 3681, "timestamp_epoch": "1723680646.658199000", "display_filter": "frame.number == 3681", "tcp_stream": 89 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d4bed33b339e04c54946e0c9", "type": "ja3", "value": "973e5ee0c53bfc4aaff964c70002dcc3", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680913.241765000", "last_seen_epoch": "1723680913.241765000", "evidence": [ { "frame_number": 12788, "timestamp_epoch": "1723680913.241765000", "display_filter": "frame.number == 12788", "tcp_stream": 204 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-996a3497e2f16ea8078b4414", "type": "ja3", "value": "a2fa4f21077551ea651d383707835d7b", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680647.157232000", "last_seen_epoch": "1723680647.285461000", "evidence": [ { "frame_number": 3732, "timestamp_epoch": "1723680647.157232000", "display_filter": "frame.number == 3732", "tcp_stream": 87 }, { "frame_number": 3736, "timestamp_epoch": "1723680647.285461000", "display_filter": "frame.number == 3736", "tcp_stream": 87 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2dfea28f594f3d7b75cb86d7", "type": "ja3", "value": "ab9d07f6268ed23da4f708263cc7ed49", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680647.757376000", "last_seen_epoch": "1723680647.901167000", "evidence": [ { "frame_number": 3855, "timestamp_epoch": "1723680647.757376000", "display_filter": "frame.number == 3855", "tcp_stream": 90 }, { "frame_number": 3946, "timestamp_epoch": "1723680647.901167000", "display_filter": "frame.number == 3946", "tcp_stream": 90 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c98a5a22a90c9a9cc3de2da0", "type": "ja3", "value": "af8bdb53babadf751a582d1ed25c0eda", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680649.780711000", "last_seen_epoch": "1723680649.780711000", "evidence": [ { "frame_number": 4871, "timestamp_epoch": "1723680649.780711000", "display_filter": "frame.number == 4871", "tcp_stream": 103 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-58b61cf8a2913cefbcbb6772", "type": "ja3", "value": "b1e1912cc21fd3c163c8ddf91f56123a", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680649.064441000", "last_seen_epoch": "1723680649.193613000", "evidence": [ { "frame_number": 4483, "timestamp_epoch": "1723680649.064441000", "display_filter": "frame.number == 4483", "tcp_stream": 100 }, { "frame_number": 4489, "timestamp_epoch": "1723680649.193613000", "display_filter": "frame.number == 4489", "tcp_stream": 100 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d2e4a09c74fcb68fe6057208", "type": "ja3", "value": "b4162be74fb260b4576b62481ee819de", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680913.302499000", "last_seen_epoch": "1723680913.302499000", "evidence": [ { "frame_number": 12885, "timestamp_epoch": "1723680913.302499000", "display_filter": "frame.number == 12885", "tcp_stream": 205 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-afbd5e2d060b71185937e0c9", "type": "ja3", "value": "b74979b1b06e1413e302d2c817ca33db", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680913.202066000", "last_seen_epoch": "1723680913.202066000", "evidence": [ { "frame_number": 12761, "timestamp_epoch": "1723680913.202066000", "display_filter": "frame.number == 12761", "tcp_stream": 203 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2598a9b339e1800aa6257aa0", "type": "ja3", "value": "b7e6d0a42505ebdcb4ca793e16825d04", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680668.416978000", "last_seen_epoch": "1723680668.416978000", "evidence": [ { "frame_number": 8724, "timestamp_epoch": "1723680668.416978000", "display_filter": "frame.number == 8724", "tcp_stream": 114 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1ea768ba2d1164c8ae4a0d69", "type": "ja3", "value": "c44656a187a470fa1e85dfc1707da993", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680647.821571000", "last_seen_epoch": "1723680647.821571000", "evidence": [ { "frame_number": 3901, "timestamp_epoch": "1723680647.821571000", "display_filter": "frame.number == 3901", "tcp_stream": 97 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d3620e47b10780e2dc78cb07", "type": "ja3", "value": "c6e2484ca73f97e2cbb72bacc9c9916b", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680912.962917000", "last_seen_epoch": "1723680913.074674000", "evidence": [ { "frame_number": 12722, "timestamp_epoch": "1723680912.962917000", "display_filter": "frame.number == 12722", "tcp_stream": 201 }, { "frame_number": 12733, "timestamp_epoch": "1723680913.074674000", "display_filter": "frame.number == 12733", "tcp_stream": 201 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d6350dec60e41417e4424392", "type": "ja3", "value": "cd51c3a587eeacaf4f714e3920764550", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680913.063117000", "last_seen_epoch": "1723680913.063117000", "evidence": [ { "frame_number": 12729, "timestamp_epoch": "1723680913.063117000", "display_filter": "frame.number == 12729", "tcp_stream": 202 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b1355b0b93111a13978251f6", "type": "ja3", "value": "d108c2f321a2af5781ed4b63b5b28472", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680619.424890000", "last_seen_epoch": "1723680619.424890000", "evidence": [ { "frame_number": 2293, "timestamp_epoch": "1723680619.424890000", "display_filter": "frame.number == 2293", "tcp_stream": 79 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-fdfde3c8cb66fee49b1a4312", "type": "ja3", "value": "e978fa4306e6fe19e2d404321d215b00", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680895.824113000", "last_seen_epoch": "1723680895.824113000", "evidence": [ { "frame_number": 12217, "timestamp_epoch": "1723680895.824113000", "display_filter": "frame.number == 12217", "tcp_stream": 182 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d9ed3492c6e144738934e9c3", "type": "ja3", "value": "eb6eb038162eb12fda714a4a5860dc83", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680656.244920000", "last_seen_epoch": "1723680656.355466000", "evidence": [ { "frame_number": 6306, "timestamp_epoch": "1723680656.244920000", "display_filter": "frame.number == 6306", "tcp_stream": 110 }, { "frame_number": 6338, "timestamp_epoch": "1723680656.355466000", "display_filter": "frame.number == 6338", "tcp_stream": 110 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-78a729317c72bd378563dedc", "type": "ja3", "value": "ec93fbad48fbc839a6e52e85c3f5af8d", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680911.245835000", "last_seen_epoch": "1723680911.367720000", "evidence": [ { "frame_number": 12440, "timestamp_epoch": "1723680911.245835000", "display_filter": "frame.number == 12440", "tcp_stream": 194 }, { "frame_number": 12467, "timestamp_epoch": "1723680911.367720000", "display_filter": "frame.number == 12467", "tcp_stream": 194 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c7f4d6c380017da4846dfba9", "type": "ja3", "value": "f0a0d117d2207afbb65df9114a8c6321", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680619.036309000", "last_seen_epoch": "1723680619.036309000", "evidence": [ { "frame_number": 2121, "timestamp_epoch": "1723680619.036309000", "display_filter": "frame.number == 2121", "tcp_stream": 72 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9a89b7338ca23ff0407e5b37", "type": "ja3", "value": "f957ed04f16c95c78f474482505d5e89", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680648.494630000", "last_seen_epoch": "1723680648.560629000", "evidence": [ { "frame_number": 4419, "timestamp_epoch": "1723680648.494630000", "display_filter": "frame.number == 4419", "tcp_stream": 99 }, { "frame_number": 4432, "timestamp_epoch": "1723680648.560629000", "display_filter": "frame.number == 4432", "tcp_stream": 99 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-673dd097dbf700ca631e2174", "type": "ja3", "value": "fc2ac8b293f08f588c5b93dd8b87eef6", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680647.835099000", "last_seen_epoch": "1723680647.949563000", "evidence": [ { "frame_number": 3919, "timestamp_epoch": "1723680647.835099000", "display_filter": "frame.number == 3919", "tcp_stream": 98 }, { "frame_number": 3972, "timestamp_epoch": "1723680647.949563000", "display_filter": "frame.number == 3972", "tcp_stream": 98 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f3db57bbe3bb932bfaf1123a", "type": "ja3", "value": "fe624dd6795521519b6fbbd082375f4f", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1723680656.055329000", "last_seen_epoch": "1723680656.218317000", "evidence": [ { "frame_number": 6278, "timestamp_epoch": "1723680656.055329000", "display_filter": "frame.number == 6278", "tcp_stream": 109 }, { "frame_number": 6291, "timestamp_epoch": "1723680656.218317000", "display_filter": "frame.number == 6291", "tcp_stream": 109 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b166783c540f592223be5146", "type": "sha256", "value": "0078330840159b7adc1ec144a36905642a0469d68c4879febf76dbda26ffd5b2", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-df85503f34927168bda1320b", "type": "sha256", "value": "261daf6d8ef4a2ea145dbcd589a3808af3d734af40319248dbf81746bab0f594", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-7a4c0027cd14f7e39ef099fe", "type": "sha256", "value": "2ba81673f8cd827df283ad30f52bcaa0514fc065fef4398dafed3a0f612517f6", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-60138c306c947e9b4b7abf78", "type": "sha256", "value": "41e87d5cfc89b6168dd794c2b32cdf83bff7fe164a603416d5d7d7e399109c9b", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-b806a85b736756b294cb51c0", "type": "sha256", "value": "5e4b21db2742377a82d65f7553eb8d183f781a561ff60f9421baee33b743fac4", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-e84c8c06c073136e7d3ecea3", "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-2128b88b8cc2dd72b36af02f", "type": "sha256", "value": "69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-5f7849f114f0a58f30263793", "type": "sha256", "value": "6a42906135e357167d748aee9f36cb40bf5ba4584e85e7e1df4433ee8f38680c", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-3ad655436ecece548088d51c", "type": "sha256", "value": "798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-fe0bb2131a99e199ed51a67b", "type": "sha256", "value": "8fcd6135214262cc9ef17efb67055b2a1baa9036a22325d8679192683c025e47", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-061e78416598eee84a4c4440", "type": "sha256", "value": "9579dca191a7420bab906998ffd624709de7deda27481b53f6da693765f03499", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-d3199e46bba25eff29acf803", "type": "sha256", "value": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-22b1de5d70ecd4aef966a830", "type": "sha256", "value": "be2882b8c36a2a65594e72f3cedb87b34523d2a8b13e23e902c4cd952a0a4252", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-0fbc75432320a3c389b46722", "type": "sha256", "value": "c54e6bd06d5c09a075e274a55c6d3ce31a2fabebbea38ce7083a9ebb7034a110", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-6ed7f008113d9987e0e7061d", "type": "sha256", "value": "dff7255b90139fbc8d3e76f31b480e65fc3eb7f49f70e7876cfb3f1cb56e5123", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-ea58252776eac9223e000cf9", "type": "sha256", "value": "f300d3238190768cae396cbc02636955abc1d8d2a1d9cf2b27bbd1a4d691ea64", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-3685946564381d0db9dbc293", "type": "sha256", "value": "f394b14f8fb0b1d746f13e2acb5921e4c5962984836c1187147e341fcb693b0e", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-b656b00319e48fb85db41b1c", "type": "sha256", "value": "f8313d5ec5090e37e52eef9455de8085810a8362db2e1226f3dc42f747651332", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-a43582373940980b41bb6beb", "type": "url", "value": "http://239.255.255.250:1900*", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1723680618.769208000", "last_seen_epoch": "1723682541.976598000", "evidence": [ { "frame_number": 2104, "timestamp_epoch": "1723680618.769208000", "display_filter": "frame.number == 2104" }, { "frame_number": 2328, "timestamp_epoch": "1723680619.776640000", "display_filter": "frame.number == 2328" }, { "frame_number": 2700, "timestamp_epoch": "1723680620.776682000", "display_filter": "frame.number == 2700" }, { "frame_number": 2972, "timestamp_epoch": "1723680621.781943000", "display_filter": "frame.number == 2972" }, { "frame_number": 8977, "timestamp_epoch": "1723680681.507171000", "display_filter": "frame.number == 8977" }, { "frame_number": 8978, "timestamp_epoch": "1723680681.510601000", "display_filter": "frame.number == 8978" }, { "frame_number": 8982, "timestamp_epoch": "1723680681.717085000", "display_filter": "frame.number == 8982" }, { "frame_number": 9041, "timestamp_epoch": "1723680684.514513000", "display_filter": "frame.number == 9041" }, { "frame_number": 9042, "timestamp_epoch": "1723680684.514901000", "display_filter": "frame.number == 9042" }, { "frame_number": 9178, "timestamp_epoch": "1723680684.717004000", "display_filter": "frame.number == 9178" }, { "frame_number": 10207, "timestamp_epoch": "1723680687.529821000", "display_filter": "frame.number == 10207" }, { "frame_number": 10208, "timestamp_epoch": "1723680687.530376000", "display_filter": "frame.number == 10208" }, { "frame_number": 10886, "timestamp_epoch": "1723680738.774571000", "display_filter": "frame.number == 10886" }, { "frame_number": 10889, "timestamp_epoch": "1723680739.785805000", "display_filter": "frame.number == 10889" }, { "frame_number": 10890, "timestamp_epoch": "1723680740.801288000", "display_filter": "frame.number == 10890" }, { "frame_number": 10893, "timestamp_epoch": "1723680741.801367000", "display_filter": "frame.number == 10893" }, { "frame_number": 12132, "timestamp_epoch": "1723680858.790096000", "display_filter": "frame.number == 12132" }, { "frame_number": 12133, "timestamp_epoch": "1723680859.802600000", "display_filter": "frame.number == 12133" }, { "frame_number": 12134, "timestamp_epoch": "1723680860.818073000", "display_filter": "frame.number == 12134" }, { "frame_number": 12137, "timestamp_epoch": "1723680861.818104000", "display_filter": "frame.number == 12137" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1696a1526564699f96b661f8", "type": "url", "value": "http://72.5.43.29/", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1723680780.664378000", "last_seen_epoch": "1723682545.821716000", "evidence": [ { "frame_number": 11028, "timestamp_epoch": "1723680780.664378000", "display_filter": "frame.number == 11028", "tcp_stream": 142 }, { "frame_number": 11032, "timestamp_epoch": "1723680780.868295000", "display_filter": "frame.number == 11032", "tcp_stream": 142 }, { "frame_number": 11463, "timestamp_epoch": "1723680782.262324000", "display_filter": "frame.number == 11463", "tcp_stream": 143 }, { "frame_number": 11496, "timestamp_epoch": "1723680782.865019000", "display_filter": "frame.number == 11496", "tcp_stream": 144 }, { "frame_number": 11505, "timestamp_epoch": "1723680787.999666000", "display_filter": "frame.number == 11505", "tcp_stream": 145 }, { "frame_number": 11619, "timestamp_epoch": "1723680793.850601000", "display_filter": "frame.number == 11619", "tcp_stream": 151 }, { "frame_number": 11688, "timestamp_epoch": "1723680797.315577000", "display_filter": "frame.number == 11688", "tcp_stream": 155 }, { "frame_number": 11962, "timestamp_epoch": "1723680804.254102000", "display_filter": "frame.number == 11962", "tcp_stream": 164 }, { "frame_number": 11974, "timestamp_epoch": "1723680809.944683000", "display_filter": "frame.number == 11974", "tcp_stream": 165 }, { "frame_number": 11993, "timestamp_epoch": "1723680817.194861000", "display_filter": "frame.number == 11993", "tcp_stream": 166 }, { "frame_number": 12004, "timestamp_epoch": "1723680823.591854000", "display_filter": "frame.number == 12004", "tcp_stream": 167 }, { "frame_number": 12017, "timestamp_epoch": "1723680829.193045000", "display_filter": "frame.number == 12017", "tcp_stream": 168 }, { "frame_number": 12032, "timestamp_epoch": "1723680835.214191000", "display_filter": "frame.number == 12032", "tcp_stream": 169 }, { "frame_number": 12045, "timestamp_epoch": "1723680839.081492000", "display_filter": "frame.number == 12045", "tcp_stream": 170 }, { "frame_number": 12060, "timestamp_epoch": "1723680843.782430000", "display_filter": "frame.number == 12060", "tcp_stream": 171 }, { "frame_number": 12072, "timestamp_epoch": "1723680847.998603000", "display_filter": "frame.number == 12072", "tcp_stream": 172 }, { "frame_number": 12087, "timestamp_epoch": "1723680852.361708000", "display_filter": "frame.number == 12087", "tcp_stream": 173 }, { "frame_number": 12096, "timestamp_epoch": "1723680857.007048000", "display_filter": "frame.number == 12096", "tcp_stream": 174 }, { "frame_number": 12141, "timestamp_epoch": "1723680862.196492000", "display_filter": "frame.number == 12141", "tcp_stream": 176 }, { "frame_number": 12154, "timestamp_epoch": "1723680868.478805000", "display_filter": "frame.number == 12154", "tcp_stream": 177 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-00ea24cdba6f312c0eed5a96", "type": "url", "value": "http://72.5.43.29/data/0f60a3e7baecf2748b1c8183ed37d1e4", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1723680719.744428000", "last_seen_epoch": "1723680719.960393000", "evidence": [ { "frame_number": 10611, "timestamp_epoch": "1723680719.744428000", "display_filter": "frame.number == 10611", "tcp_stream": 134 }, { "frame_number": 10614, "timestamp_epoch": "1723680719.960393000", "display_filter": "frame.number == 10614", "tcp_stream": 134 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0d930928a9317c9b1ef79bcc", "type": "url", "value": "http://acroipm2.adobe.com/assets/Owner/arm/ProcessMAU.txt", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1723681329.890743000", "last_seen_epoch": "1723681329.890743000", "evidence": [ { "frame_number": 15345, "timestamp_epoch": "1723681329.890743000", "display_filter": "frame.number == 15345", "tcp_stream": 300 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-93052f78569936293b8ae325", "type": "url", "value": "http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8f2381c2-652d-48a2-86f6-19cb7757f5dc?P1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1723680685.801254000", "last_seen_epoch": "1723680690.407477000", "evidence": [ { "frame_number": 10198, "timestamp_epoch": "1723680685.801254000", "display_filter": "frame.number == 10198", "tcp_stream": 127 }, { "frame_number": 10201, "timestamp_epoch": "1723680685.861043000", "display_filter": "frame.number == 10201", "tcp_stream": 127 }, { "frame_number": 10209, "timestamp_epoch": "1723680687.970979000", "display_filter": "frame.number == 10209", "tcp_stream": 127 }, { "frame_number": 10214, "timestamp_epoch": "1723680689.189501000", "display_filter": "frame.number == 10214", "tcp_stream": 127 }, { "frame_number": 10222, "timestamp_epoch": "1723680690.407477000", "display_filter": "frame.number == 10222", "tcp_stream": 127 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-de440d3208321aa25cab0789", "type": "url", "value": "http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6?P1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1723680706.416178000", "last_seen_epoch": "1723680711.070632000", "evidence": [ { "frame_number": 10278, "timestamp_epoch": "1723680706.416178000", "display_filter": "frame.number == 10278", "tcp_stream": 127 }, { "frame_number": 10284, "timestamp_epoch": "1723680706.545976000", "display_filter": "frame.number == 10284", "tcp_stream": 127 }, { "frame_number": 10407, "timestamp_epoch": "1723680708.884758000", "display_filter": "frame.number == 10407", "tcp_stream": 127 }, { "frame_number": 10454, "timestamp_epoch": "1723680709.993124000", "display_filter": "frame.number == 10454", "tcp_stream": 127 }, { "frame_number": 10483, "timestamp_epoch": "1723680711.070632000", "display_filter": "frame.number == 10483", "tcp_stream": 127 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-88617100b6a558f55f0f5b3e", "type": "url", "value": "http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBR2JNtr0JxEvYySpbyBWaqBmealCgQUzhUWO%2BoCo6Zr2tkr%2FeWMUr56UKgCEzMAPnPpacmgFoSqVQMAAAA%2Bc%2Bk%3D", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1723681517.670816000", "last_seen_epoch": "1723681517.670816000", "evidence": [ { "frame_number": 15884, "timestamp_epoch": "1723681517.670816000", "display_filter": "frame.number == 15884", "tcp_stream": 339 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-387c869916fcf35badbc654a", "type": "url", "value": "http://quote.checkfedexexp.com/managements?16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1723680658.536866000", "last_seen_epoch": "1723680658.536866000", "evidence": [ { "frame_number": 6418, "timestamp_epoch": "1723680658.536866000", "display_filter": "frame.number == 6418", "tcp_stream": 112 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a20b2287735de432ee396482", "type": "url", "value": "http://www.msftconnecttest.com/connecttest.txt", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1723680585.124763000", "last_seen_epoch": "1723680585.124763000", "evidence": [ { "frame_number": 66, "timestamp_epoch": "1723680585.124763000", "display_filter": "frame.number == 66", "tcp_stream": 2 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7bd30066fd261a455d0f6386", "type": "user_agent", "value": "Microsoft BITS/7.8", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1723680685.801254000", "last_seen_epoch": "1723680719.960393000", "evidence": [ { "frame_number": 10198, "timestamp_epoch": "1723680685.801254000", "display_filter": "frame.number == 10198", "tcp_stream": 127 }, { "frame_number": 10201, "timestamp_epoch": "1723680685.861043000", "display_filter": "frame.number == 10201", "tcp_stream": 127 }, { "frame_number": 10209, "timestamp_epoch": "1723680687.970979000", "display_filter": "frame.number == 10209", "tcp_stream": 127 }, { "frame_number": 10214, "timestamp_epoch": "1723680689.189501000", "display_filter": "frame.number == 10214", "tcp_stream": 127 }, { "frame_number": 10222, "timestamp_epoch": "1723680690.407477000", "display_filter": "frame.number == 10222", "tcp_stream": 127 }, { "frame_number": 10278, "timestamp_epoch": "1723680706.416178000", "display_filter": "frame.number == 10278", "tcp_stream": 127 }, { "frame_number": 10284, "timestamp_epoch": "1723680706.545976000", "display_filter": "frame.number == 10284", "tcp_stream": 127 }, { "frame_number": 10407, "timestamp_epoch": "1723680708.884758000", "display_filter": "frame.number == 10407", "tcp_stream": 127 }, { "frame_number": 10454, "timestamp_epoch": "1723680709.993124000", "display_filter": "frame.number == 10454", "tcp_stream": 127 }, { "frame_number": 10483, "timestamp_epoch": "1723680711.070632000", "display_filter": "frame.number == 10483", "tcp_stream": 127 }, { "frame_number": 10611, "timestamp_epoch": "1723680719.744428000", "display_filter": "frame.number == 10611", "tcp_stream": 134 }, { "frame_number": 10614, "timestamp_epoch": "1723680719.960393000", "display_filter": "frame.number == 10614", "tcp_stream": 134 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-328879c7adabe7926b6e316b", "type": "user_agent", "value": "Microsoft Edge/127.0.2651.98 Windows", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1723680618.769208000", "last_seen_epoch": "1723682541.976598000", "evidence": [ { "frame_number": 2104, "timestamp_epoch": "1723680618.769208000", "display_filter": "frame.number == 2104" }, { "frame_number": 2328, "timestamp_epoch": "1723680619.776640000", "display_filter": "frame.number == 2328" }, { "frame_number": 2700, "timestamp_epoch": "1723680620.776682000", "display_filter": "frame.number == 2700" }, { "frame_number": 2972, "timestamp_epoch": "1723680621.781943000", "display_filter": "frame.number == 2972" }, { "frame_number": 10886, "timestamp_epoch": "1723680738.774571000", "display_filter": "frame.number == 10886" }, { "frame_number": 10889, "timestamp_epoch": "1723680739.785805000", "display_filter": "frame.number == 10889" }, { "frame_number": 10890, "timestamp_epoch": "1723680740.801288000", "display_filter": "frame.number == 10890" }, { "frame_number": 10893, "timestamp_epoch": "1723680741.801367000", "display_filter": "frame.number == 10893" }, { "frame_number": 12132, "timestamp_epoch": "1723680858.790096000", "display_filter": "frame.number == 12132" }, { "frame_number": 12133, "timestamp_epoch": "1723680859.802600000", "display_filter": "frame.number == 12133" }, { "frame_number": 12134, "timestamp_epoch": "1723680860.818073000", "display_filter": "frame.number == 12134" }, { "frame_number": 12137, "timestamp_epoch": "1723680861.818104000", "display_filter": "frame.number == 12137" }, { "frame_number": 13641, "timestamp_epoch": "1723680978.797257000", "display_filter": "frame.number == 13641" }, { "frame_number": 13644, "timestamp_epoch": "1723680979.808885000", "display_filter": "frame.number == 13644" }, { "frame_number": 13645, "timestamp_epoch": "1723680980.809112000", "display_filter": "frame.number == 13645" }, { "frame_number": 13647, "timestamp_epoch": "1723680981.824794000", "display_filter": "frame.number == 13647" }, { "frame_number": 14352, "timestamp_epoch": "1723681098.811138000", "display_filter": "frame.number == 14352" }, { "frame_number": 14353, "timestamp_epoch": "1723681099.821200000", "display_filter": "frame.number == 14353" }, { "frame_number": 14354, "timestamp_epoch": "1723681100.836638000", "display_filter": "frame.number == 14354" }, { "frame_number": 14365, "timestamp_epoch": "1723681101.836854000", "display_filter": "frame.number == 14365" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1f1466099efdd0cc682b4be8", "type": "user_agent", "value": "Microsoft NCSI", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1723680585.124763000", "last_seen_epoch": "1723680585.124763000", "evidence": [ { "frame_number": 66, "timestamp_epoch": "1723680585.124763000", "display_filter": "frame.number == 66", "tcp_stream": 2 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-082f8af5c4bb75e3c701c3bc", "type": "user_agent", "value": "Microsoft-CryptoAPI/10.0", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1723681517.670816000", "last_seen_epoch": "1723681517.670816000", "evidence": [ { "frame_number": 15884, "timestamp_epoch": "1723681517.670816000", "display_filter": "frame.number == 15884", "tcp_stream": 339 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-fe8de16fd9163ddb40b6ae05", "type": "user_agent", "value": "Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1723680780.664378000", "last_seen_epoch": "1723682545.821716000", "evidence": [ { "frame_number": 11028, "timestamp_epoch": "1723680780.664378000", "display_filter": "frame.number == 11028", "tcp_stream": 142 }, { "frame_number": 11032, "timestamp_epoch": "1723680780.868295000", "display_filter": "frame.number == 11032", "tcp_stream": 142 }, { "frame_number": 11463, "timestamp_epoch": "1723680782.262324000", "display_filter": "frame.number == 11463", "tcp_stream": 143 }, { "frame_number": 11496, "timestamp_epoch": "1723680782.865019000", "display_filter": "frame.number == 11496", "tcp_stream": 144 }, { "frame_number": 11505, "timestamp_epoch": "1723680787.999666000", "display_filter": "frame.number == 11505", "tcp_stream": 145 }, { "frame_number": 11619, "timestamp_epoch": "1723680793.850601000", "display_filter": "frame.number == 11619", "tcp_stream": 151 }, { "frame_number": 11688, "timestamp_epoch": "1723680797.315577000", "display_filter": "frame.number == 11688", "tcp_stream": 155 }, { "frame_number": 11962, "timestamp_epoch": "1723680804.254102000", "display_filter": "frame.number == 11962", "tcp_stream": 164 }, { "frame_number": 11974, "timestamp_epoch": "1723680809.944683000", "display_filter": "frame.number == 11974", "tcp_stream": 165 }, { "frame_number": 11993, "timestamp_epoch": "1723680817.194861000", "display_filter": "frame.number == 11993", "tcp_stream": 166 }, { "frame_number": 12004, "timestamp_epoch": "1723680823.591854000", "display_filter": "frame.number == 12004", "tcp_stream": 167 }, { "frame_number": 12017, "timestamp_epoch": "1723680829.193045000", "display_filter": "frame.number == 12017", "tcp_stream": 168 }, { "frame_number": 12032, "timestamp_epoch": "1723680835.214191000", "display_filter": "frame.number == 12032", "tcp_stream": 169 }, { "frame_number": 12045, "timestamp_epoch": "1723680839.081492000", "display_filter": "frame.number == 12045", "tcp_stream": 170 }, { "frame_number": 12060, "timestamp_epoch": "1723680843.782430000", "display_filter": "frame.number == 12060", "tcp_stream": 171 }, { "frame_number": 12072, "timestamp_epoch": "1723680847.998603000", "display_filter": "frame.number == 12072", "tcp_stream": 172 }, { "frame_number": 12087, "timestamp_epoch": "1723680852.361708000", "display_filter": "frame.number == 12087", "tcp_stream": 173 }, { "frame_number": 12096, "timestamp_epoch": "1723680857.007048000", "display_filter": "frame.number == 12096", "tcp_stream": 174 }, { "frame_number": 12141, "timestamp_epoch": "1723680862.196492000", "display_filter": "frame.number == 12141", "tcp_stream": 176 }, { "frame_number": 12154, "timestamp_epoch": "1723680868.478805000", "display_filter": "frame.number == 12154", "tcp_stream": 177 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b845c921b7cd151cfd24b648", "type": "user_agent", "value": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E)", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1723681329.890743000", "last_seen_epoch": "1723681329.890743000", "evidence": [ { "frame_number": 15345, "timestamp_epoch": "1723681329.890743000", "display_filter": "frame.number == 15345", "tcp_stream": 300 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1134604422fd6570705c735b", "type": "user_agent", "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1723680658.536866000", "last_seen_epoch": "1723680658.536866000", "evidence": [ { "frame_number": 6418, "timestamp_epoch": "1723680658.536866000", "display_filter": "frame.number == 6418", "tcp_stream": 112 } ], "enrichment_state": "not_requested" } ], "findings": [ { "finding_id": "finding-11a7e4318835eb1c13fc1c02", "rule_id": "periodic-http-callbacks", "rule_version": "pcap-rules-v3", "severity": "high", "title": "Periodic HTTP callback pattern", "explanation": "Repeated requests have a stable cadence consistent with automated callback or beacon behavior.", "confidence": 0.88, "status": "candidate", "evidence": [ { "frame_number": 11028, "timestamp_epoch": "1723680780.664378000", "display_filter": "frame.number == 11028", "tcp_stream": 142 }, { "frame_number": 11505, "timestamp_epoch": "1723680787.999666000", "display_filter": "frame.number == 11505", "tcp_stream": 145 }, { "frame_number": 11619, "timestamp_epoch": "1723680793.850601000", "display_filter": "frame.number == 11619", "tcp_stream": 151 }, { "frame_number": 11688, "timestamp_epoch": "1723680797.315577000", "display_filter": "frame.number == 11688", "tcp_stream": 155 }, { "frame_number": 11962, "timestamp_epoch": "1723680804.254102000", "display_filter": "frame.number == 11962", "tcp_stream": 164 }, { "frame_number": 11974, "timestamp_epoch": "1723680809.944683000", "display_filter": "frame.number == 11974", "tcp_stream": 165 }, { "frame_number": 11993, "timestamp_epoch": "1723680817.194861000", "display_filter": "frame.number == 11993", "tcp_stream": 166 }, { "frame_number": 12004, "timestamp_epoch": "1723680823.591854000", "display_filter": "frame.number == 12004", "tcp_stream": 167 }, { "frame_number": 12017, "timestamp_epoch": "1723680829.193045000", "display_filter": "frame.number == 12017", "tcp_stream": 168 }, { "frame_number": 12032, "timestamp_epoch": "1723680835.214191000", "display_filter": "frame.number == 12032", "tcp_stream": 169 }, { "frame_number": 12045, "timestamp_epoch": "1723680839.081492000", "display_filter": "frame.number == 12045", "tcp_stream": 170 }, { "frame_number": 12060, "timestamp_epoch": "1723680843.782430000", "display_filter": "frame.number == 12060", "tcp_stream": 171 }, { "frame_number": 12072, "timestamp_epoch": "1723680847.998603000", "display_filter": "frame.number == 12072", "tcp_stream": 172 }, { "frame_number": 12087, "timestamp_epoch": "1723680852.361708000", "display_filter": "frame.number == 12087", "tcp_stream": 173 }, { "frame_number": 12096, "timestamp_epoch": "1723680857.007048000", "display_filter": "frame.number == 12096", "tcp_stream": 174 }, { "frame_number": 12141, "timestamp_epoch": "1723680862.196492000", "display_filter": "frame.number == 12141", "tcp_stream": 176 }, { "frame_number": 12154, "timestamp_epoch": "1723680868.478805000", "display_filter": "frame.number == 12154", "tcp_stream": 177 }, { "frame_number": 12164, "timestamp_epoch": "1723680872.853090000", "display_filter": "frame.number == 12164", "tcp_stream": 178 }, { "frame_number": 12175, "timestamp_epoch": "1723680878.604245000", "display_filter": "frame.number == 12175", "tcp_stream": 179 }, { "frame_number": 12186, "timestamp_epoch": "1723680886.067560000", "display_filter": "frame.number == 12186", "tcp_stream": 180 }, { "frame_number": 12200, "timestamp_epoch": "1723680893.807805000", "display_filter": "frame.number == 12200", "tcp_stream": 181 }, { "frame_number": 12242, "timestamp_epoch": "1723680900.014338000", "display_filter": "frame.number == 12242", "tcp_stream": 183 }, { "frame_number": 12253, "timestamp_epoch": "1723680907.248656000", "display_filter": "frame.number == 12253", "tcp_stream": 184 }, { "frame_number": 13263, "timestamp_epoch": "1723680913.542763000", "display_filter": "frame.number == 13263", "tcp_stream": 206 }, { "frame_number": 13589, "timestamp_epoch": "1723680917.980065000", "display_filter": "frame.number == 13589", "tcp_stream": 207 }, { "frame_number": 13609, "timestamp_epoch": "1723680923.254494000", "display_filter": "frame.number == 13609", "tcp_stream": 208 }, { "frame_number": 13635, "timestamp_epoch": "1723680975.818959000", "display_filter": "frame.number == 13635", "tcp_stream": 209 }, { "frame_number": 13655, "timestamp_epoch": "1723680982.660112000", "display_filter": "frame.number == 13655", "tcp_stream": 210 }, { "frame_number": 13739, "timestamp_epoch": "1723680986.523941000", "display_filter": "frame.number == 13739", "tcp_stream": 215 }, { "frame_number": 13911, "timestamp_epoch": "1723680990.391966000", "display_filter": "frame.number == 13911", "tcp_stream": 222 }, { "frame_number": 14070, "timestamp_epoch": "1723680994.843801000", "display_filter": "frame.number == 14070", "tcp_stream": 225 }, { "frame_number": 14091, "timestamp_epoch": "1723681000.674471000", "display_filter": "frame.number == 14091", "tcp_stream": 226 }, { "frame_number": 14138, "timestamp_epoch": "1723681006.223359000", "display_filter": "frame.number == 14138", "tcp_stream": 228 }, { "frame_number": 14178, "timestamp_epoch": "1723681013.189457000", "display_filter": "frame.number == 14178", "tcp_stream": 230 }, { "frame_number": 14189, "timestamp_epoch": "1723681018.917530000", "display_filter": "frame.number == 14189", "tcp_stream": 231 }, { "frame_number": 14201, "timestamp_epoch": "1723681026.263547000", "display_filter": "frame.number == 14201", "tcp_stream": 232 }, { "frame_number": 14210, "timestamp_epoch": "1723681032.790381000", "display_filter": "frame.number == 14210", "tcp_stream": 233 }, { "frame_number": 14221, "timestamp_epoch": "1723681037.630532000", "display_filter": "frame.number == 14221", "tcp_stream": 234 }, { "frame_number": 14254, "timestamp_epoch": "1723681043.230910000", "display_filter": "frame.number == 14254", "tcp_stream": 236 }, { "frame_number": 14263, "timestamp_epoch": "1723681050.323085000", "display_filter": "frame.number == 14263", "tcp_stream": 237 }, { "frame_number": 14272, "timestamp_epoch": "1723681056.322087000", "display_filter": "frame.number == 14272", "tcp_stream": 238 }, { "frame_number": 14281, "timestamp_epoch": "1723681060.099936000", "display_filter": "frame.number == 14281", "tcp_stream": 239 }, { "frame_number": 14290, "timestamp_epoch": "1723681063.593064000", "display_filter": "frame.number == 14290", "tcp_stream": 240 }, { "frame_number": 14301, "timestamp_epoch": "1723681070.563338000", "display_filter": "frame.number == 14301", "tcp_stream": 241 }, { "frame_number": 14312, "timestamp_epoch": "1723681076.331728000", "display_filter": "frame.number == 14312", "tcp_stream": 242 }, { "frame_number": 14324, "timestamp_epoch": "1723681083.743242000", "display_filter": "frame.number == 14324", "tcp_stream": 243 }, { "frame_number": 14335, "timestamp_epoch": "1723681090.400183000", "display_filter": "frame.number == 14335", "tcp_stream": 244 }, { "frame_number": 14344, "timestamp_epoch": "1723681095.477626000", "display_filter": "frame.number == 14344", "tcp_stream": 245 }, { "frame_number": 14358, "timestamp_epoch": "1723681101.539859000", "display_filter": "frame.number == 14358", "tcp_stream": 246 }, { "frame_number": 14373, "timestamp_epoch": "1723681105.503006000", "display_filter": "frame.number == 14373", "tcp_stream": 247 }, { "frame_number": 14383, "timestamp_epoch": "1723681109.332869000", "display_filter": "frame.number == 14383", "tcp_stream": 248 }, { "frame_number": 14394, "timestamp_epoch": "1723681112.883107000", "display_filter": "frame.number == 14394", "tcp_stream": 249 }, { "frame_number": 14406, "timestamp_epoch": "1723681119.999894000", "display_filter": "frame.number == 14406", "tcp_stream": 250 }, { "frame_number": 14415, "timestamp_epoch": "1723681126.022041000", "display_filter": "frame.number == 14415", "tcp_stream": 251 }, { "frame_number": 14424, "timestamp_epoch": "1723681129.862278000", "display_filter": "frame.number == 14424", "tcp_stream": 252 }, { "frame_number": 14437, "timestamp_epoch": "1723681133.454087000", "display_filter": "frame.number == 14437", "tcp_stream": 253 }, { "frame_number": 14450, "timestamp_epoch": "1723681140.654390000", "display_filter": "frame.number == 14450", "tcp_stream": 254 }, { "frame_number": 14459, "timestamp_epoch": "1723681146.895398000", "display_filter": "frame.number == 14459", "tcp_stream": 255 }, { "frame_number": 14470, "timestamp_epoch": "1723681151.153685000", "display_filter": "frame.number == 14470", "tcp_stream": 256 }, { "frame_number": 14647, "timestamp_epoch": "1723681155.562098000", "display_filter": "frame.number == 14647", "tcp_stream": 261 }, { "frame_number": 14675, "timestamp_epoch": "1723681160.282703000", "display_filter": "frame.number == 14675", "tcp_stream": 263 }, { "frame_number": 14698, "timestamp_epoch": "1723681165.914795000", "display_filter": "frame.number == 14698", "tcp_stream": 264 }, { "frame_number": 14707, "timestamp_epoch": "1723681172.798210000", "display_filter": "frame.number == 14707", "tcp_stream": 265 }, { "frame_number": 14719, "timestamp_epoch": "1723681179.882767000", "display_filter": "frame.number == 14719", "tcp_stream": 266 }, { "frame_number": 14736, "timestamp_epoch": "1723681184.875518000", "display_filter": "frame.number == 14736", "tcp_stream": 267 }, { "frame_number": 14760, "timestamp_epoch": "1723681190.222347000", "display_filter": "frame.number == 14760", "tcp_stream": 268 }, { "frame_number": 14792, "timestamp_epoch": "1723681196.830819000", "display_filter": "frame.number == 14792", "tcp_stream": 270 }, { "frame_number": 14806, "timestamp_epoch": "1723681201.842354000", "display_filter": "frame.number == 14806", "tcp_stream": 271 }, { "frame_number": 14921, "timestamp_epoch": "1723681209.572065000", "display_filter": "frame.number == 14921", "tcp_stream": 272 }, { "frame_number": 14962, "timestamp_epoch": "1723681215.076361000", "display_filter": "frame.number == 14962", "tcp_stream": 274 }, { "frame_number": 14979, "timestamp_epoch": "1723681221.962481000", "display_filter": "frame.number == 14979", "tcp_stream": 275 }, { "frame_number": 14989, "timestamp_epoch": "1723681227.561961000", "display_filter": "frame.number == 14989", "tcp_stream": 276 }, { "frame_number": 14999, "timestamp_epoch": "1723681234.695176000", "display_filter": "frame.number == 14999", "tcp_stream": 277 }, { "frame_number": 15010, "timestamp_epoch": "1723681240.762230000", "display_filter": "frame.number == 15010", "tcp_stream": 278 }, { "frame_number": 15021, "timestamp_epoch": "1723681244.681707000", "display_filter": "frame.number == 15021", "tcp_stream": 279 }, { "frame_number": 15037, "timestamp_epoch": "1723681250.455053000", "display_filter": "frame.number == 15037", "tcp_stream": 280 }, { "frame_number": 15047, "timestamp_epoch": "1723681255.848643000", "display_filter": "frame.number == 15047", "tcp_stream": 281 }, { "frame_number": 15060, "timestamp_epoch": "1723681262.791423000", "display_filter": "frame.number == 15060", "tcp_stream": 282 }, { "frame_number": 15078, "timestamp_epoch": "1723681269.649464000", "display_filter": "frame.number == 15078", "tcp_stream": 283 }, { "frame_number": 15089, "timestamp_epoch": "1723681273.870863000", "display_filter": "frame.number == 15089", "tcp_stream": 284 }, { "frame_number": 15098, "timestamp_epoch": "1723681278.112448000", "display_filter": "frame.number == 15098", "tcp_stream": 285 }, { "frame_number": 15122, "timestamp_epoch": "1723681282.733454000", "display_filter": "frame.number == 15122", "tcp_stream": 286 }, { "frame_number": 15170, "timestamp_epoch": "1723681287.618414000", "display_filter": "frame.number == 15170", "tcp_stream": 288 }, { "frame_number": 15206, "timestamp_epoch": "1723681294.874856000", "display_filter": "frame.number == 15206", "tcp_stream": 290 }, { "frame_number": 15217, "timestamp_epoch": "1723681299.634243000", "display_filter": "frame.number == 15217", "tcp_stream": 291 }, { "frame_number": 15250, "timestamp_epoch": "1723681305.055347000", "display_filter": "frame.number == 15250", "tcp_stream": 294 }, { "frame_number": 15260, "timestamp_epoch": "1723681311.776154000", "display_filter": "frame.number == 15260", "tcp_stream": 295 }, { "frame_number": 15311, "timestamp_epoch": "1723681318.536068000", "display_filter": "frame.number == 15311", "tcp_stream": 297 }, { "frame_number": 15320, "timestamp_epoch": "1723681322.887261000", "display_filter": "frame.number == 15320", "tcp_stream": 298 }, { "frame_number": 15332, "timestamp_epoch": "1723681328.595654000", "display_filter": "frame.number == 15332", "tcp_stream": 299 }, { "frame_number": 15375, "timestamp_epoch": "1723681334.274261000", "display_filter": "frame.number == 15375", "tcp_stream": 302 }, { "frame_number": 15391, "timestamp_epoch": "1723681341.576410000", "display_filter": "frame.number == 15391", "tcp_stream": 303 }, { "frame_number": 15405, "timestamp_epoch": "1723681347.954525000", "display_filter": "frame.number == 15405", "tcp_stream": 304 }, { "frame_number": 15414, "timestamp_epoch": "1723681352.496784000", "display_filter": "frame.number == 15414", "tcp_stream": 305 }, { "frame_number": 15423, "timestamp_epoch": "1723681357.516311000", "display_filter": "frame.number == 15423", "tcp_stream": 306 }, { "frame_number": 15434, "timestamp_epoch": "1723681363.438478000", "display_filter": "frame.number == 15434", "tcp_stream": 307 }, { "frame_number": 15443, "timestamp_epoch": "1723681367.610722000", "display_filter": "frame.number == 15443", "tcp_stream": 308 }, { "frame_number": 15454, "timestamp_epoch": "1723681372.837324000", "display_filter": "frame.number == 15454", "tcp_stream": 309 }, { "frame_number": 15463, "timestamp_epoch": "1723681377.723785000", "display_filter": "frame.number == 15463", "tcp_stream": 310 }, { "frame_number": 15492, "timestamp_epoch": "1723681383.397047000", "display_filter": "frame.number == 15492", "tcp_stream": 312 } ], "metrics": { "request_count": 303, "median_interval_seconds": 5.685, "median_absolute_deviation": 1.037, "source": "10.8.15.133", "destination": "72.5.43.29", "port": 80, "host": "72.5.43.29", "uri": "/", "method": "GET" } }, { "finding_id": "finding-90a3532518006ab5a519468a", "rule_id": "repeated-nxdomain", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Repeated unsuccessful DNS resolution", "explanation": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.", "confidence": 0.5, "status": "candidate", "evidence": [ { "frame_number": 56, "timestamp_epoch": "1723680584.978533000", "display_filter": "frame.number == 56", "udp_stream": 9 }, { "frame_number": 60, "timestamp_epoch": "1723680584.996370000", "display_filter": "frame.number == 60", "udp_stream": 10 }, { "frame_number": 962, "timestamp_epoch": "1723680599.997451000", "display_filter": "frame.number == 962", "udp_stream": 14 }, { "frame_number": 964, "timestamp_epoch": "1723680600.044261000", "display_filter": "frame.number == 964", "udp_stream": 20 }, { "frame_number": 2106, "timestamp_epoch": "1723680618.772193000", "display_filter": "frame.number == 2106", "udp_stream": 22 }, { "frame_number": 3576, "timestamp_epoch": "1723680626.785646000", "display_filter": "frame.number == 3576", "udp_stream": 14 }, { "frame_number": 6439, "timestamp_epoch": "1723680660.000329000", "display_filter": "frame.number == 6439", "udp_stream": 38 }, { "frame_number": 6441, "timestamp_epoch": "1723680660.047965000", "display_filter": "frame.number == 6441", "udp_stream": 20 }, { "frame_number": 6459, "timestamp_epoch": "1723680661.692095000", "display_filter": "frame.number == 6459", "udp_stream": 14 }, { "frame_number": 12209, "timestamp_epoch": "1723680895.684574000", "display_filter": "frame.number == 12209", "udp_stream": 100 }, { "frame_number": 12410, "timestamp_epoch": "1723680911.067621000", "display_filter": "frame.number == 12410", "udp_stream": 100 }, { "frame_number": 13598, "timestamp_epoch": "1723680919.077883000", "display_filter": "frame.number == 13598", "udp_stream": 100 }, { "frame_number": 15054, "timestamp_epoch": "1723681260.039606000", "display_filter": "frame.number == 15054", "udp_stream": 133 }, { "frame_number": 15056, "timestamp_epoch": "1723681260.083829000", "display_filter": "frame.number == 15056", "udp_stream": 20 }, { "frame_number": 15370, "timestamp_epoch": "1723681330.394345000", "display_filter": "frame.number == 15370", "udp_stream": 136 }, { "frame_number": 15382, "timestamp_epoch": "1723681338.397619000", "display_filter": "frame.number == 15382", "udp_stream": 136 }, { "frame_number": 16701, "timestamp_epoch": "1723681860.125139000", "display_filter": "frame.number == 16701", "udp_stream": 20 }, { "frame_number": 16703, "timestamp_epoch": "1723681860.169001000", "display_filter": "frame.number == 16703", "udp_stream": 145 }, { "frame_number": 18011, "timestamp_epoch": "1723682460.198419000", "display_filter": "frame.number == 18011", "udp_stream": 151 }, { "frame_number": 18013, "timestamp_epoch": "1723682460.256763000", "display_filter": "frame.number == 18013", "udp_stream": 20 } ], "metrics": { "source": "10.8.15.133", "domain": "wpad.lafontainebleu.org", "response_count": 20 } }, { "finding_id": "finding-130344072143303b93081c2d", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 281, "timestamp_epoch": "1723680586.162496000", "display_filter": "frame.number == 281", "tcp_stream": 11 }, { "frame_number": 285, "timestamp_epoch": "1723680586.163355000", "display_filter": "frame.number == 285", "tcp_stream": 11 }, { "frame_number": 292, "timestamp_epoch": "1723680586.164365000", "display_filter": "frame.number == 292", "tcp_stream": 11 }, { "frame_number": 297, "timestamp_epoch": "1723680586.165243000", "display_filter": "frame.number == 297", "tcp_stream": 11 }, { "frame_number": 312, "timestamp_epoch": "1723680586.175079000", "display_filter": "frame.number == 312", "tcp_stream": 11 }, { "frame_number": 314, "timestamp_epoch": "1723680586.183783000", "display_filter": "frame.number == 314", "tcp_stream": 11 }, { "frame_number": 316, "timestamp_epoch": "1723680586.185886000", "display_filter": "frame.number == 316", "tcp_stream": 11 }, { "frame_number": 331, "timestamp_epoch": "1723680586.222611000", "display_filter": "frame.number == 331", "tcp_stream": 11 }, { "frame_number": 335, "timestamp_epoch": "1723680586.223909000", "display_filter": "frame.number == 335", "tcp_stream": 11 }, { "frame_number": 348, "timestamp_epoch": "1723680586.231259000", "display_filter": "frame.number == 348", "tcp_stream": 11 }, { "frame_number": 405, "timestamp_epoch": "1723680586.407343000", "display_filter": "frame.number == 405", "tcp_stream": 22 }, { "frame_number": 407, "timestamp_epoch": "1723680586.408227000", "display_filter": "frame.number == 407", "tcp_stream": 22 }, { "frame_number": 411, "timestamp_epoch": "1723680586.417183000", "display_filter": "frame.number == 411", "tcp_stream": 22 }, { "frame_number": 418, "timestamp_epoch": "1723680586.419421000", "display_filter": "frame.number == 418", "tcp_stream": 22 }, { "frame_number": 423, "timestamp_epoch": "1723680586.421509000", "display_filter": "frame.number == 423", "tcp_stream": 11 }, { "frame_number": 425, "timestamp_epoch": "1723680586.422332000", "display_filter": "frame.number == 425", "tcp_stream": 11 }, { "frame_number": 427, "timestamp_epoch": "1723680586.425984000", "display_filter": "frame.number == 427", "tcp_stream": 11 }, { "frame_number": 776, "timestamp_epoch": "1723680589.063397000", "display_filter": "frame.number == 776", "tcp_stream": 35 }, { "frame_number": 778, "timestamp_epoch": "1723680589.064122000", "display_filter": "frame.number == 778", "tcp_stream": 35 }, { "frame_number": 780, "timestamp_epoch": "1723680589.064730000", "display_filter": "frame.number == 780", "tcp_stream": 35 }, { "frame_number": 784, "timestamp_epoch": "1723680589.066298000", "display_filter": "frame.number == 784", "tcp_stream": 35 }, { "frame_number": 786, "timestamp_epoch": "1723680589.066760000", "display_filter": "frame.number == 786", "tcp_stream": 35 }, { "frame_number": 788, "timestamp_epoch": "1723680589.067268000", "display_filter": "frame.number == 788", "tcp_stream": 35 }, { "frame_number": 1022, "timestamp_epoch": "1723680608.254938000", "display_filter": "frame.number == 1022", "tcp_stream": 11 }, { "frame_number": 1024, "timestamp_epoch": "1723680608.255330000", "display_filter": "frame.number == 1024", "tcp_stream": 11 }, { "frame_number": 1026, "timestamp_epoch": "1723680608.255819000", "display_filter": "frame.number == 1026", "tcp_stream": 11 }, { "frame_number": 1028, "timestamp_epoch": "1723680608.256225000", "display_filter": "frame.number == 1028", "tcp_stream": 11 }, { "frame_number": 2170, "timestamp_epoch": "1723680619.142078000", "display_filter": "frame.number == 2170", "tcp_stream": 75 }, { "frame_number": 2173, "timestamp_epoch": "1723680619.142601000", "display_filter": "frame.number == 2173", "tcp_stream": 75 }, { "frame_number": 2176, "timestamp_epoch": "1723680619.143163000", "display_filter": "frame.number == 2176", "tcp_stream": 75 }, { "frame_number": 2184, "timestamp_epoch": "1723680619.146051000", "display_filter": "frame.number == 2184", "tcp_stream": 75 }, { "frame_number": 2186, "timestamp_epoch": "1723680619.146435000", "display_filter": "frame.number == 2186", "tcp_stream": 75 }, { "frame_number": 2188, "timestamp_epoch": "1723680619.146901000", "display_filter": "frame.number == 2188", "tcp_stream": 75 }, { "frame_number": 8771, "timestamp_epoch": "1723680669.170554000", "display_filter": "frame.number == 8771", "tcp_stream": 116 }, { "frame_number": 8773, "timestamp_epoch": "1723680669.171234000", "display_filter": "frame.number == 8773", "tcp_stream": 116 }, { "frame_number": 8775, "timestamp_epoch": "1723680669.171828000", "display_filter": "frame.number == 8775", "tcp_stream": 116 }, { "frame_number": 8779, "timestamp_epoch": "1723680669.173716000", "display_filter": "frame.number == 8779", "tcp_stream": 116 }, { "frame_number": 8781, "timestamp_epoch": "1723680669.174116000", "display_filter": "frame.number == 8781", "tcp_stream": 116 }, { "frame_number": 8783, "timestamp_epoch": "1723680669.174611000", "display_filter": "frame.number == 8783", "tcp_stream": 116 }, { "frame_number": 10324, "timestamp_epoch": "1723680707.872008000", "display_filter": "frame.number == 10324", "tcp_stream": 129 }, { "frame_number": 10326, "timestamp_epoch": "1723680707.872467000", "display_filter": "frame.number == 10326", "tcp_stream": 129 }, { "frame_number": 10328, "timestamp_epoch": "1723680707.873023000", "display_filter": "frame.number == 10328", "tcp_stream": 129 }, { "frame_number": 10332, "timestamp_epoch": "1723680707.874681000", "display_filter": "frame.number == 10332", "tcp_stream": 129 }, { "frame_number": 10334, "timestamp_epoch": "1723680707.875077000", "display_filter": "frame.number == 10334", "tcp_stream": 129 }, { "frame_number": 10336, "timestamp_epoch": "1723680707.875542000", "display_filter": "frame.number == 10336", "tcp_stream": 129 }, { "frame_number": 10792, "timestamp_epoch": "1723680726.271910000", "display_filter": "frame.number == 10792", "tcp_stream": 136 }, { "frame_number": 10794, "timestamp_epoch": "1723680726.272437000", "display_filter": "frame.number == 10794", "tcp_stream": 136 }, { "frame_number": 10796, "timestamp_epoch": "1723680726.272994000", "display_filter": "frame.number == 10796", "tcp_stream": 136 }, { "frame_number": 10800, "timestamp_epoch": "1723680726.274795000", "display_filter": "frame.number == 10800", "tcp_stream": 136 }, { "frame_number": 10802, "timestamp_epoch": "1723680726.275171000", "display_filter": "frame.number == 10802", "tcp_stream": 136 }, { "frame_number": 10804, "timestamp_epoch": "1723680726.275611000", "display_filter": "frame.number == 10804", "tcp_stream": 136 }, { "frame_number": 11542, "timestamp_epoch": "1723680793.575615000", "display_filter": "frame.number == 11542", "tcp_stream": 147 }, { "frame_number": 11544, "timestamp_epoch": "1723680793.576154000", "display_filter": "frame.number == 11544", "tcp_stream": 147 }, { "frame_number": 11546, "timestamp_epoch": "1723680793.576710000", "display_filter": "frame.number == 11546", "tcp_stream": 147 }, { "frame_number": 11550, "timestamp_epoch": "1723680793.578633000", "display_filter": "frame.number == 11550", "tcp_stream": 147 }, { "frame_number": 11552, "timestamp_epoch": "1723680793.579033000", "display_filter": "frame.number == 11552", "tcp_stream": 147 }, { "frame_number": 11554, "timestamp_epoch": "1723680793.579501000", "display_filter": "frame.number == 11554", "tcp_stream": 147 }, { "frame_number": 13681, "timestamp_epoch": "1723680984.938022000", "display_filter": "frame.number == 13681", "tcp_stream": 212 }, { "frame_number": 13683, "timestamp_epoch": "1723680984.938687000", "display_filter": "frame.number == 13683", "tcp_stream": 212 }, { "frame_number": 13685, "timestamp_epoch": "1723680984.939327000", "display_filter": "frame.number == 13685", "tcp_stream": 212 }, { "frame_number": 13689, "timestamp_epoch": "1723680984.940868000", "display_filter": "frame.number == 13689", "tcp_stream": 212 }, { "frame_number": 13691, "timestamp_epoch": "1723680984.941263000", "display_filter": "frame.number == 13691", "tcp_stream": 212 }, { "frame_number": 13693, "timestamp_epoch": "1723680984.941752000", "display_filter": "frame.number == 13693", "tcp_stream": 212 }, { "frame_number": 13766, "timestamp_epoch": "1723680987.861060000", "display_filter": "frame.number == 13766", "tcp_stream": 217 }, { "frame_number": 13768, "timestamp_epoch": "1723680987.861627000", "display_filter": "frame.number == 13768", "tcp_stream": 217 }, { "frame_number": 13770, "timestamp_epoch": "1723680987.862317000", "display_filter": "frame.number == 13770", "tcp_stream": 217 }, { "frame_number": 13774, "timestamp_epoch": "1723680987.864133000", "display_filter": "frame.number == 13774", "tcp_stream": 217 }, { "frame_number": 13776, "timestamp_epoch": "1723680987.864658000", "display_filter": "frame.number == 13776", "tcp_stream": 217 }, { "frame_number": 13778, "timestamp_epoch": "1723680987.865145000", "display_filter": "frame.number == 13778", "tcp_stream": 217 } ], "metrics": { "source": "10.8.15.133", "destination": "10.8.15.4", "protocol": "drsuapi", "event_count": 69, "operation_numbers": [ "0", "1", "12", "13", "30" ] } }, { "finding_id": "finding-72bc17359c2c979bc54cf1d2", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 37, "timestamp_epoch": "1723680584.316304000", "display_filter": "frame.number == 37", "tcp_stream": 0 }, { "frame_number": 288, "timestamp_epoch": "1723680586.163682000", "display_filter": "frame.number == 288", "tcp_stream": 19 }, { "frame_number": 295, "timestamp_epoch": "1723680586.165042000", "display_filter": "frame.number == 295", "tcp_stream": 19 }, { "frame_number": 300, "timestamp_epoch": "1723680586.167935000", "display_filter": "frame.number == 300", "tcp_stream": 19 }, { "frame_number": 304, "timestamp_epoch": "1723680586.169382000", "display_filter": "frame.number == 304", "tcp_stream": 19 }, { "frame_number": 342, "timestamp_epoch": "1723680586.228979000", "display_filter": "frame.number == 342", "tcp_stream": 0 }, { "frame_number": 350, "timestamp_epoch": "1723680586.232492000", "display_filter": "frame.number == 350", "tcp_stream": 0 }, { "frame_number": 367, "timestamp_epoch": "1723680586.333842000", "display_filter": "frame.number == 367", "tcp_stream": 19 }, { "frame_number": 434, "timestamp_epoch": "1723680586.460022000", "display_filter": "frame.number == 434", "tcp_stream": 19 }, { "frame_number": 454, "timestamp_epoch": "1723680586.566735000", "display_filter": "frame.number == 454", "tcp_stream": 19 }, { "frame_number": 461, "timestamp_epoch": "1723680586.570595000", "display_filter": "frame.number == 461", "tcp_stream": 19 }, { "frame_number": 465, "timestamp_epoch": "1723680586.571718000", "display_filter": "frame.number == 465", "tcp_stream": 19 }, { "frame_number": 467, "timestamp_epoch": "1723680586.572226000", "display_filter": "frame.number == 467", "tcp_stream": 19 }, { "frame_number": 477, "timestamp_epoch": "1723680586.858009000", "display_filter": "frame.number == 477", "tcp_stream": 27 }, { "frame_number": 482, "timestamp_epoch": "1723680586.861444000", "display_filter": "frame.number == 482", "tcp_stream": 27 }, { "frame_number": 498, "timestamp_epoch": "1723680586.918933000", "display_filter": "frame.number == 498", "tcp_stream": 27 }, { "frame_number": 504, "timestamp_epoch": "1723680586.923457000", "display_filter": "frame.number == 504", "tcp_stream": 29 }, { "frame_number": 507, "timestamp_epoch": "1723680586.925209000", "display_filter": "frame.number == 507", "tcp_stream": 29 }, { "frame_number": 509, "timestamp_epoch": "1723680586.927027000", "display_filter": "frame.number == 509", "tcp_stream": 29 }, { "frame_number": 511, "timestamp_epoch": "1723680586.927993000", "display_filter": "frame.number == 511", "tcp_stream": 27 }, { "frame_number": 669, "timestamp_epoch": "1723680587.233004000", "display_filter": "frame.number == 669", "tcp_stream": 29 }, { "frame_number": 673, "timestamp_epoch": "1723680587.260152000", "display_filter": "frame.number == 673", "tcp_stream": 27 }, { "frame_number": 805, "timestamp_epoch": "1723680589.322280000", "display_filter": "frame.number == 805", "tcp_stream": 36 }, { "frame_number": 810, "timestamp_epoch": "1723680589.324404000", "display_filter": "frame.number == 810", "tcp_stream": 36 }, { "frame_number": 813, "timestamp_epoch": "1723680589.327099000", "display_filter": "frame.number == 813", "tcp_stream": 36 }, { "frame_number": 815, "timestamp_epoch": "1723680589.327801000", "display_filter": "frame.number == 815", "tcp_stream": 36 }, { "frame_number": 817, "timestamp_epoch": "1723680589.328308000", "display_filter": "frame.number == 817", "tcp_stream": 36 }, { "frame_number": 823, "timestamp_epoch": "1723680589.330954000", "display_filter": "frame.number == 823", "tcp_stream": 37 }, { "frame_number": 826, "timestamp_epoch": "1723680589.331945000", "display_filter": "frame.number == 826", "tcp_stream": 37 }, { "frame_number": 831, "timestamp_epoch": "1723680589.332615000", "display_filter": "frame.number == 831", "tcp_stream": 37 }, { "frame_number": 833, "timestamp_epoch": "1723680589.333097000", "display_filter": "frame.number == 833", "tcp_stream": 37 }, { "frame_number": 835, "timestamp_epoch": "1723680589.333557000", "display_filter": "frame.number == 835", "tcp_stream": 36 }, { "frame_number": 892, "timestamp_epoch": "1723680594.911094000", "display_filter": "frame.number == 892", "tcp_stream": 39 }, { "frame_number": 897, "timestamp_epoch": "1723680594.913590000", "display_filter": "frame.number == 897", "tcp_stream": 39 }, { "frame_number": 900, "timestamp_epoch": "1723680594.916130000", "display_filter": "frame.number == 900", "tcp_stream": 39 }, { "frame_number": 902, "timestamp_epoch": "1723680594.916675000", "display_filter": "frame.number == 902", "tcp_stream": 39 }, { "frame_number": 904, "timestamp_epoch": "1723680594.917132000", "display_filter": "frame.number == 904", "tcp_stream": 39 }, { "frame_number": 906, "timestamp_epoch": "1723680594.917721000", "display_filter": "frame.number == 906", "tcp_stream": 39 }, { "frame_number": 908, "timestamp_epoch": "1723680594.918472000", "display_filter": "frame.number == 908", "tcp_stream": 39 }, { "frame_number": 914, "timestamp_epoch": "1723680594.931067000", "display_filter": "frame.number == 914", "tcp_stream": 40 }, { "frame_number": 917, "timestamp_epoch": "1723680594.932325000", "display_filter": "frame.number == 917", "tcp_stream": 40 }, { "frame_number": 949, "timestamp_epoch": "1723680594.937953000", "display_filter": "frame.number == 949", "tcp_stream": 40 }, { "frame_number": 951, "timestamp_epoch": "1723680594.938627000", "display_filter": "frame.number == 951", "tcp_stream": 40 }, { "frame_number": 955, "timestamp_epoch": "1723680594.939118000", "display_filter": "frame.number == 955", "tcp_stream": 39 }, { "frame_number": 1034, "timestamp_epoch": "1723680608.262175000", "display_filter": "frame.number == 1034", "tcp_stream": 48 }, { "frame_number": 1037, "timestamp_epoch": "1723680608.266520000", "display_filter": "frame.number == 1037", "tcp_stream": 48 }, { "frame_number": 1043, "timestamp_epoch": "1723680608.269420000", "display_filter": "frame.number == 1043", "tcp_stream": 49 }, { "frame_number": 1046, "timestamp_epoch": "1723680608.270460000", "display_filter": "frame.number == 1046", "tcp_stream": 49 }, { "frame_number": 1048, "timestamp_epoch": "1723680608.270835000", "display_filter": "frame.number == 1048", "tcp_stream": 49 }, { "frame_number": 1050, "timestamp_epoch": "1723680608.271287000", "display_filter": "frame.number == 1050", "tcp_stream": 48 }, { "frame_number": 1083, "timestamp_epoch": "1723680608.286720000", "display_filter": "frame.number == 1083", "tcp_stream": 49 }, { "frame_number": 1085, "timestamp_epoch": "1723680608.289999000", "display_filter": "frame.number == 1085", "tcp_stream": 48 }, { "frame_number": 2193, "timestamp_epoch": "1723680619.150261000", "display_filter": "frame.number == 2193", "tcp_stream": 76 }, { "frame_number": 2198, "timestamp_epoch": "1723680619.151800000", "display_filter": "frame.number == 2198", "tcp_stream": 76 }, { "frame_number": 2201, "timestamp_epoch": "1723680619.152947000", "display_filter": "frame.number == 2201", "tcp_stream": 76 }, { "frame_number": 2203, "timestamp_epoch": "1723680619.153458000", "display_filter": "frame.number == 2203", "tcp_stream": 76 }, { "frame_number": 2205, "timestamp_epoch": "1723680619.153878000", "display_filter": "frame.number == 2205", "tcp_stream": 76 }, { "frame_number": 2211, "timestamp_epoch": "1723680619.157530000", "display_filter": "frame.number == 2211", "tcp_stream": 77 }, { "frame_number": 2214, "timestamp_epoch": "1723680619.158686000", "display_filter": "frame.number == 2214", "tcp_stream": 77 }, { "frame_number": 2219, "timestamp_epoch": "1723680619.159464000", "display_filter": "frame.number == 2219", "tcp_stream": 77 }, { "frame_number": 2221, "timestamp_epoch": "1723680619.160052000", "display_filter": "frame.number == 2221", "tcp_stream": 77 }, { "frame_number": 2224, "timestamp_epoch": "1723680619.160335000", "display_filter": "frame.number == 2224", "tcp_stream": 76 }, { "frame_number": 8788, "timestamp_epoch": "1723680669.177116000", "display_filter": "frame.number == 8788", "tcp_stream": 117 }, { "frame_number": 8793, "timestamp_epoch": "1723680669.178289000", "display_filter": "frame.number == 8793", "tcp_stream": 117 }, { "frame_number": 8796, "timestamp_epoch": "1723680669.179482000", "display_filter": "frame.number == 8796", "tcp_stream": 117 }, { "frame_number": 8798, "timestamp_epoch": "1723680669.179947000", "display_filter": "frame.number == 8798", "tcp_stream": 117 }, { "frame_number": 8800, "timestamp_epoch": "1723680669.180357000", "display_filter": "frame.number == 8800", "tcp_stream": 117 }, { "frame_number": 8806, "timestamp_epoch": "1723680669.183217000", "display_filter": "frame.number == 8806", "tcp_stream": 118 }, { "frame_number": 8809, "timestamp_epoch": "1723680669.184395000", "display_filter": "frame.number == 8809", "tcp_stream": 118 }, { "frame_number": 8814, "timestamp_epoch": "1723680669.185005000", "display_filter": "frame.number == 8814", "tcp_stream": 118 }, { "frame_number": 8816, "timestamp_epoch": "1723680669.185491000", "display_filter": "frame.number == 8816", "tcp_stream": 118 }, { "frame_number": 8820, "timestamp_epoch": "1723680669.186001000", "display_filter": "frame.number == 8820", "tcp_stream": 117 }, { "frame_number": 10341, "timestamp_epoch": "1723680707.878189000", "display_filter": "frame.number == 10341", "tcp_stream": 130 }, { "frame_number": 10346, "timestamp_epoch": "1723680707.879339000", "display_filter": "frame.number == 10346", "tcp_stream": 130 }, { "frame_number": 10349, "timestamp_epoch": "1723680707.880452000", "display_filter": "frame.number == 10349", "tcp_stream": 130 }, { "frame_number": 10351, "timestamp_epoch": "1723680707.880893000", "display_filter": "frame.number == 10351", "tcp_stream": 130 }, { "frame_number": 10353, "timestamp_epoch": "1723680707.881264000", "display_filter": "frame.number == 10353", "tcp_stream": 130 }, { "frame_number": 10359, "timestamp_epoch": "1723680707.884542000", "display_filter": "frame.number == 10359", "tcp_stream": 131 }, { "frame_number": 10362, "timestamp_epoch": "1723680707.885559000", "display_filter": "frame.number == 10362", "tcp_stream": 131 }, { "frame_number": 10367, "timestamp_epoch": "1723680707.886071000", "display_filter": "frame.number == 10367", "tcp_stream": 131 }, { "frame_number": 10369, "timestamp_epoch": "1723680707.886516000", "display_filter": "frame.number == 10369", "tcp_stream": 131 }, { "frame_number": 10373, "timestamp_epoch": "1723680707.886942000", "display_filter": "frame.number == 10373", "tcp_stream": 130 }, { "frame_number": 10809, "timestamp_epoch": "1723680726.278208000", "display_filter": "frame.number == 10809", "tcp_stream": 137 }, { "frame_number": 10814, "timestamp_epoch": "1723680726.279327000", "display_filter": "frame.number == 10814", "tcp_stream": 137 }, { "frame_number": 10817, "timestamp_epoch": "1723680726.280306000", "display_filter": "frame.number == 10817", "tcp_stream": 137 }, { "frame_number": 10819, "timestamp_epoch": "1723680726.280781000", "display_filter": "frame.number == 10819", "tcp_stream": 137 }, { "frame_number": 10821, "timestamp_epoch": "1723680726.281165000", "display_filter": "frame.number == 10821", "tcp_stream": 137 }, { "frame_number": 10827, "timestamp_epoch": "1723680726.284604000", "display_filter": "frame.number == 10827", "tcp_stream": 138 }, { "frame_number": 10830, "timestamp_epoch": "1723680726.285727000", "display_filter": "frame.number == 10830", "tcp_stream": 138 }, { "frame_number": 10835, "timestamp_epoch": "1723680726.286321000", "display_filter": "frame.number == 10835", "tcp_stream": 138 }, { "frame_number": 10837, "timestamp_epoch": "1723680726.286818000", "display_filter": "frame.number == 10837", "tcp_stream": 138 }, { "frame_number": 10841, "timestamp_epoch": "1723680726.287221000", "display_filter": "frame.number == 10841", "tcp_stream": 137 }, { "frame_number": 11559, "timestamp_epoch": "1723680793.582099000", "display_filter": "frame.number == 11559", "tcp_stream": 148 }, { "frame_number": 11564, "timestamp_epoch": "1723680793.583308000", "display_filter": "frame.number == 11564", "tcp_stream": 148 }, { "frame_number": 11567, "timestamp_epoch": "1723680793.584848000", "display_filter": "frame.number == 11567", "tcp_stream": 148 }, { "frame_number": 11569, "timestamp_epoch": "1723680793.585396000", "display_filter": "frame.number == 11569", "tcp_stream": 148 }, { "frame_number": 11571, "timestamp_epoch": "1723680793.585855000", "display_filter": "frame.number == 11571", "tcp_stream": 148 }, { "frame_number": 11577, "timestamp_epoch": "1723680793.589691000", "display_filter": "frame.number == 11577", "tcp_stream": 149 }, { "frame_number": 11580, "timestamp_epoch": "1723680793.590821000", "display_filter": "frame.number == 11580", "tcp_stream": 149 }, { "frame_number": 11585, "timestamp_epoch": "1723680793.591360000", "display_filter": "frame.number == 11585", "tcp_stream": 149 } ], "metrics": { "source": "10.8.15.133", "destination": "10.8.15.4", "protocol": "ldap", "event_count": 143, "operation_numbers": [ "", "0", "2", "3" ] } }, { "finding_id": "finding-d35456ec17991fe1b149580c", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 1096, "timestamp_epoch": "1723680608.292494000", "display_filter": "frame.number == 1096", "tcp_stream": 1 }, { "frame_number": 1098, "timestamp_epoch": "1723680608.293037000", "display_filter": "frame.number == 1098", "tcp_stream": 1 }, { "frame_number": 1100, "timestamp_epoch": "1723680608.293468000", "display_filter": "frame.number == 1100", "tcp_stream": 1 }, { "frame_number": 1102, "timestamp_epoch": "1723680608.294014000", "display_filter": "frame.number == 1102", "tcp_stream": 1 }, { "frame_number": 1104, "timestamp_epoch": "1723680608.294498000", "display_filter": "frame.number == 1104", "tcp_stream": 1 }, { "frame_number": 1106, "timestamp_epoch": "1723680608.295053000", "display_filter": "frame.number == 1106", "tcp_stream": 1 }, { "frame_number": 1108, "timestamp_epoch": "1723680608.295580000", "display_filter": "frame.number == 1108", "tcp_stream": 1 }, { "frame_number": 1110, "timestamp_epoch": "1723680608.296214000", "display_filter": "frame.number == 1110", "tcp_stream": 1 }, { "frame_number": 1112, "timestamp_epoch": "1723680608.296855000", "display_filter": "frame.number == 1112", "tcp_stream": 1 }, { "frame_number": 1114, "timestamp_epoch": "1723680608.297426000", "display_filter": "frame.number == 1114", "tcp_stream": 1 }, { "frame_number": 1116, "timestamp_epoch": "1723680608.297908000", "display_filter": "frame.number == 1116", "tcp_stream": 1 }, { "frame_number": 1118, "timestamp_epoch": "1723680608.298462000", "display_filter": "frame.number == 1118", "tcp_stream": 1 }, { "frame_number": 1120, "timestamp_epoch": "1723680608.298892000", "display_filter": "frame.number == 1120", "tcp_stream": 1 }, { "frame_number": 1122, "timestamp_epoch": "1723680608.299311000", "display_filter": "frame.number == 1122", "tcp_stream": 1 }, { "frame_number": 1124, "timestamp_epoch": "1723680608.299700000", "display_filter": "frame.number == 1124", "tcp_stream": 1 } ], "metrics": { "source": "10.8.15.133", "destination": "10.8.15.4", "protocol": "samr", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] } }, { "finding_id": "finding-dadf48afcfbbcf2b5157e015", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 282, "timestamp_epoch": "1723680586.162688000", "display_filter": "frame.number == 282", "tcp_stream": 11 }, { "frame_number": 287, "timestamp_epoch": "1723680586.163662000", "display_filter": "frame.number == 287", "tcp_stream": 11 }, { "frame_number": 293, "timestamp_epoch": "1723680586.164600000", "display_filter": "frame.number == 293", "tcp_stream": 11 }, { "frame_number": 298, "timestamp_epoch": "1723680586.165377000", "display_filter": "frame.number == 298", "tcp_stream": 11 }, { "frame_number": 313, "timestamp_epoch": "1723680586.175336000", "display_filter": "frame.number == 313", "tcp_stream": 11 }, { "frame_number": 315, "timestamp_epoch": "1723680586.184129000", "display_filter": "frame.number == 315", "tcp_stream": 11 }, { "frame_number": 317, "timestamp_epoch": "1723680586.186040000", "display_filter": "frame.number == 317", "tcp_stream": 11 }, { "frame_number": 333, "timestamp_epoch": "1723680586.223085000", "display_filter": "frame.number == 333", "tcp_stream": 11 }, { "frame_number": 336, "timestamp_epoch": "1723680586.224242000", "display_filter": "frame.number == 336", "tcp_stream": 11 }, { "frame_number": 349, "timestamp_epoch": "1723680586.231483000", "display_filter": "frame.number == 349", "tcp_stream": 11 }, { "frame_number": 406, "timestamp_epoch": "1723680586.407559000", "display_filter": "frame.number == 406", "tcp_stream": 22 }, { "frame_number": 408, "timestamp_epoch": "1723680586.408786000", "display_filter": "frame.number == 408", "tcp_stream": 22 }, { "frame_number": 415, "timestamp_epoch": "1723680586.417890000", "display_filter": "frame.number == 415", "tcp_stream": 22 }, { "frame_number": 420, "timestamp_epoch": "1723680586.419690000", "display_filter": "frame.number == 420", "tcp_stream": 22 }, { "frame_number": 424, "timestamp_epoch": "1723680586.421823000", "display_filter": "frame.number == 424", "tcp_stream": 11 }, { "frame_number": 426, "timestamp_epoch": "1723680586.422890000", "display_filter": "frame.number == 426", "tcp_stream": 11 }, { "frame_number": 428, "timestamp_epoch": "1723680586.426156000", "display_filter": "frame.number == 428", "tcp_stream": 11 }, { "frame_number": 777, "timestamp_epoch": "1723680589.063735000", "display_filter": "frame.number == 777", "tcp_stream": 35 }, { "frame_number": 779, "timestamp_epoch": "1723680589.064448000", "display_filter": "frame.number == 779", "tcp_stream": 35 }, { "frame_number": 781, "timestamp_epoch": "1723680589.064904000", "display_filter": "frame.number == 781", "tcp_stream": 35 }, { "frame_number": 785, "timestamp_epoch": "1723680589.066447000", "display_filter": "frame.number == 785", "tcp_stream": 35 }, { "frame_number": 787, "timestamp_epoch": "1723680589.066986000", "display_filter": "frame.number == 787", "tcp_stream": 35 }, { "frame_number": 789, "timestamp_epoch": "1723680589.067414000", "display_filter": "frame.number == 789", "tcp_stream": 35 }, { "frame_number": 1023, "timestamp_epoch": "1723680608.255139000", "display_filter": "frame.number == 1023", "tcp_stream": 11 }, { "frame_number": 1025, "timestamp_epoch": "1723680608.255622000", "display_filter": "frame.number == 1025", "tcp_stream": 11 }, { "frame_number": 1027, "timestamp_epoch": "1723680608.256076000", "display_filter": "frame.number == 1027", "tcp_stream": 11 }, { "frame_number": 1029, "timestamp_epoch": "1723680608.256355000", "display_filter": "frame.number == 1029", "tcp_stream": 11 }, { "frame_number": 2171, "timestamp_epoch": "1723680619.142315000", "display_filter": "frame.number == 2171", "tcp_stream": 75 }, { "frame_number": 2175, "timestamp_epoch": "1723680619.142979000", "display_filter": "frame.number == 2175", "tcp_stream": 75 }, { "frame_number": 2179, "timestamp_epoch": "1723680619.143304000", "display_filter": "frame.number == 2179", "tcp_stream": 75 }, { "frame_number": 2185, "timestamp_epoch": "1723680619.146253000", "display_filter": "frame.number == 2185", "tcp_stream": 75 }, { "frame_number": 2187, "timestamp_epoch": "1723680619.146719000", "display_filter": "frame.number == 2187", "tcp_stream": 75 }, { "frame_number": 2189, "timestamp_epoch": "1723680619.147091000", "display_filter": "frame.number == 2189", "tcp_stream": 75 }, { "frame_number": 8772, "timestamp_epoch": "1723680669.170822000", "display_filter": "frame.number == 8772", "tcp_stream": 116 }, { "frame_number": 8774, "timestamp_epoch": "1723680669.171583000", "display_filter": "frame.number == 8774", "tcp_stream": 116 }, { "frame_number": 8776, "timestamp_epoch": "1723680669.172016000", "display_filter": "frame.number == 8776", "tcp_stream": 116 }, { "frame_number": 8780, "timestamp_epoch": "1723680669.173916000", "display_filter": "frame.number == 8780", "tcp_stream": 116 }, { "frame_number": 8782, "timestamp_epoch": "1723680669.174421000", "display_filter": "frame.number == 8782", "tcp_stream": 116 }, { "frame_number": 8784, "timestamp_epoch": "1723680669.174776000", "display_filter": "frame.number == 8784", "tcp_stream": 116 }, { "frame_number": 10325, "timestamp_epoch": "1723680707.872244000", "display_filter": "frame.number == 10325", "tcp_stream": 129 }, { "frame_number": 10327, "timestamp_epoch": "1723680707.872807000", "display_filter": "frame.number == 10327", "tcp_stream": 129 }, { "frame_number": 10329, "timestamp_epoch": "1723680707.873195000", "display_filter": "frame.number == 10329", "tcp_stream": 129 }, { "frame_number": 10333, "timestamp_epoch": "1723680707.874883000", "display_filter": "frame.number == 10333", "tcp_stream": 129 }, { "frame_number": 10335, "timestamp_epoch": "1723680707.875361000", "display_filter": "frame.number == 10335", "tcp_stream": 129 }, { "frame_number": 10337, "timestamp_epoch": "1723680707.875719000", "display_filter": "frame.number == 10337", "tcp_stream": 129 }, { "frame_number": 10793, "timestamp_epoch": "1723680726.272191000", "display_filter": "frame.number == 10793", "tcp_stream": 136 }, { "frame_number": 10795, "timestamp_epoch": "1723680726.272794000", "display_filter": "frame.number == 10795", "tcp_stream": 136 }, { "frame_number": 10797, "timestamp_epoch": "1723680726.273174000", "display_filter": "frame.number == 10797", "tcp_stream": 136 }, { "frame_number": 10801, "timestamp_epoch": "1723680726.274984000", "display_filter": "frame.number == 10801", "tcp_stream": 136 }, { "frame_number": 10803, "timestamp_epoch": "1723680726.275430000", "display_filter": "frame.number == 10803", "tcp_stream": 136 }, { "frame_number": 10805, "timestamp_epoch": "1723680726.275772000", "display_filter": "frame.number == 10805", "tcp_stream": 136 }, { "frame_number": 11543, "timestamp_epoch": "1723680793.575868000", "display_filter": "frame.number == 11543", "tcp_stream": 147 }, { "frame_number": 11545, "timestamp_epoch": "1723680793.576475000", "display_filter": "frame.number == 11545", "tcp_stream": 147 }, { "frame_number": 11547, "timestamp_epoch": "1723680793.576876000", "display_filter": "frame.number == 11547", "tcp_stream": 147 }, { "frame_number": 11551, "timestamp_epoch": "1723680793.578827000", "display_filter": "frame.number == 11551", "tcp_stream": 147 }, { "frame_number": 11553, "timestamp_epoch": "1723680793.579321000", "display_filter": "frame.number == 11553", "tcp_stream": 147 }, { "frame_number": 11555, "timestamp_epoch": "1723680793.579650000", "display_filter": "frame.number == 11555", "tcp_stream": 147 }, { "frame_number": 13682, "timestamp_epoch": "1723680984.938304000", "display_filter": "frame.number == 13682", "tcp_stream": 212 }, { "frame_number": 13684, "timestamp_epoch": "1723680984.939080000", "display_filter": "frame.number == 13684", "tcp_stream": 212 }, { "frame_number": 13686, "timestamp_epoch": "1723680984.939542000", "display_filter": "frame.number == 13686", "tcp_stream": 212 }, { "frame_number": 13690, "timestamp_epoch": "1723680984.941065000", "display_filter": "frame.number == 13690", "tcp_stream": 212 }, { "frame_number": 13692, "timestamp_epoch": "1723680984.941557000", "display_filter": "frame.number == 13692", "tcp_stream": 212 }, { "frame_number": 13694, "timestamp_epoch": "1723680984.941918000", "display_filter": "frame.number == 13694", "tcp_stream": 212 }, { "frame_number": 13767, "timestamp_epoch": "1723680987.861338000", "display_filter": "frame.number == 13767", "tcp_stream": 217 }, { "frame_number": 13769, "timestamp_epoch": "1723680987.862048000", "display_filter": "frame.number == 13769", "tcp_stream": 217 }, { "frame_number": 13771, "timestamp_epoch": "1723680987.862579000", "display_filter": "frame.number == 13771", "tcp_stream": 217 }, { "frame_number": 13775, "timestamp_epoch": "1723680987.864410000", "display_filter": "frame.number == 13775", "tcp_stream": 217 }, { "frame_number": 13777, "timestamp_epoch": "1723680987.864959000", "display_filter": "frame.number == 13777", "tcp_stream": 217 }, { "frame_number": 13779, "timestamp_epoch": "1723680987.865321000", "display_filter": "frame.number == 13779", "tcp_stream": 217 } ], "metrics": { "source": "10.8.15.4", "destination": "10.8.15.133", "protocol": "drsuapi", "event_count": 69, "operation_numbers": [ "0", "1", "12", "13", "30" ] } }, { "finding_id": "finding-9da2803215a49174d050ddf4", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 39, "timestamp_epoch": "1723680584.316590000", "display_filter": "frame.number == 39", "tcp_stream": 0 }, { "frame_number": 290, "timestamp_epoch": "1723680586.163947000", "display_filter": "frame.number == 290", "tcp_stream": 19 }, { "frame_number": 299, "timestamp_epoch": "1723680586.165682000", "display_filter": "frame.number == 299", "tcp_stream": 19 }, { "frame_number": 302, "timestamp_epoch": "1723680586.168128000", "display_filter": "frame.number == 302", "tcp_stream": 19 }, { "frame_number": 305, "timestamp_epoch": "1723680586.169656000", "display_filter": "frame.number == 305", "tcp_stream": 19 }, { "frame_number": 345, "timestamp_epoch": "1723680586.229864000", "display_filter": "frame.number == 345", "tcp_stream": 0 }, { "frame_number": 370, "timestamp_epoch": "1723680586.334337000", "display_filter": "frame.number == 370", "tcp_stream": 19 }, { "frame_number": 436, "timestamp_epoch": "1723680586.460412000", "display_filter": "frame.number == 436", "tcp_stream": 19 }, { "frame_number": 456, "timestamp_epoch": "1723680586.567224000", "display_filter": "frame.number == 456", "tcp_stream": 19 }, { "frame_number": 464, "timestamp_epoch": "1723680586.571159000", "display_filter": "frame.number == 464", "tcp_stream": 19 }, { "frame_number": 466, "timestamp_epoch": "1723680586.572032000", "display_filter": "frame.number == 466", "tcp_stream": 19 }, { "frame_number": 479, "timestamp_epoch": "1723680586.858347000", "display_filter": "frame.number == 479", "tcp_stream": 27 }, { "frame_number": 484, "timestamp_epoch": "1723680586.862253000", "display_filter": "frame.number == 484", "tcp_stream": 27 }, { "frame_number": 499, "timestamp_epoch": "1723680586.919299000", "display_filter": "frame.number == 499", "tcp_stream": 27 }, { "frame_number": 506, "timestamp_epoch": "1723680586.924302000", "display_filter": "frame.number == 506", "tcp_stream": 29 }, { "frame_number": 508, "timestamp_epoch": "1723680586.925448000", "display_filter": "frame.number == 508", "tcp_stream": 29 }, { "frame_number": 510, "timestamp_epoch": "1723680586.927291000", "display_filter": "frame.number == 510", "tcp_stream": 29 }, { "frame_number": 512, "timestamp_epoch": "1723680586.928362000", "display_filter": "frame.number == 512", "tcp_stream": 27 }, { "frame_number": 807, "timestamp_epoch": "1723680589.322588000", "display_filter": "frame.number == 807", "tcp_stream": 36 }, { "frame_number": 812, "timestamp_epoch": "1723680589.325251000", "display_filter": "frame.number == 812", "tcp_stream": 36 }, { "frame_number": 814, "timestamp_epoch": "1723680589.327512000", "display_filter": "frame.number == 814", "tcp_stream": 36 }, { "frame_number": 816, "timestamp_epoch": "1723680589.328051000", "display_filter": "frame.number == 816", "tcp_stream": 36 }, { "frame_number": 818, "timestamp_epoch": "1723680589.328531000", "display_filter": "frame.number == 818", "tcp_stream": 36 }, { "frame_number": 825, "timestamp_epoch": "1723680589.331594000", "display_filter": "frame.number == 825", "tcp_stream": 37 }, { "frame_number": 829, "timestamp_epoch": "1723680589.332163000", "display_filter": "frame.number == 829", "tcp_stream": 37 }, { "frame_number": 832, "timestamp_epoch": "1723680589.332847000", "display_filter": "frame.number == 832", "tcp_stream": 37 }, { "frame_number": 894, "timestamp_epoch": "1723680594.911658000", "display_filter": "frame.number == 894", "tcp_stream": 39 }, { "frame_number": 899, "timestamp_epoch": "1723680594.914633000", "display_filter": "frame.number == 899", "tcp_stream": 39 }, { "frame_number": 901, "timestamp_epoch": "1723680594.916365000", "display_filter": "frame.number == 901", "tcp_stream": 39 }, { "frame_number": 903, "timestamp_epoch": "1723680594.916837000", "display_filter": "frame.number == 903", "tcp_stream": 39 }, { "frame_number": 905, "timestamp_epoch": "1723680594.917418000", "display_filter": "frame.number == 905", "tcp_stream": 39 }, { "frame_number": 907, "timestamp_epoch": "1723680594.918030000", "display_filter": "frame.number == 907", "tcp_stream": 39 }, { "frame_number": 909, "timestamp_epoch": "1723680594.918864000", "display_filter": "frame.number == 909", "tcp_stream": 39 }, { "frame_number": 916, "timestamp_epoch": "1723680594.931841000", "display_filter": "frame.number == 916", "tcp_stream": 40 }, { "frame_number": 918, "timestamp_epoch": "1723680594.932466000", "display_filter": "frame.number == 918", "tcp_stream": 40 }, { "frame_number": 950, "timestamp_epoch": "1723680594.938268000", "display_filter": "frame.number == 950", "tcp_stream": 40 }, { "frame_number": 1036, "timestamp_epoch": "1723680608.263016000", "display_filter": "frame.number == 1036", "tcp_stream": 48 }, { "frame_number": 1038, "timestamp_epoch": "1723680608.266867000", "display_filter": "frame.number == 1038", "tcp_stream": 48 }, { "frame_number": 1045, "timestamp_epoch": "1723680608.270141000", "display_filter": "frame.number == 1045", "tcp_stream": 49 }, { "frame_number": 1047, "timestamp_epoch": "1723680608.270637000", "display_filter": "frame.number == 1047", "tcp_stream": 49 }, { "frame_number": 1049, "timestamp_epoch": "1723680608.271050000", "display_filter": "frame.number == 1049", "tcp_stream": 49 }, { "frame_number": 1051, "timestamp_epoch": "1723680608.271601000", "display_filter": "frame.number == 1051", "tcp_stream": 48 }, { "frame_number": 2195, "timestamp_epoch": "1723680619.150540000", "display_filter": "frame.number == 2195", "tcp_stream": 76 }, { "frame_number": 2200, "timestamp_epoch": "1723680619.152525000", "display_filter": "frame.number == 2200", "tcp_stream": 76 }, { "frame_number": 2202, "timestamp_epoch": "1723680619.153176000", "display_filter": "frame.number == 2202", "tcp_stream": 76 }, { "frame_number": 2204, "timestamp_epoch": "1723680619.153636000", "display_filter": "frame.number == 2204", "tcp_stream": 76 }, { "frame_number": 2206, "timestamp_epoch": "1723680619.154056000", "display_filter": "frame.number == 2206", "tcp_stream": 76 }, { "frame_number": 2213, "timestamp_epoch": "1723680619.158222000", "display_filter": "frame.number == 2213", "tcp_stream": 77 }, { "frame_number": 2217, "timestamp_epoch": "1723680619.158932000", "display_filter": "frame.number == 2217", "tcp_stream": 77 }, { "frame_number": 2220, "timestamp_epoch": "1723680619.159752000", "display_filter": "frame.number == 2220", "tcp_stream": 77 }, { "frame_number": 8790, "timestamp_epoch": "1723680669.177405000", "display_filter": "frame.number == 8790", "tcp_stream": 117 }, { "frame_number": 8795, "timestamp_epoch": "1723680669.179140000", "display_filter": "frame.number == 8795", "tcp_stream": 117 }, { "frame_number": 8797, "timestamp_epoch": "1723680669.179708000", "display_filter": "frame.number == 8797", "tcp_stream": 117 }, { "frame_number": 8799, "timestamp_epoch": "1723680669.180172000", "display_filter": "frame.number == 8799", "tcp_stream": 117 }, { "frame_number": 8801, "timestamp_epoch": "1723680669.180565000", "display_filter": "frame.number == 8801", "tcp_stream": 117 }, { "frame_number": 8808, "timestamp_epoch": "1723680669.183920000", "display_filter": "frame.number == 8808", "tcp_stream": 118 }, { "frame_number": 8812, "timestamp_epoch": "1723680669.184677000", "display_filter": "frame.number == 8812", "tcp_stream": 118 }, { "frame_number": 8815, "timestamp_epoch": "1723680669.185287000", "display_filter": "frame.number == 8815", "tcp_stream": 118 }, { "frame_number": 10343, "timestamp_epoch": "1723680707.878499000", "display_filter": "frame.number == 10343", "tcp_stream": 130 }, { "frame_number": 10348, "timestamp_epoch": "1723680707.880056000", "display_filter": "frame.number == 10348", "tcp_stream": 130 }, { "frame_number": 10350, "timestamp_epoch": "1723680707.880675000", "display_filter": "frame.number == 10350", "tcp_stream": 130 }, { "frame_number": 10352, "timestamp_epoch": "1723680707.881085000", "display_filter": "frame.number == 10352", "tcp_stream": 130 }, { "frame_number": 10354, "timestamp_epoch": "1723680707.881451000", "display_filter": "frame.number == 10354", "tcp_stream": 130 }, { "frame_number": 10361, "timestamp_epoch": "1723680707.885178000", "display_filter": "frame.number == 10361", "tcp_stream": 131 }, { "frame_number": 10365, "timestamp_epoch": "1723680707.885810000", "display_filter": "frame.number == 10365", "tcp_stream": 131 }, { "frame_number": 10368, "timestamp_epoch": "1723680707.886329000", "display_filter": "frame.number == 10368", "tcp_stream": 131 }, { "frame_number": 10811, "timestamp_epoch": "1723680726.278478000", "display_filter": "frame.number == 10811", "tcp_stream": 137 }, { "frame_number": 10816, "timestamp_epoch": "1723680726.279932000", "display_filter": "frame.number == 10816", "tcp_stream": 137 }, { "frame_number": 10818, "timestamp_epoch": "1723680726.280560000", "display_filter": "frame.number == 10818", "tcp_stream": 137 }, { "frame_number": 10820, "timestamp_epoch": "1723680726.280982000", "display_filter": "frame.number == 10820", "tcp_stream": 137 }, { "frame_number": 10822, "timestamp_epoch": "1723680726.281360000", "display_filter": "frame.number == 10822", "tcp_stream": 137 }, { "frame_number": 10829, "timestamp_epoch": "1723680726.285345000", "display_filter": "frame.number == 10829", "tcp_stream": 138 }, { "frame_number": 10833, "timestamp_epoch": "1723680726.285995000", "display_filter": "frame.number == 10833", "tcp_stream": 138 }, { "frame_number": 10836, "timestamp_epoch": "1723680726.286605000", "display_filter": "frame.number == 10836", "tcp_stream": 138 }, { "frame_number": 11561, "timestamp_epoch": "1723680793.582360000", "display_filter": "frame.number == 11561", "tcp_stream": 148 }, { "frame_number": 11566, "timestamp_epoch": "1723680793.584069000", "display_filter": "frame.number == 11566", "tcp_stream": 148 }, { "frame_number": 11568, "timestamp_epoch": "1723680793.585134000", "display_filter": "frame.number == 11568", "tcp_stream": 148 }, { "frame_number": 11570, "timestamp_epoch": "1723680793.585635000", "display_filter": "frame.number == 11570", "tcp_stream": 148 }, { "frame_number": 11572, "timestamp_epoch": "1723680793.586076000", "display_filter": "frame.number == 11572", "tcp_stream": 148 }, { "frame_number": 11579, "timestamp_epoch": "1723680793.590422000", "display_filter": "frame.number == 11579", "tcp_stream": 149 }, { "frame_number": 11583, "timestamp_epoch": "1723680793.591070000", "display_filter": "frame.number == 11583", "tcp_stream": 149 }, { "frame_number": 11586, "timestamp_epoch": "1723680793.591623000", "display_filter": "frame.number == 11586", "tcp_stream": 149 }, { "frame_number": 11639, "timestamp_epoch": "1723680795.693019000", "display_filter": "frame.number == 11639", "tcp_stream": 152 }, { "frame_number": 11656, "timestamp_epoch": "1723680795.703747000", "display_filter": "frame.number == 11656", "tcp_stream": 152 }, { "frame_number": 11658, "timestamp_epoch": "1723680795.705808000", "display_filter": "frame.number == 11658", "tcp_stream": 152 }, { "frame_number": 11673, "timestamp_epoch": "1723680795.729326000", "display_filter": "frame.number == 11673", "tcp_stream": 154 }, { "frame_number": 11675, "timestamp_epoch": "1723680795.729993000", "display_filter": "frame.number == 11675", "tcp_stream": 154 }, { "frame_number": 12513, "timestamp_epoch": "1723680911.761516000", "display_filter": "frame.number == 12513", "tcp_stream": 196 }, { "frame_number": 12518, "timestamp_epoch": "1723680911.763442000", "display_filter": "frame.number == 12518", "tcp_stream": 196 }, { "frame_number": 12520, "timestamp_epoch": "1723680911.765039000", "display_filter": "frame.number == 12520", "tcp_stream": 196 }, { "frame_number": 12529, "timestamp_epoch": "1723680911.774536000", "display_filter": "frame.number == 12529", "tcp_stream": 197 }, { "frame_number": 12531, "timestamp_epoch": "1723680911.784208000", "display_filter": "frame.number == 12531", "tcp_stream": 197 }, { "frame_number": 13700, "timestamp_epoch": "1723680984.944342000", "display_filter": "frame.number == 13700", "tcp_stream": 213 }, { "frame_number": 13705, "timestamp_epoch": "1723680984.945807000", "display_filter": "frame.number == 13705", "tcp_stream": 213 }, { "frame_number": 13707, "timestamp_epoch": "1723680984.946341000", "display_filter": "frame.number == 13707", "tcp_stream": 213 }, { "frame_number": 13709, "timestamp_epoch": "1723680984.946751000", "display_filter": "frame.number == 13709", "tcp_stream": 213 }, { "frame_number": 13711, "timestamp_epoch": "1723680984.947134000", "display_filter": "frame.number == 13711", "tcp_stream": 213 }, { "frame_number": 13718, "timestamp_epoch": "1723680984.950226000", "display_filter": "frame.number == 13718", "tcp_stream": 214 }, { "frame_number": 13722, "timestamp_epoch": "1723680984.950762000", "display_filter": "frame.number == 13722", "tcp_stream": 214 }, { "frame_number": 13725, "timestamp_epoch": "1723680984.951327000", "display_filter": "frame.number == 13725", "tcp_stream": 214 } ], "metrics": { "source": "10.8.15.4", "destination": "10.8.15.133", "protocol": "ldap", "event_count": 113, "operation_numbers": [ "", "1", "4,19,19,19,5", "4,5", "5" ] } }, { "finding_id": "finding-8367718ddef3981991b6f583", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 1097, "timestamp_epoch": "1723680608.292835000", "display_filter": "frame.number == 1097", "tcp_stream": 1 }, { "frame_number": 1099, "timestamp_epoch": "1723680608.293290000", "display_filter": "frame.number == 1099", "tcp_stream": 1 }, { "frame_number": 1101, "timestamp_epoch": "1723680608.293826000", "display_filter": "frame.number == 1101", "tcp_stream": 1 }, { "frame_number": 1103, "timestamp_epoch": "1723680608.294335000", "display_filter": "frame.number == 1103", "tcp_stream": 1 }, { "frame_number": 1105, "timestamp_epoch": "1723680608.294889000", "display_filter": "frame.number == 1105", "tcp_stream": 1 }, { "frame_number": 1107, "timestamp_epoch": "1723680608.295392000", "display_filter": "frame.number == 1107", "tcp_stream": 1 }, { "frame_number": 1109, "timestamp_epoch": "1723680608.296055000", "display_filter": "frame.number == 1109", "tcp_stream": 1 }, { "frame_number": 1111, "timestamp_epoch": "1723680608.296635000", "display_filter": "frame.number == 1111", "tcp_stream": 1 }, { "frame_number": 1113, "timestamp_epoch": "1723680608.297258000", "display_filter": "frame.number == 1113", "tcp_stream": 1 }, { "frame_number": 1115, "timestamp_epoch": "1723680608.297744000", "display_filter": "frame.number == 1115", "tcp_stream": 1 }, { "frame_number": 1117, "timestamp_epoch": "1723680608.298252000", "display_filter": "frame.number == 1117", "tcp_stream": 1 }, { "frame_number": 1119, "timestamp_epoch": "1723680608.298712000", "display_filter": "frame.number == 1119", "tcp_stream": 1 }, { "frame_number": 1121, "timestamp_epoch": "1723680608.299161000", "display_filter": "frame.number == 1121", "tcp_stream": 1 }, { "frame_number": 1123, "timestamp_epoch": "1723680608.299551000", "display_filter": "frame.number == 1123", "tcp_stream": 1 }, { "frame_number": 1125, "timestamp_epoch": "1723680608.299949000", "display_filter": "frame.number == 1125", "tcp_stream": 1 } ], "metrics": { "source": "10.8.15.4", "destination": "10.8.15.133", "protocol": "samr", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] } } ], "attack_candidates": [ { "attack_id": "T1071.001", "name": "Application Layer Protocol: Web Protocols", "tactic": "command-and-control", "confidence": 0.85, "status": "suggested", "mapping_basis": "versioned-deterministic-rule", "finding_ids": [ "finding-11a7e4318835eb1c13fc1c02" ], "evidence": [ { "frame_number": 11028, "timestamp_epoch": "1723680780.664378000", "display_filter": "frame.number == 11028", "tcp_stream": 142 }, { "frame_number": 11505, "timestamp_epoch": "1723680787.999666000", "display_filter": "frame.number == 11505", "tcp_stream": 145 }, { "frame_number": 11619, "timestamp_epoch": "1723680793.850601000", "display_filter": "frame.number == 11619", "tcp_stream": 151 }, { "frame_number": 11688, "timestamp_epoch": "1723680797.315577000", "display_filter": "frame.number == 11688", "tcp_stream": 155 }, { "frame_number": 11962, "timestamp_epoch": "1723680804.254102000", "display_filter": "frame.number == 11962", "tcp_stream": 164 } ] } ], "actor_leads": [], "coverage": { "event_limits": { "dns": { "returned": 430, "truncated": false }, "http_request": { "returned": 404, "truncated": false }, "http_response": { "returned": 322, "truncated": false }, "tls_client_hello": { "returned": 174, "truncated": false }, "dhcp": { "returned": 6, "truncated": false }, "identity": { "returned": 441, "truncated": false }, "directory_service": { "returned": 424, "truncated": false }, "unclassified_tcp": { "returned": 162, "truncated": false } }, "warnings": [], "encrypted_payload_visibility": "metadata-only", "name_resolution": false, "http_objects": { "exported_objects": 322, "hashed_objects": 322, "unique_hashes": 18, "returned_unique_hashes": 18, "detailed_objects": 18, "compact_hash_index": [], "compact_objects": 0, "omitted_unique_hashes": 0, "unhashed_objects": 0, "hashed_bytes": 3449794, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "complete": true }, "complete_within_profile": true, "limitations": [ "Encrypted application contents are not decrypted", "Protocol decoding and heuristic findings do not establish malware family or attribution", "No endpoint execution, persistence, or credential-theft proof without corresponding evidence" ] }, "summary": "Decoded 18189 packets across 75 IP endpoints and 698 transport flows. Observed 430 DNS events, 404 HTTP requests, 174 TLS ClientHello events, and 18 exported HTTP object(s). Deterministic rules produced 8 finding(s): 1 high, 0 medium, and 7 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "semantic_sha256": "f1e40c750b6946d0db5734f3fb390579d65b42e1dbb9cdd67b0a5c6d2f3174ab" }, "context": { "schema_version": "pcap-context-v1", "created_at": "2026-09-19T12:08:57.190731+00:00", "session_id": "a894fbbc-d0d5-4309-bd04-2eda8773adfa", "source_semantic_sha256": "f1e40c750b6946d0db5734f3fb390579d65b42e1dbb9cdd67b0a5c6d2f3174ab", "mode": "local-only", "external_enrichment": { "status": "not-requested", "requests": 0, "reason": "Requires explicit provider consent and privacy review" }, "coverage": { "observables_total": 272, "observables_checked": 272, "observable_limit": 5000, "truncated": false, "matched_observables": 0, "no_exact_match": 272, "prior_cases_checked": 8, "prior_case_limit_reached": false }, "matches": [], "source_actor_links": [], "techniques": [ { "attack_id": "T1071.001", "name": "Web Protocols", "catalog_version_id": 851, "url": "https://attack.mitre.org/techniques/T1071/001", "platforms": [ "ESXi", "Linux", "macOS", "Network Devices", "Windows" ], "data_sources": [ "NSM:Flow", "WinEventLog:Sysmon", "auditd:SYSCALL", "macos:osquery", "macos:unifiedlog", "esxi:shell" ], "detection": "", "detection_strategies": [ { "stix_id": "x-mitre-detection-strategy--e6496b9b-2458-4616-9712-a7c0da7fd3bc", "attack_id": "DET0027", "name": "Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets" } ], "detection_links_truncated": false, "status": "catalog-context-not-validation-of-behavior" } ], "cross_case_correlations": [ { "analysis_id": "faf041c3-70e0-4a01-8780-10917e5e187c", "session_id": "df6c55a2-3630-4e95-82d0-0eebb41c3b51", "source_sha256": "8fee06d0b1686faab4364f5b7a741e736ad7e713d5ca9299ff9161a4b4d4862e", "shared_observables": [ { "type": "domain", "value": "a1834.dscg2.akamai.net" }, { "type": "domain", "value": "acroipm2.adobe.com" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "assets.msn.com" }, { "type": "domain", "value": "blob.mwh03prdstf02a.store.core.windows.net" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "g.live.com" }, { "type": "domain", "value": "img-s-msn-com.akamaized.net" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "mobile.events.data.microsoft.com" }, { "type": "domain", "value": "odc.officeapps.live.com" }, { "type": "domain", "value": "officeclient.microsoft.com" }, { "type": "domain", "value": "oneclient.sfx.ms" }, { "type": "domain", "value": "pti.store.microsoft.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "srtb.msn.com" }, { "type": "domain", "value": "storecatalogrevocation.storequality.microsoft.com" }, { "type": "domain", "value": "th.bing.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "weathermapdata.blob.core.windows.net" }, { "type": "domain", "value": "windows.msn.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.msftconnecttest.com" }, { "type": "domain", "value": "www.msn.com" }, { "type": "ipv4", "value": "13.107.246.57" }, { "type": "ipv4", "value": "13.70.79.200" }, { "type": "ipv4", "value": "199.232.210.172" }, { "type": "ipv4", "value": "199.232.214.172" }, { "type": "ipv4", "value": "20.10.31.115" }, { "type": "ipv4", "value": "20.241.44.114" }, { "type": "ipv4", "value": "20.60.228.1" }, { "type": "ipv4", "value": "20.96.153.111" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "23.194.68.140" }, { "type": "ipv4", "value": "52.109.0.142" }, { "type": "ipv4", "value": "52.113.194.132" }, { "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61" }, { "type": "sha256", "value": "69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820" } ], "shared_count": 42, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "08324647-35af-4af2-8d82-4387eec03918", "session_id": "426471ed-5e63-4b7e-ac6c-d36e060a4739", "source_sha256": "a38267943a7bf3b0e445d7e51cb0a68b3dee797d67081bc9a033f73d079c0f50", "shared_observables": [ { "type": "domain", "value": "a1834.dscg2.akamai.net" }, { "type": "domain", "value": "acroipm2.adobe.com" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "armmf.adobe.com" }, { "type": "domain", "value": "assets.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "default.exp-tas.com" }, { "type": "domain", "value": "displaycatalog.mp.microsoft.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "edge-microsoft-com.dual-a-0036.a-msedge.net" }, { "type": "domain", "value": "edge.microsoft.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "fe3cr.delivery.mp.microsoft.com" }, { "type": "domain", "value": "img-s-msn-com.akamaized.net" }, { "type": "domain", "value": "licensing.mp.microsoft.com" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "mobile.events.data.microsoft.com" }, { "type": "domain", "value": "mrodevicemgr.officeapps.live.com" }, { "type": "domain", "value": "nav.smartscreen.microsoft.com" }, { "type": "domain", "value": "odc.officeapps.live.com" }, { "type": "domain", "value": "officeclient.microsoft.com" }, { "type": "domain", "value": "prod.mrodevicemgr.live.com.akadns.net" }, { "type": "domain", "value": "srtb.msn.com" }, { "type": "domain", "value": "storecatalogrevocation.storequality.microsoft.com" }, { "type": "domain", "value": "th.bing.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "windows.msn.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.msftconnecttest.com" }, { "type": "domain", "value": "www.msn.com" }, { "type": "ipv4", "value": "13.107.21.239" }, { "type": "ipv4", "value": "13.107.246.57" }, { "type": "ipv4", "value": "13.107.5.93" }, { "type": "ipv4", "value": "20.96.153.111" }, { "type": "ipv4", "value": "20.99.184.37" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "204.79.197.239" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "40.126.29.9" }, { "type": "ipv4", "value": "52.109.0.136" }, { "type": "ipv4", "value": "52.113.194.132" }, { "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61" }, { "type": "sha256", "value": "69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820" } ], "shared_count": 46, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "616a90fa-f15e-4fcb-8d56-7b8e0eff5785", "session_id": "1ea146b9-1fb6-4be9-8adc-154756a8642c", "source_sha256": "21bb800849459709a7ceb5513573b2b20f090ffccd00eb89b9886feedd47a2df", "shared_observables": [ { "type": "domain", "value": "browser.events.data.msn.com" }, { "type": "domain", "value": "edge.microsoft.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "mobile.events.data.microsoft.com" }, { "type": "domain", "value": "odc.officeapps.live.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "v20.events.data.microsoft.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "20.190.157.9" }, { "type": "ipv4", "value": "40.126.29.11" } ], "shared_count": 12, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "459e119d-191f-49e8-85ea-c78f9de41826", "session_id": "45dead98-56f7-41bd-bcd0-62bcf13e9f9b", "source_sha256": "0ea6b597732a9ce6af9a7e3adff4512c9a91b4bce27184c8fdeb746f05cce170", "shared_observables": [ { "type": "domain", "value": "a1834.dscg2.akamai.net" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "assets.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "edge-consumer-static.azureedge.net" }, { "type": "domain", "value": "edge.microsoft.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "fe2cr.update.microsoft.com" }, { "type": "domain", "value": "fe2cr.update.msft.com.trafficmanager.net" }, { "type": "domain", "value": "img-s-msn-com.akamaized.net" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "mobile.events.data.microsoft.com" }, { "type": "domain", "value": "officeclient.microsoft.com" }, { "type": "domain", "value": "pti.store.microsoft.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "srtb.msn.com" }, { "type": "domain", "value": "th.bing.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "v20.events.data.microsoft.com" }, { "type": "domain", "value": "windows.msn.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.msftconnecttest.com" }, { "type": "domain", "value": "www.msn.com" }, { "type": "ipv4", "value": "199.232.210.172" }, { "type": "ipv4", "value": "199.232.214.172" }, { "type": "ipv4", "value": "20.42.65.88" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.22" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61" } ], "shared_count": 33, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "7a2cfe72-f48d-4894-8a2d-8889cb3b11b2", "session_id": "d201ef05-c1ff-4b51-bfb6-594810367b62", "source_sha256": "3dc470f5490ec15b4024c513e87c67e0b17caeae2a2ce3d83541be24ef407e61", "shared_observables": [ { "type": "domain", "value": "a1834.dscg2.akamai.net" }, { "type": "domain", "value": "acroipm2.adobe.com" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "armmf.adobe.com" }, { "type": "domain", "value": "assets.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "edge-consumer-static.azureedge.net" }, { "type": "domain", "value": "edge.microsoft.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "g.live.com" }, { "type": "domain", "value": "img-s-msn-com.akamaized.net" }, { "type": "domain", "value": "licensing.mp.microsoft.com" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "mobile.events.data.microsoft.com" }, { "type": "domain", "value": "msedge.b.tlu.dl.delivery.mp.microsoft.com" }, { "type": "domain", "value": "odc.officeapps.live.com" }, { "type": "domain", "value": "officeclient.microsoft.com" }, { "type": "domain", "value": "oneclient.sfx.ms" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "srtb.msn.com" }, { "type": "domain", "value": "th.bing.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "windows.msn.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.msftconnecttest.com" }, { "type": "domain", "value": "www.msn.com" }, { "type": "ipv4", "value": "13.107.246.57" }, { "type": "ipv4", "value": "13.70.79.200" }, { "type": "ipv4", "value": "13.89.179.13" }, { "type": "ipv4", "value": "199.232.210.172" }, { "type": "ipv4", "value": "199.232.214.172" }, { "type": "ipv4", "value": "20.190.157.9" }, { "type": "ipv4", "value": "20.42.65.88" }, { "type": "ipv4", "value": "20.42.65.94" }, { "type": "ipv4", "value": "20.96.153.111" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "40.126.29.10" }, { "type": "ipv4", "value": "40.126.29.11" }, { "type": "ipv4", "value": "40.126.29.12" }, { "type": "ipv4", "value": "40.126.29.13" }, { "type": "ipv4", "value": "40.126.29.15" }, { "type": "ipv4", "value": "40.126.29.5" }, { "type": "ipv4", "value": "40.126.29.6" }, { "type": "ipv4", "value": "40.126.29.7" }, { "type": "ipv4", "value": "40.126.29.8" }, { "type": "ipv4", "value": "40.126.29.9" }, { "type": "ipv4", "value": "52.137.106.217" }, { "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61" } ], "shared_count": 53, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "81373b30-6a59-49d1-89b0-bad73ed19eaa", "session_id": "28d700f9-1f64-46d0-ab25-5dd6123537fa", "source_sha256": "f755444d0b6eac847e07b73dea0774084b232d8577f536547a12f39b959d7833", "shared_observables": [ { "type": "domain", "value": "a1834.dscg2.akamai.net" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "assets.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "edge-consumer-static.azureedge.net" }, { "type": "domain", "value": "edge.microsoft.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "img-s-msn-com.akamaized.net" }, { "type": "domain", "value": "licensing.mp.microsoft.com" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "odc.officeapps.live.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "srtb.msn.com" }, { "type": "domain", "value": "th.bing.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "v20.events.data.microsoft.com" }, { "type": "domain", "value": "windows.msn.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.msftconnecttest.com" }, { "type": "domain", "value": "www.msn.com" }, { "type": "ipv4", "value": "13.107.246.57" }, { "type": "ipv4", "value": "20.190.157.9" }, { "type": "ipv4", "value": "20.96.153.111" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "40.126.29.10" }, { "type": "ipv4", "value": "40.126.29.11" }, { "type": "ipv4", "value": "40.126.29.15" }, { "type": "ipv4", "value": "40.126.29.5" }, { "type": "ipv4", "value": "40.126.29.6" }, { "type": "ipv4", "value": "40.126.29.8" }, { "type": "ipv4", "value": "40.126.29.9" }, { "type": "ipv4", "value": "52.109.0.142" }, { "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61" } ], "shared_count": 37, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "38851ad7-b3a0-423d-ae89-3b7be4e4b908", "session_id": "d001b3fc-7e55-401a-8bb6-381e0c10fbda", "source_sha256": "33e274d7246f4eca8fbe7337c465c7ded077cd650d5d4d42481cad822c962741", "shared_observables": [ { "type": "domain", "value": "acroipm2.adobe.com" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "assets.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "edge-consumer-static.azureedge.net" }, { "type": "domain", "value": "edge.microsoft.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "fp.msedge.net" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "srtb.msn.com" }, { "type": "domain", "value": "th.bing.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "windows.msn.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.msftconnecttest.com" }, { "type": "domain", "value": "www.msn.com" }, { "type": "ipv4", "value": "13.107.246.57" }, { "type": "ipv4", "value": "20.190.157.9" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "204.79.197.222" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "23.96.180.189" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "40.126.29.10" }, { "type": "ipv4", "value": "40.126.29.11" }, { "type": "ipv4", "value": "40.126.29.12" }, { "type": "ipv4", "value": "40.126.29.13" }, { "type": "ipv4", "value": "40.126.29.5" }, { "type": "ipv4", "value": "40.126.29.6" }, { "type": "ipv4", "value": "40.126.29.7" }, { "type": "ipv4", "value": "40.126.29.9" }, { "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61" } ], "shared_count": 36, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "bfccc426-aa9b-4007-8558-a66d37ecb90c", "session_id": "bc2c808d-5171-4ed5-9832-5cbf7c3a8866", "source_sha256": "e59db1c07c6fdefafa0abdbca03248c341cdc36c09c34753204d3162802a3586", "shared_observables": [ { "type": "domain", "value": "a1834.dscg2.akamai.net" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "assets.msn.com" }, { "type": "domain", "value": "browser.events.data.msn.com" }, { "type": "domain", "value": "c.bing.com" }, { "type": "domain", "value": "c.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "edge-consumer-static.azureedge.net" }, { "type": "domain", "value": "edge-microsoft-com.dual-a-0036.a-msedge.net" }, { "type": "domain", "value": "edge.microsoft.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "fe2cr.update.microsoft.com" }, { "type": "domain", "value": "fe2cr.update.msft.com.trafficmanager.net" }, { "type": "domain", "value": "g.live.com" }, { "type": "domain", "value": "img-s-msn-com.akamaized.net" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "mobile.events.data.microsoft.com" }, { "type": "domain", "value": "msedge.b.tlu.dl.delivery.mp.microsoft.com" }, { "type": "domain", "value": "ntp.msn.com" }, { "type": "domain", "value": "odc.officeapps.live.com" }, { "type": "domain", "value": "officeclient.microsoft.com" }, { "type": "domain", "value": "oneclient.sfx.ms" }, { "type": "domain", "value": "pti.store.microsoft.com" }, { "type": "domain", "value": "r.bing.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "srtb.msn.com" }, { "type": "domain", "value": "th.bing.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "v20.events.data.microsoft.com" }, { "type": "domain", "value": "windows.msn.com" }, { "type": "domain", "value": "wns.notify.trafficmanager.net" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.msftconnecttest.com" }, { "type": "domain", "value": "www.msn.com" }, { "type": "ipv4", "value": "13.107.21.237" }, { "type": "ipv4", "value": "13.107.21.239" }, { "type": "ipv4", "value": "13.107.246.57" }, { "type": "ipv4", "value": "199.232.210.172" }, { "type": "ipv4", "value": "199.232.214.172" }, { "type": "ipv4", "value": "20.10.31.115" }, { "type": "ipv4", "value": "20.125.209.212" }, { "type": "ipv4", "value": "20.190.157.9" }, { "type": "ipv4", "value": "20.241.44.114" }, { "type": "ipv4", "value": "20.96.153.111" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "204.79.197.237" }, { "type": "ipv4", "value": "204.79.197.239" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "23.205.110.12" }, { "type": "ipv4", "value": "23.205.110.48" }, { "type": "ipv4", "value": "23.205.110.59" }, { "type": "ipv4", "value": "23.220.103.18" }, { "type": "ipv4", "value": "23.220.103.8" }, { "type": "ipv4", "value": "23.96.180.189" }, { "type": "ipv4", "value": "239.255.255.250" }, { "type": "ipv4", "value": "40.126.29.10" }, { "type": "ipv4", "value": "40.126.29.11" }, { "type": "ipv4", "value": "40.126.29.12" }, { "type": "ipv4", "value": "40.126.29.15" }, { "type": "ipv4", "value": "40.126.29.5" }, { "type": "ipv4", "value": "40.126.29.7" }, { "type": "ipv4", "value": "40.126.29.8" }, { "type": "ipv4", "value": "40.126.29.9" }, { "type": "ipv4", "value": "52.109.0.142" }, { "type": "ipv4", "value": "52.109.20.38" }, { "type": "ipv4", "value": "52.113.194.132" }, { "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61" } ], "shared_count": 69, "status": "shared-observation-not-common-campaign" } ], "interpretation": "No match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.", "snapshot_sha256": "d16753b47de8ecdb023abba50189bbcdbc68cf5a1d4b318a005b594ca7c48206" }, "techniques": [ { "attack_id": "T1071.001", "name": "Application Layer Protocol: Web Protocols", "tactic": "command-and-control", "confidence": 0.85, "evidence": "T1071.001 Application Layer Protocol: Web Protocols", "review_status": "suggested", "evidence_start": 5383, "evidence_end": 5434, "evidence_source": "source-text", "llm_verified": true, "review_note": null, "reviewer": null, "reviewed_at": null } ], "apt_matches": [ { "group_attack_id": "G0071", "group_name": "Orangeworm", "similarity": 0.5, "shared_count": 1, "shared_techniques": [ "T1071.001" ] }, { "group_attack_id": "G0083", "group_name": "SilverTerrier", "similarity": 0.25, "shared_count": 1, "shared_techniques": [ "T1071.001" ] }, { "group_attack_id": "G1042", "group_name": "RedEcho", "similarity": 0.2, "shared_count": 1, "shared_techniques": [ "T1071.001" ] }, { "group_attack_id": "G1013", "group_name": "Metador", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1071.001" ] }, { "group_attack_id": "G0075", "group_name": "Rancor", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1071.001" ] }, { "group_attack_id": "G0026", "group_name": "APT18", "similarity": 0.0833, "shared_count": 1, "shared_techniques": [ "T1071.001" ] }, { "group_attack_id": "G0085", "group_name": "FIN4", "similarity": 0.0833, "shared_count": 1, "shared_techniques": [ "T1071.001" ] }, { "group_attack_id": "G0070", "group_name": "Dark Caracal", "similarity": 0.0833, "shared_count": 1, "shared_techniques": [ "T1071.001" ] }, { "group_attack_id": "G0127", "group_name": "TA551", "similarity": 0.0714, "shared_count": 1, "shared_techniques": [ "T1071.001" ] }, { "group_attack_id": "G1002", "group_name": "BITTER", "similarity": 0.0625, "shared_count": 1, "shared_techniques": [ "T1071.001" ] } ] }