{ "analysis_id": "faf041c3-70e0-4a01-8780-10917e5e187c", "session_id": "df6c55a2-3630-4e95-82d0-0eebb41c3b51", "status": "completed", "filename": "2024-09-04-traffic-analysis-exercise.pcap", "source_sha256": "8fee06d0b1686faab4364f5b7a741e736ad7e713d5ca9299ff9161a4b4d4862e", "source_size_bytes": 2129659, "schema_version": "pcap-analysis-v1", "semantic_sha256": "4897ba23edbbda370beb304db04a336b3872d332b86d9834b16bb29e87c6d8b5", "analyzer_manifest": { "schema_version": "pcap-analyzer-manifest-v1", "profile_id": "tshark-evidence-v3", "rulepack_version": "pcap-rules-v3", "tshark_version": "TShark (Wireshark) 4.4.18.", "implementation_sha256": "9e8d2397c92213d4143ee2e4e2f86f0c1606d085cc7a81fd3ab98e687a5a9388", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "limits": { "max_upload_bytes": 536870912, "tool_timeout_seconds": 300, "max_tool_output_bytes": 268435456, "max_events_per_kind": 50000, "max_flows": 50000, "max_endpoints": 20000, "max_exported_objects": 500, "max_object_hash_index": 50000, "max_exported_object_bytes": 52428800, "max_exported_total_bytes": 268435456 }, "requested_fields_sha256": "fb9865915ed277886a75f522c6f27708f67e4e28e7a9d4a051ed816dd6783b15", "supported_profile_fields_sha256": "917cc2ac17024ecb151d0baaf8ddfb0767624db4f29d127ec668d6ebb5d80604", "profile_sha256": "7bdd5b06266e645efbbef1674e9934e21a27fcb37b084c18bcfe6abd8192ade3", "manifest_sha256": "ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde" }, "summary": "Decoded 5091 packets across 42 IP endpoints and 221 transport flows. Observed 173 DNS events, 57 HTTP requests, 72 TLS ClientHello events, and 6 exported HTTP object(s). Deterministic rules produced 8 finding(s): 0 high, 1 medium, and 7 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2024-09-04-traffic-analysis-exercise.pcap\nCapture SHA-256: `8fee06d0b1686faab4364f5b7a741e736ad7e713d5ca9299ff9161a4b4d4862e`\nSemantic result SHA-256: `4897ba23edbbda370beb304db04a336b3872d332b86d9834b16bb29e87c6d8b5`\nAnalyzer manifest SHA-256: `ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde`\n\n## Executive summary\n\nDecoded 5091 packets across 42 IP endpoints and 221 transport flows. Observed 173 DNS events, 57 HTTP requests, 72 TLS ClientHello events, and 6 exported HTTP object(s). Deterministic rules produced 8 finding(s): 0 high, 1 medium, and 7 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 5091\n- Duration: 3576.159984 seconds\n- Captured bytes: 2048179\n- Endpoints: 42\n- Flows: 221\n\n## Deterministic findings\n\n### MEDIUM — Repeated outbound HTTP POST activity\n\nThe same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review.\n\nRule: `repeated-http-posts@pcap-rules-v3`; confidence: 0.72; evidence: frame 1668 / TCP stream 48, frame 1672 / TCP stream 48, frame 1697 / TCP stream 48, frame 2347 / TCP stream 56, frame 2985 / TCP stream 63.\n\nMetrics: `{\"declared_body_bytes\":2046,\"destination\":\"79.124.78.197\",\"host\":\"79.124.78.197\",\"port\":80,\"request_count\":48,\"source\":\"172.17.0.99\",\"uri\":\"/foots.php\"}`\n\n### LOW — Repeated unsuccessful DNS resolution\n\nRepeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.\n\nRule: `repeated-nxdomain@pcap-rules-v3`; confidence: 0.5; evidence: frame 41, frame 42, frame 111, frame 112, frame 215.\n\nMetrics: `{\"domain\":\"wpad.bepositive.com\",\"response_count\":20,\"source\":\"172.17.0.99\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 384 / TCP stream 14, frame 386 / TCP stream 14, frame 388 / TCP stream 14, frame 391 / TCP stream 14, frame 1074 / TCP stream 34.\n\nMetrics: `{\"destination\":\"172.17.0.99\",\"event_count\":39,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"172.17.0.17\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 33 / TCP stream 0, frame 419 / TCP stream 18, frame 431 / TCP stream 18, frame 452 / TCP stream 19, frame 455 / TCP stream 19.\n\nMetrics: `{\"destination\":\"172.17.0.99\",\"event_count\":66,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"172.17.0.17\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 410 / TCP stream 13, frame 415 / TCP stream 13, frame 417 / TCP stream 13, frame 420 / TCP stream 13, frame 422 / TCP stream 13.\n\nMetrics: `{\"destination\":\"172.17.0.99\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"172.17.0.17\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 382 / TCP stream 14, frame 385 / TCP stream 14, frame 387 / TCP stream 14, frame 389 / TCP stream 14, frame 1073 / TCP stream 34.\n\nMetrics: `{\"destination\":\"172.17.0.17\",\"event_count\":39,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"172.17.0.99\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 31 / TCP stream 0, frame 34 / TCP stream 0, frame 412 / TCP stream 18, frame 430 / TCP stream 18, frame 443 / TCP stream 19.\n\nMetrics: `{\"destination\":\"172.17.0.17\",\"event_count\":84,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"172.17.0.99\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 409 / TCP stream 13, frame 413 / TCP stream 13, frame 416 / TCP stream 13, frame 418 / TCP stream 13, frame 421 / TCP stream 13.\n\nMetrics: `{\"destination\":\"172.17.0.17\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"172.17.0.99\"}`\n\n## ATT&CK candidates\n\n- No deterministic ATT&CK candidates.\n\n## Identities\n\n- account: `afletcher`; client IPs: 172.17.0.99; frames: 293, 301, 303, 317, 350\n- full-name: `Andrew Fletcher`; client IPs: 172.17.0.99; frames: 428\n- hostname: `DESKTOP-RNVO9AT`; client IPs: 172.17.0.99; frames: 1, 3, 20, 22, 60\n- netbios-group: `BEPOSITIVE`; client IPs: unbound subject; frames: 21, 61, 65, 82, 85\n\n## IOC and artifact candidates\n\n- domain: `a1834.dscg2.akamai.net`; roles: dns-cname\n- domain: `acroipm2.adobe.com`; roles: dns-query, http-host\n- domain: `api.msn.com`; roles: dns-query, tls-sni\n- domain: `arc.msn.com`; roles: dns-query, tls-sni\n- domain: `assets.msn.com`; roles: dns-query, tls-sni\n- domain: `bepositive.com`; roles: dns-query\n- domain: `blob.mwh03prdstf02a.store.core.windows.net`; roles: dns-cname\n- domain: `client.wns.windows.com`; roles: tls-sni\n- domain: `ctldl.windowsupdate.com`; roles: dns-query, http-host\n- domain: `desktop-rnvo9at.bepositive.com`; roles: dns-query\n- domain: `dns.msftncsi.com`; roles: dns-query\n- domain: `download.windowsupdate.com`; roles: dns-query\n- domain: `ecs.office.com`; roles: dns-query, tls-sni\n- domain: `fd.api.iris.microsoft.com`; roles: dns-query, tls-sni\n- domain: `g.live.com`; roles: dns-query, tls-sni\n- domain: `img-s-msn-com.akamaized.net`; roles: dns-query, tls-sni\n- domain: `inputsuggestions.msdxcdn.microsoft.com`; roles: dns-query, tls-sni\n- domain: `login.microsoftonline.com`; roles: dns-query, tls-sni\n- domain: `mobile.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `odc.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `officeclient.microsoft.com`; roles: dns-query, tls-sni\n- domain: `oneclient.sfx.ms`; roles: dns-query, tls-sni\n- domain: `pti.store.microsoft.com`; roles: dns-query\n- domain: `settings-win.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `srtb.msn.com`; roles: dns-query, tls-sni\n- domain: `sso.godaddy.com`; roles: dns-query, tls-sni\n- domain: `storecatalogrevocation.storequality.microsoft.com`; roles: dns-query, tls-sni\n- domain: `th.bing.com`; roles: dns-query, tls-sni\n- domain: `v10.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `weathermapdata.blob.core.windows.net`; roles: dns-query, tls-sni\n- domain: `win-ctl9xbq9y19.bepositive.com`; roles: dns-query\n- domain: `windows.msn.com`; roles: dns-query, tls-sni\n- domain: `wpad.bepositive.com`; roles: dns-query\n- domain: `www.bellantonicioccolato.it`; roles: tls-sni\n- domain: `www.bing.com`; roles: dns-query, tls-sni\n- domain: `www.msftconnecttest.com`; roles: dns-query, http-host\n- domain: `www.msn.com`; roles: dns-query, tls-sni\n- domain: `x1.c.lencr.org`; roles: dns-query, http-host\n- ipv4: `0.0.0.0`; roles: network-endpoint\n- ipv4: `13.107.246.57`; roles: dns-answer, network-endpoint\n- ipv4: `13.70.79.200`; roles: dns-answer, network-endpoint\n- ipv4: `13.89.179.9`; roles: dns-answer, network-endpoint\n- ipv4: `131.107.255.255`; roles: dns-answer\n- ipv4: `172.17.0.17`; roles: dns-answer, network-endpoint\n- ipv4: `172.17.0.255`; roles: network-endpoint\n- ipv4: `172.17.0.99`; roles: dns-answer, network-endpoint\n- ipv4: `184.29.137.96`; roles: dns-answer, network-endpoint\n- ipv4: `199.232.210.172`; roles: dns-answer, network-endpoint\n- ipv4: `199.232.214.172`; roles: dns-answer, network-endpoint\n- ipv4: `20.10.31.115`; roles: network-endpoint\n- ipv4: `20.189.173.1`; roles: dns-answer, network-endpoint\n- ipv4: `20.189.173.18`; roles: dns-answer, network-endpoint\n- ipv4: `20.189.173.26`; roles: dns-answer, network-endpoint\n- ipv4: `20.190.135.2`; roles: dns-answer\n- ipv4: `20.241.44.114`; roles: dns-answer, network-endpoint\n- ipv4: `20.42.73.28`; roles: dns-answer, network-endpoint\n- ipv4: `20.60.228.1`; roles: dns-answer, network-endpoint\n- ipv4: `20.96.153.111`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.203`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.251`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.194.68.140`; roles: dns-answer, network-endpoint\n- ipv4: `23.195.212.189`; roles: dns-answer, network-endpoint\n- ipv4: `23.220.251.149`; roles: dns-answer, network-endpoint\n- ipv4: `23.220.251.153`; roles: dns-answer, network-endpoint\n- ipv4: `23.220.251.158`; roles: dns-answer, network-endpoint\n- ipv4: `23.220.251.160`; roles: dns-answer\n- ipv4: `23.220.251.47`; roles: dns-answer, network-endpoint\n- ipv4: `23.220.251.48`; roles: dns-answer\n- ipv4: `23.221.24.49`; roles: dns-answer\n- ipv4: `23.221.24.50`; roles: dns-answer\n- ipv4: `23.221.24.51`; roles: dns-answer\n- ipv4: `23.221.24.52`; roles: dns-answer\n- ipv4: `23.221.24.53`; roles: dns-answer\n- ipv4: `23.221.24.55`; roles: dns-answer\n- ipv4: `23.221.24.56`; roles: dns-answer\n- ipv4: `23.221.24.57`; roles: dns-answer\n- ipv4: `23.221.24.58`; roles: dns-answer, network-endpoint\n- ipv4: `23.221.24.62`; roles: dns-answer\n- ipv4: `23.221.24.63`; roles: dns-answer\n- ipv4: `23.221.24.64`; roles: dns-answer\n- ipv4: `23.221.24.68`; roles: dns-answer\n- ipv4: `23.221.24.69`; roles: dns-answer, network-endpoint\n- ipv4: `23.221.24.70`; roles: dns-answer\n- ipv4: `23.221.24.73`; roles: dns-answer\n- ipv4: `23.40.145.142`; roles: dns-answer, network-endpoint\n- ipv4: `23.45.119.134`; roles: dns-answer\n- ipv4: `23.45.119.140`; roles: dns-answer\n- ipv4: `23.45.119.142`; roles: dns-answer\n- ipv4: `23.45.119.143`; roles: dns-answer, network-endpoint\n- ipv4: `23.45.119.144`; roles: dns-answer, network-endpoint\n- ipv4: `23.45.119.146`; roles: dns-answer\n- ipv4: `23.45.119.147`; roles: dns-answer, network-endpoint\n- ipv4: `23.45.119.166`; roles: dns-answer\n- ipv4: `23.45.119.174`; roles: dns-answer\n- ipv4: `255.255.255.255`; roles: network-endpoint\n- ipv4: `40.119.249.228`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.28.11`; roles: dns-answer\n- ipv4: `40.126.28.12`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.28.13`; roles: dns-answer\n- ipv4: `40.126.28.18`; roles: dns-answer\n- ipv4: `40.126.28.19`; roles: dns-answer\n- ipv4: `40.126.28.20`; roles: dns-answer\n- ipv4: `40.126.28.21`; roles: dns-answer\n- ipv4: `40.126.28.22`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.28.23`; roles: dns-answer\n- ipv4: `40.126.7.32`; roles: dns-answer\n- ipv4: `40.126.7.35`; roles: dns-answer\n- ipv4: `46.254.34.201`; roles: network-endpoint\n- ipv4: `52.109.0.142`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.0.91`; roles: dns-answer, network-endpoint\n- ipv4: `52.113.194.132`; roles: dns-answer, network-endpoint\n- ipv4: `79.124.78.197`; roles: http-host, network-endpoint\n- ja3: `091f51a7a1c3a4504a224cc081ce9cee`; roles: tls-client-fingerprint\n- ja3: `1a0fcf72de58b80a8499dea99e961714`; roles: tls-client-fingerprint\n- ja3: `350c9b4a3f847974933dd25e9f9dc620`; roles: tls-client-fingerprint\n- ja3: `3c293bdf2a25c07559b560ba86debc77`; roles: tls-client-fingerprint\n- ja3: `3c4eb72b882d4d1442c67ce73f1292a9`; roles: tls-client-fingerprint\n- ja3: `4c6de70d03b552090a8d77fcb0e10629`; roles: tls-client-fingerprint\n- ja3: `5291cc6eebf72ef2ca72d48a1dd0d72f`; roles: tls-client-fingerprint\n- ja3: `5919f6108f098e14c2f37619021ebd4d`; roles: tls-client-fingerprint\n- ja3: `65005c9d9ae0f0ebeaf22c210571d482`; roles: tls-client-fingerprint\n- ja3: `6a5d235ee78c6aede6a61448b4e9ff1e`; roles: tls-client-fingerprint\n- ja3: `81e0f23545c783a55096f99f7c4755d7`; roles: tls-client-fingerprint\n- ja3: `a25c14084d58bfea7bb5de112124edb3`; roles: tls-client-fingerprint\n- ja3: `a35e0e26a8a46900d0f8297769d1112c`; roles: tls-client-fingerprint\n- ja3: `cad306d4b414c5fcf993c03e0d596109`; roles: tls-client-fingerprint\n- ja3: `f06a64ec6ecba24167cfe2612badcd91`; roles: tls-client-fingerprint\n- sha256: `3f39d5c348e5b79d06e842c114e6cc571583bbf44e4b0ebfda1a01ec05745d43`; roles: exported-object\n- sha256: `5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61`; roles: exported-object\n- sha256: `69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820`; roles: exported-object\n- sha256: `736f0cb5cc23435dad920dbe447efcf102e61c8691fa8528f5f39f386537f43e`; roles: exported-object\n- sha256: `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`; roles: exported-object\n- sha256: `ed0855c1637e5f93be7d54acb2cb8872683a0e5eb670258abb1ebc41bfbf4591`; roles: exported-object\n- url: `http://79.124.78.197/foots.php`; roles: http-request\n- url: `http://79.124.78.197/index.php`; roles: http-request\n- url: `http://79.124.78.197/index.php?id=&subid=qIOuKk7U`; roles: http-request\n- url: `http://acroipm2.adobe.com/assets/Owner/arm/ProcessMAU.txt`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?d7a8a57aa5acd39b`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?91717f420e6dda94`; roles: http-request\n- url: `http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?a5fef2ac8502b132`; roles: http-request\n- url: `http://www.msftconnecttest.com/connecttest.txt`; roles: http-request\n- url: `http://x1.c.lencr.org/`; roles: http-request\n- user_agent: `Microsoft NCSI`; roles: http-client\n- user_agent: `Microsoft-CryptoAPI/10.0`; roles: http-client\n- user_agent: `Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)`; roles: http-client\n- user_agent: `Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)`; roles: http-client\n- exported object `index.php`; SHA-256 `ed0855c1637e5f93be7d54acb2cb8872683a0e5eb670258abb1ebc41bfbf4591`; size 105 bytes\n- exported object `index.php%3fid=&subid=qIOuKk7U`; SHA-256 `736f0cb5cc23435dad920dbe447efcf102e61c8691fa8528f5f39f386537f43e`; size 61 bytes\n- exported object `connecttest(1).txt`; SHA-256 `5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61`; size 22 bytes\n- exported object `ProcessMAU.txt`; SHA-256 `69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820`; size 4 bytes\n- exported object `index(1).php`; SHA-256 `3f39d5c348e5b79d06e842c114e6cc571583bbf44e4b0ebfda1a01ec05745d43`; size 1 bytes\n- exported object `foots(1).php`; SHA-256 `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`; size 0 bytes\n\n## Actor similarity leads\n\n- No actor lead was calculated.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `99bf9b0d5c90e5eb36c1f5a055241fc0beb1b677bd448cb59545c1ac1d629049`; recorded 2026-09-19T12:08:45.501397+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":147,\"observable_limit\":5000,\"observables_checked\":147,\"observables_total\":147,\"prior_case_limit_reached\":false,\"prior_cases_checked\":7,\"truncated\":false}`\n\n- Prior analysis `08324647-35af-4af2-8d82-4387eec03918` shares 38 observations. This does not establish a common campaign.\n- Prior analysis `616a90fa-f15e-4fcb-8d56-7b8e0eff5785` shares 12 observations. This does not establish a common campaign.\n- Prior analysis `459e119d-191f-49e8-85ea-c78f9de41826` shares 31 observations. This does not establish a common campaign.\n- Prior analysis `7a2cfe72-f48d-4894-8a2d-8889cb3b11b2` shares 47 observations. This does not establish a common campaign.\n- Prior analysis `81373b30-6a59-49d1-89b0-bad73ed19eaa` shares 26 observations. This does not establish a common campaign.\n- Prior analysis `38851ad7-b3a0-423d-ae89-3b7be4e4b908` shares 26 observations. This does not establish a common campaign.\n- Prior analysis `bfccc426-aa9b-4007-8558-a66d37ecb90c` shares 56 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":6,\"exported_objects\":54,\"hashed_bytes\":215,\"hashed_objects\":54,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":6,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":6}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 8/8, identities 4/4, observables 147/147, artifacts 6/6. Full returned inventory is in the JSON result.\n", "result": { "schema_version": "pcap-analysis-v1", "analysis_key_material": { "source_sha256": "8fee06d0b1686faab4364f5b7a741e736ad7e713d5ca9299ff9161a4b4d4862e", "analyzer_manifest_sha256": "ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde", "rulepack_version": "pcap-rules-v3" }, "analyzer_manifest": { "schema_version": "pcap-analyzer-manifest-v1", "profile_id": "tshark-evidence-v3", "rulepack_version": "pcap-rules-v3", "tshark_version": "TShark (Wireshark) 4.4.18.", "implementation_sha256": "9e8d2397c92213d4143ee2e4e2f86f0c1606d085cc7a81fd3ab98e687a5a9388", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "limits": { "max_upload_bytes": 536870912, "tool_timeout_seconds": 300, "max_tool_output_bytes": 268435456, "max_events_per_kind": 50000, "max_flows": 50000, "max_endpoints": 20000, "max_exported_objects": 500, "max_object_hash_index": 50000, "max_exported_object_bytes": 52428800, "max_exported_total_bytes": 268435456 }, "requested_fields_sha256": "fb9865915ed277886a75f522c6f27708f67e4e28e7a9d4a051ed816dd6783b15", "supported_profile_fields_sha256": "917cc2ac17024ecb151d0baaf8ddfb0767624db4f29d127ec668d6ebb5d80604", "profile_sha256": "7bdd5b06266e645efbbef1674e9934e21a27fcb37b084c18bcfe6abd8192ade3", "manifest_sha256": "ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde" }, "capture": { "packet_count": 5091, "captured_bytes": 2048179, "first_packet_epoch": "1725471151.318609", "last_packet_epoch": "1725474727.478593", "duration_seconds": 3576.159984, "interface_ids": [], "encapsulation_types": [ 1 ], "format": "pcap-le-microsecond", "source_sha256": "8fee06d0b1686faab4364f5b7a741e736ad7e713d5ca9299ff9161a4b4d4862e", "source_size_bytes": 2129659, "protocol_counts": { "eth": 5091, "ethertype": 5091, "ip": 4797, "tcp": 4222, "tls": 788, "udp": 575, "x509sat": 478, "x509ce": 347, "spnego-krb5": 337, "quic": 331, "arp": 294, "nbss": 260, "dcerpc": 176, "dns": 173, "smb2": 167, "gss-api": 162, "ldap": 158, "http": 114, "spnego": 110, "data": 105, "smb": 101, "pkix1implicit": 39, "ntlmssp": 25, "cldap": 20, "ocsp": 20, "browser": 18, "nbdgm": 18, "nbns": 18, "pkix1explicit": 17, "kerberos": 16, "ntp": 8, "data-text-lines": 5, "dhcp": 4, "mdns": 2, "llmnr": 1 } }, "endpoints": [ { "endpoint_id": "endpoint-76430b65c7b9e458493feae4", "ip": "0.0.0.0", "ip_version": 4, "is_private": true, "mac_addresses": [ "18:3d:a2:b6:8d:c4" ], "packets_sent": 2, "packets_received": 0, "bytes_sent": 729, "bytes_received": 0, "first_seen_epoch": "1725471151.318609", "last_seen_epoch": "1725471151.319898", "evidence_frames": [ 1, 3 ] }, { "endpoint_id": "endpoint-10a217c5253b10733e3906dd", "ip": "13.107.246.57", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 17, "packets_received": 19, "bytes_sent": 6734, "bytes_received": 2149, "first_seen_epoch": "1725471296.71628", "last_seen_epoch": "1725471386.941229", "evidence_frames": [ 1246, 1247, 1248, 1249, 1250 ] }, { "endpoint_id": "endpoint-83ebaef4f08bc23f8fd577c6", "ip": "13.70.79.200", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 15, "packets_received": 17, "bytes_sent": 5672, "bytes_received": 4682, "first_seen_epoch": "1725473078.777225", "last_seen_epoch": "1725473080.470605", "evidence_frames": [ 4257, 4258, 4259, 4260, 4261 ] }, { "endpoint_id": "endpoint-96246a92c868b7f45c63af1f", "ip": "13.89.179.9", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 12, "packets_received": 14, "bytes_sent": 5356, "bytes_received": 3101, "first_seen_epoch": "1725471611.312779", "last_seen_epoch": "1725471611.866071", "evidence_frames": [ 3142, 3143, 3144, 3145, 3146 ] }, { "endpoint_id": "endpoint-93bac8c22b372104d397c4e5", "ip": "172.17.0.17", "ip_version": 4, "is_private": true, "mac_addresses": [ "00:23:ae:50:ba:fd" ], "packets_sent": 611, "packets_received": 699, "bytes_sent": 149792, "bytes_received": 172235, "first_seen_epoch": "1725471151.319395", "last_seen_epoch": "1725474727.478593", "evidence_frames": [ 2, 4, 7, 9, 12 ] }, { "endpoint_id": "endpoint-c440bfdbb73e862a2c3c6591", "ip": "172.17.0.255", "ip_version": 4, "is_private": true, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "packets_sent": 0, "packets_received": 35, "bytes_sent": 0, "bytes_received": 6046, "first_seen_epoch": "1725471151.396549", "last_seen_epoch": "1725474279.648734", "evidence_frames": [ 20, 21, 22, 60, 61 ] }, { "endpoint_id": "endpoint-cbb6a37d5c72026501e0a7e6", "ip": "172.17.0.99", "ip_version": 4, "is_private": true, "mac_addresses": [ "18:3d:a2:b6:8d:c4" ], "packets_sent": 2358, "packets_received": 2435, "bytes_sent": 400542, "bytes_received": 1628565, "first_seen_epoch": "1725471151.328745", "last_seen_epoch": "1725474727.478593", "evidence_frames": [ 7, 8, 9, 10, 11 ] }, { "endpoint_id": "endpoint-921b049c13c7fdd58f6fc4e1", "ip": "184.29.137.96", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 4, "packets_received": 6, "bytes_sent": 503, "bytes_received": 587, "first_seen_epoch": "1725473139.516337", "last_seen_epoch": "1725473199.738788", "evidence_frames": [ 4305, 4306, 4307, 4308, 4309 ] }, { "endpoint_id": "endpoint-07eb1d6c41fb564f08ae4aae", "ip": "199.232.210.172", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 7, "packets_received": 7, "bytes_sent": 817, "bytes_received": 981, "first_seen_epoch": "1725472865.565177", "last_seen_epoch": "1725472925.764937", "evidence_frames": [ 4117, 4118, 4119, 4120, 4121 ] }, { "endpoint_id": "endpoint-373df20ebaaef40782c964fb", "ip": "199.232.214.172", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 5, "packets_received": 6, "bytes_sent": 503, "bytes_received": 642, "first_seen_epoch": "1725473139.610865", "last_seen_epoch": "1725473199.723036", "evidence_frames": [ 4313, 4315, 4316, 4317, 4318 ] }, { "endpoint_id": "endpoint-e3de7b1f0e0834b24df766db", "ip": "20.10.31.115", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 28, "packets_received": 31, "bytes_sent": 6989, "bytes_received": 4536, "first_seen_epoch": "1725471222.922365", "last_seen_epoch": "1725474602.839069", "evidence_frames": [ 185, 186, 187, 188, 189 ] }, { "endpoint_id": "endpoint-97145b48da64d1e4077eddff", "ip": "20.189.173.1", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 15, "packets_received": 18, "bytes_sent": 5672, "bytes_received": 5238, "first_seen_epoch": "1725472176.569848", "last_seen_epoch": "1725472177.264116", "evidence_frames": [ 3668, 3671, 3672, 3673, 3684 ] }, { "endpoint_id": "endpoint-bedc911af71dee4302c72970", "ip": "20.189.173.18", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 22, "packets_received": 30, "bytes_sent": 15376, "bytes_received": 5385, "first_seen_epoch": "1725472805.211273", "last_seen_epoch": "1725474715.181862", "evidence_frames": [ 4036, 4037, 4038, 4039, 4040 ] }, { "endpoint_id": "endpoint-5df562d1ec92da04f70f4dc7", "ip": "20.189.173.26", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 13, "packets_received": 15, "bytes_sent": 5452, "bytes_received": 3255, "first_seen_epoch": "1725471852.362541", "last_seen_epoch": "1725471852.916613", "evidence_frames": [ 3261, 3262, 3263, 3264, 3265 ] }, { "endpoint_id": "endpoint-7b0e553b8aac7435507c6c61", "ip": "20.241.44.114", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 9, "packets_received": 12, "bytes_sent": 7198, "bytes_received": 1439, "first_seen_epoch": "1725471279.979068", "last_seen_epoch": "1725471314.331476", "evidence_frames": [ 1053, 1054, 1055, 1056, 1129 ] }, { "endpoint_id": "endpoint-acf3e44e1ee03f5548440300", "ip": "20.42.73.28", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 16, "packets_received": 20, "bytes_sent": 5696, "bytes_received": 10096, "first_seen_epoch": "1725471255.699611", "last_seen_epoch": "1725471256.448135", "evidence_frames": [ 245, 246, 247, 248, 249 ] }, { "endpoint_id": "endpoint-48b1bdf3a67a38c40acc96f9", "ip": "20.60.228.1", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 13, "packets_received": 17, "bytes_sent": 12001, "bytes_received": 2114, "first_seen_epoch": "1725471938.580076", "last_seen_epoch": "1725472068.571195", "evidence_frames": [ 3391, 3392, 3393, 3394, 3395 ] }, { "endpoint_id": "endpoint-c1b71c45392212b18818da46", "ip": "20.96.153.111", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 28, "packets_received": 33, "bytes_sent": 15036, "bytes_received": 6038, "first_seen_epoch": "1725471276.337901", "last_seen_epoch": "1725471595.186605", "evidence_frames": [ 576, 577, 578, 579, 580 ] }, { "endpoint_id": "endpoint-577b04ebbbcbd0df57148969", "ip": "204.79.197.203", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 144, "packets_received": 117, "bytes_sent": 79752, "bytes_received": 23651, "first_seen_epoch": "1725471276.697176", "last_seen_epoch": "1725472406.415203", "evidence_frames": [ 603, 612, 613, 614, 616 ] }, { "endpoint_id": "endpoint-0b1972195f90c329861bb5cd", "ip": "224.0.0.251", "ip_version": 4, "is_private": false, "mac_addresses": [ "01:00:5e:00:00:fb" ], "packets_sent": 0, "packets_received": 2, "bytes_sent": 0, "bytes_received": 172, "first_seen_epoch": "1725471151.328859", "last_seen_epoch": "1725471151.328989", "evidence_frames": [ 8, 10 ] }, { "endpoint_id": "endpoint-33d9d565c8a9fdd1cc1eeffd", "ip": "224.0.0.252", "ip_version": 4, "is_private": false, "mac_addresses": [ "01:00:5e:00:00:fc" ], "packets_sent": 0, "packets_received": 1, "bytes_sent": 0, "bytes_received": 75, "first_seen_epoch": "1725471151.329715", "last_seen_epoch": "1725471151.329715", "evidence_frames": [ 11 ] }, { "endpoint_id": "endpoint-fb23cc3f5e49908a0325990a", "ip": "23.194.68.140", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 11, "packets_received": 10, "bytes_sent": 7485, "bytes_received": 1257, "first_seen_epoch": "1725471761.525267", "last_seen_epoch": "1725471761.813653", "evidence_frames": [ 3205, 3206, 3207, 3208, 3209 ] }, { "endpoint_id": "endpoint-143324186048e4a8e61bfcb9", "ip": "23.195.212.189", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 37, "packets_received": 41, "bytes_sent": 32785, "bytes_received": 4803, "first_seen_epoch": "1725471280.594513", "last_seen_epoch": "1725472176.725498", "evidence_frames": [ 1200, 1201, 1202, 1203, 1204 ] }, { "endpoint_id": "endpoint-fb110702c860fce4f97acd63", "ip": "23.220.251.149", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 5, "packets_received": 5, "bytes_sent": 487, "bytes_received": 454, "first_seen_epoch": "1725471151.894502", "last_seen_epoch": "1725471152.03503", "evidence_frames": [ 49, 50, 51, 52, 53 ] }, { "endpoint_id": "endpoint-1322668a6da55fb489c028d1", "ip": "23.220.251.153", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 21, "packets_received": 20, "bytes_sent": 10091, "bytes_received": 3869, "first_seen_epoch": "1725471398.624675", "last_seen_epoch": "1725471400.841096", "evidence_frames": [ 2626, 2652, 2654, 2655, 2656 ] }, { "endpoint_id": "endpoint-ac6dd4366ff2894425b07bc2", "ip": "23.220.251.158", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 5, "packets_received": 5, "bytes_sent": 487, "bytes_received": 411, "first_seen_epoch": "1725471152.99448", "last_seen_epoch": "1725471153.125097", "evidence_frames": [ 69, 70, 71, 72, 73 ] }, { "endpoint_id": "endpoint-b4bf4e91e27f3a0251688e8c", "ip": "23.220.251.47", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 3, "packets_received": 5, "bytes_sent": 476, "bytes_received": 608, "first_seen_epoch": "1725471995.49992", "last_seen_epoch": "1725471995.853844", "evidence_frames": [ 3437, 3438, 3439, 3440, 3441 ] }, { "endpoint_id": "endpoint-289b119a2a6b8df99ddbf5ab", "ip": "23.221.24.58", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 91, "packets_received": 101, "bytes_sent": 90638, "bytes_received": 11698, "first_seen_epoch": "1725471275.894579", "last_seen_epoch": "1725471397.360461", "evidence_frames": [ 500, 502, 503, 504, 505 ] }, { "endpoint_id": "endpoint-365d49c63234938cdf6ac3f7", "ip": "23.221.24.69", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 147, "packets_received": 68, "bytes_sent": 160936, "bytes_received": 9973, "first_seen_epoch": "1725471398.560894", "last_seen_epoch": "1725471399.790259", "evidence_frames": [ 2593, 2594, 2604, 2605, 2606 ] }, { "endpoint_id": "endpoint-e2e13ba30432980cf1b573de", "ip": "23.40.145.142", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 12, "packets_received": 16, "bytes_sent": 9832, "bytes_received": 1686, "first_seen_epoch": "1725471280.344296", "last_seen_epoch": "1725471389.930264", "evidence_frames": [ 1155, 1156, 1157, 1158, 1170 ] }, { "endpoint_id": "endpoint-d7cd2f34bc967a9266834f7c", "ip": "23.45.119.143", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 14, "packets_received": 11, "bytes_sent": 8035, "bytes_received": 1205, "first_seen_epoch": "1725472090.718458", "last_seen_epoch": "1725472150.879645", "evidence_frames": [ 3505, 3506, 3507, 3508, 3509 ] }, { "endpoint_id": "endpoint-27eba340bdc66c970e78d704", "ip": "23.45.119.144", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 199, "packets_received": 177, "bytes_sent": 164676, "bytes_received": 24168, "first_seen_epoch": "1725471276.100652", "last_seen_epoch": "1725472698.578533", "evidence_frames": [ 532, 533, 534, 535, 536 ] }, { "endpoint_id": "endpoint-efa1d542259c3a1bdfd9b1ca", "ip": "23.45.119.147", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 13, "packets_received": 12, "bytes_sent": 7976, "bytes_received": 1265, "first_seen_epoch": "1725473809.502685", "last_seen_epoch": "1725473869.739024", "evidence_frames": [ 4697, 4698, 4699, 4700, 4701 ] }, { "endpoint_id": "endpoint-1be9c65f646884030e029444", "ip": "255.255.255.255", "ip_version": 4, "is_private": true, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "packets_sent": 0, "packets_received": 4, "bytes_sent": 0, "bytes_received": 1432, "first_seen_epoch": "1725471151.318609", "last_seen_epoch": "1725471151.320804", "evidence_frames": [ 1, 2, 3, 4 ] }, { "endpoint_id": "endpoint-1c256083703137bb9e9789a9", "ip": "40.119.249.228", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 22, "packets_received": 26, "bytes_sent": 10050, "bytes_received": 4147, "first_seen_epoch": "1725472176.787379", "last_seen_epoch": "1725472179.914223", "evidence_frames": [ 3692, 3705, 3706, 3707, 3718 ] }, { "endpoint_id": "endpoint-4e6402395b2dd10b33bb3585", "ip": "40.126.28.12", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 20, "packets_received": 35, "bytes_sent": 12182, "bytes_received": 4512, "first_seen_epoch": "1725471280.153204", "last_seen_epoch": "1725471307.130969", "evidence_frames": [ 1141, 1145, 1146, 1147, 1151 ] }, { "endpoint_id": "endpoint-13033cc9525a9fbd4cdf98ad", "ip": "40.126.28.22", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 11, "packets_received": 14, "bytes_sent": 6157, "bytes_received": 2046, "first_seen_epoch": "1725472175.895532", "last_seen_epoch": "1725472176.725456", "evidence_frames": [ 3622, 3623, 3624, 3625, 3626 ] }, { "endpoint_id": "endpoint-ecacaeb756ad7ee44208f349", "ip": "46.254.34.201", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 504, "packets_received": 278, "bytes_sent": 701293, "bytes_received": 18378, "first_seen_epoch": "1725471304.635538", "last_seen_epoch": "1725471406.583228", "evidence_frames": [ 1276, 1277, 1278, 1279, 1280 ] }, { "endpoint_id": "endpoint-9df90623c7a2211f46cf8b2f", "ip": "52.109.0.142", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 13, "packets_received": 16, "bytes_sent": 7712, "bytes_received": 1629, "first_seen_epoch": "1725471277.873835", "last_seen_epoch": "1725471402.355701", "evidence_frames": [ 887, 888, 889, 890, 907 ] }, { "endpoint_id": "endpoint-566ff15ba59f31b817f0c226", "ip": "52.109.0.91", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 16, "packets_received": 21, "bytes_sent": 8530, "bytes_received": 2027, "first_seen_epoch": "1725471277.199017", "last_seen_epoch": "1725471409.954481", "evidence_frames": [ 806, 828, 829, 830, 843 ] }, { "endpoint_id": "endpoint-69273e6a5dfe53bbcda3395b", "ip": "52.113.194.132", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 73, "packets_received": 68, "bytes_sent": 42248, "bytes_received": 14395, "first_seen_epoch": "1725472852.166591", "last_seen_epoch": "1725473891.478871", "evidence_frames": [ 4079, 4080, 4081, 4082, 4083 ] }, { "endpoint_id": "endpoint-68c0c4d34090d050605922f5", "ip": "79.124.78.197", "ip_version": 4, "is_private": false, "mac_addresses": [ "00:02:4b:51:8c:b6" ], "packets_sent": 261, "packets_received": 330, "bytes_sent": 24643, "bytes_received": 39589, "first_seen_epoch": "1725471306.753489", "last_seen_epoch": "1725474715.927104", "evidence_frames": [ 1632, 1651, 1652, 1667, 1668 ] } ], "identities": [ { "identity_id": "identity-d170589102e27d1a098c356d", "type": "account", "value": "afletcher", "ip_addresses": [ "172.17.0.99" ], "mac_addresses": [ "18:3d:a2:b6:8d:c4" ], "evidence": [ { "frame_number": 293, "timestamp_epoch": "1725471275.303608000", "display_filter": "frame.number == 293", "tcp_stream": 9 }, { "frame_number": 301, "timestamp_epoch": "1725471275.309704000", "display_filter": "frame.number == 301", "tcp_stream": 10 }, { "frame_number": 303, "timestamp_epoch": "1725471275.311510000", "display_filter": "frame.number == 303", "tcp_stream": 10 }, { "frame_number": 317, "timestamp_epoch": "1725471275.315483000", "display_filter": "frame.number == 317", "tcp_stream": 11 }, { "frame_number": 350, "timestamp_epoch": "1725471275.484008000", "display_filter": "frame.number == 350", "tcp_stream": 16 }, { "frame_number": 354, "timestamp_epoch": "1725471275.484265000", "display_filter": "frame.number == 354", "tcp_stream": 15 }, { "frame_number": 373, "timestamp_epoch": "1725471275.486633000", "display_filter": "frame.number == 373", "tcp_stream": 17 }, { "frame_number": 428, "timestamp_epoch": "1725471275.498011000", "display_filter": "frame.number == 428", "tcp_stream": 13 }, { "frame_number": 483, "timestamp_epoch": "1725471275.576097000", "display_filter": "frame.number == 483", "tcp_stream": 21 }, { "frame_number": 3009, "timestamp_epoch": "1725471470.872547000", "display_filter": "frame.number == 3009", "tcp_stream": 65 } ], "bindings": [ { "frame_number": 293, "relationship": "kerberos-client-principal", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.17", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 301, "relationship": "kerberos-client-principal", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.17", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 303, "relationship": "kerberos-client-principal", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.17", "conversation_dst": "172.17.0.99", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 317, "relationship": "kerberos-client-principal", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.17", "conversation_dst": "172.17.0.99", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 350, "relationship": "kerberos-client-principal", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.17", "conversation_dst": "172.17.0.99", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 354, "relationship": "kerberos-client-principal", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.17", "conversation_dst": "172.17.0.99", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 373, "relationship": "kerberos-client-principal", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.17", "conversation_dst": "172.17.0.99", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 428, "relationship": "directory-subject-returned-to-client", "owner_ip": null, "conversation_src": "172.17.0.17", "conversation_dst": "172.17.0.99", "account": "afletcher", "source_field": "samr.samr_UserInfo21.account_name" }, { "frame_number": 483, "relationship": "kerberos-client-principal", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.17", "conversation_dst": "172.17.0.99", "account": "", "source_field": "kerberos.CNameString" }, { "frame_number": 3009, "relationship": "kerberos-client-principal", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.17", "conversation_dst": "172.17.0.99", "account": "", "source_field": "kerberos.CNameString" } ], "raw_values": [ "afletcher" ] }, { "identity_id": "identity-6281eabc5dfb393f2954d4ab", "type": "full-name", "value": "Andrew Fletcher", "ip_addresses": [ "172.17.0.99" ], "mac_addresses": [], "evidence": [ { "frame_number": 428, "timestamp_epoch": "1725471275.498011000", "display_filter": "frame.number == 428", "tcp_stream": 13 } ], "bindings": [ { "frame_number": 428, "relationship": "directory-name-correlated-with-client-principal", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.17", "conversation_dst": "172.17.0.99", "account": "afletcher", "source_field": "samr.samr_UserInfo21.full_name" } ], "raw_values": [ "Andrew Fletcher" ] }, { "identity_id": "identity-a6415d058485fbf8447ef670", "type": "hostname", "value": "DESKTOP-RNVO9AT", "ip_addresses": [ "172.17.0.99" ], "mac_addresses": [ "18:3d:a2:b6:8d:c4", "18:3d:a2:b6:8d:c4,18:3d:a2:b6:8d:c4" ], "evidence": [ { "frame_number": 1, "timestamp_epoch": "1725471151.318609000", "display_filter": "frame.number == 1", "udp_stream": 0 }, { "frame_number": 3, "timestamp_epoch": "1725471151.319898000", "display_filter": "frame.number == 3", "udp_stream": 0 }, { "frame_number": 20, "timestamp_epoch": "1725471151.396549000", "display_filter": "frame.number == 20", "udp_stream": 8 }, { "frame_number": 22, "timestamp_epoch": "1725471151.396549000", "display_filter": "frame.number == 22", "udp_stream": 8 }, { "frame_number": 60, "timestamp_epoch": "1725471152.150023000", "display_filter": "frame.number == 60", "udp_stream": 8 }, { "frame_number": 62, "timestamp_epoch": "1725471152.150023000", "display_filter": "frame.number == 62", "udp_stream": 8 }, { "frame_number": 64, "timestamp_epoch": "1725471152.912861000", "display_filter": "frame.number == 64", "udp_stream": 8 }, { "frame_number": 66, "timestamp_epoch": "1725471152.912861000", "display_filter": "frame.number == 66", "udp_stream": 8 }, { "frame_number": 81, "timestamp_epoch": "1725471153.663907000", "display_filter": "frame.number == 81", "udp_stream": 8 }, { "frame_number": 83, "timestamp_epoch": "1725471153.663907000", "display_filter": "frame.number == 83", "udp_stream": 8 }, { "frame_number": 97, "timestamp_epoch": "1725471157.536757000", "display_filter": "frame.number == 97", "udp_stream": 14 }, { "frame_number": 98, "timestamp_epoch": "1725471157.540516000", "display_filter": "frame.number == 98", "udp_stream": 14 }, { "frame_number": 130, "timestamp_epoch": "1725471188.148346000", "display_filter": "frame.number == 130", "udp_stream": 14 }, { "frame_number": 141, "timestamp_epoch": "1725471188.172679000", "display_filter": "frame.number == 141", "tcp_stream": 4 }, { "frame_number": 147, "timestamp_epoch": "1725471188.176195000", "display_filter": "frame.number == 147", "udp_stream": 14 }, { "frame_number": 150, "timestamp_epoch": "1725471188.185423000", "display_filter": "frame.number == 150", "udp_stream": 14 }, { "frame_number": 174, "timestamp_epoch": "1725471218.199311000", "display_filter": "frame.number == 174", "tcp_stream": 5 }, { "frame_number": 180, "timestamp_epoch": "1725471218.203910000", "display_filter": "frame.number == 180", "udp_stream": 14 }, { "frame_number": 183, "timestamp_epoch": "1725471218.222904000", "display_filter": "frame.number == 183", "udp_stream": 14 }, { "frame_number": 232, "timestamp_epoch": "1725471248.256719000", "display_filter": "frame.number == 232", "tcp_stream": 7 } ], "bindings": [ { "frame_number": 1, "relationship": "dhcp-client-assertion", "owner_ip": "0.0.0.0", "conversation_src": "0.0.0.0", "conversation_dst": "255.255.255.255", "account": "", "source_field": "dhcp.option.hostname" }, { "frame_number": 3, "relationship": "dhcp-client-assertion", "owner_ip": "0.0.0.0", "conversation_src": "0.0.0.0", "conversation_dst": "255.255.255.255", "account": "", "source_field": "dhcp.option.hostname" }, { "frame_number": 20, "relationship": "netbios-registration", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 22, "relationship": "netbios-registration", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 60, "relationship": "netbios-registration", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 62, "relationship": "netbios-registration", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 64, "relationship": "netbios-registration", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 66, "relationship": "netbios-registration", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 81, "relationship": "netbios-registration", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 83, "relationship": "netbios-registration", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 97, "relationship": "client-asserted", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 98, "relationship": "client-asserted", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.255", "account": "", "source_field": "browser.server" }, { "frame_number": 130, "relationship": "client-asserted", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 141, "relationship": "client-asserted", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.17", "account": "", "source_field": "ntlmssp.auth.hostname" }, { "frame_number": 147, "relationship": "client-asserted", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 150, "relationship": "client-asserted", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 174, "relationship": "client-asserted", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.17", "account": "", "source_field": "ntlmssp.auth.hostname" }, { "frame_number": 180, "relationship": "client-asserted", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 183, "relationship": "client-asserted", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.255", "account": "", "source_field": "browser.response_computer_name" }, { "frame_number": 232, "relationship": "client-asserted", "owner_ip": "172.17.0.99", "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.17", "account": "", "source_field": "ntlmssp.auth.hostname" } ], "raw_values": [ "DESKTOP-RNVO9AT", "DESKTOP-RNVO9AT<00>,DESKTOP-RNVO9AT<00> (Workstation/Redirector)", "DESKTOP-RNVO9AT<20>,DESKTOP-RNVO9AT<20> (Server service)" ] }, { "identity_id": "identity-498252bc3d6ec8cb44cd6137", "type": "netbios-group", "value": "BEPOSITIVE", "ip_addresses": [], "mac_addresses": [], "evidence": [ { "frame_number": 21, "timestamp_epoch": "1725471151.396549000", "display_filter": "frame.number == 21", "udp_stream": 8 }, { "frame_number": 61, "timestamp_epoch": "1725471152.150023000", "display_filter": "frame.number == 61", "udp_stream": 8 }, { "frame_number": 65, "timestamp_epoch": "1725471152.912861000", "display_filter": "frame.number == 65", "udp_stream": 8 }, { "frame_number": 82, "timestamp_epoch": "1725471153.663907000", "display_filter": "frame.number == 82", "udp_stream": 8 }, { "frame_number": 85, "timestamp_epoch": "1725471154.449002000", "display_filter": "frame.number == 85", "udp_stream": 8 }, { "frame_number": 91, "timestamp_epoch": "1725471155.224995000", "display_filter": "frame.number == 91", "udp_stream": 8 }, { "frame_number": 92, "timestamp_epoch": "1725471155.975604000", "display_filter": "frame.number == 92", "udp_stream": 8 }, { "frame_number": 96, "timestamp_epoch": "1725471156.745729000", "display_filter": "frame.number == 96", "udp_stream": 8 } ], "bindings": [ { "frame_number": 21, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 61, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 65, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 82, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 85, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 91, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 92, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.255", "account": "", "source_field": "nbns.name" }, { "frame_number": 96, "relationship": "group-membership-not-hostname", "owner_ip": null, "conversation_src": "172.17.0.99", "conversation_dst": "172.17.0.255", "account": "", "source_field": "nbns.name" } ], "raw_values": [ "BEPOSITIVE<00>,BEPOSITIVE<00> (Workstation/Redirector)", "BEPOSITIVE<1e>,BEPOSITIVE<1e> (Browser Election Service)" ] } ], "flows": [ { "flow_id": "flow-2b4ab0aa9eee18402ab688db", "transport": "udp", "stream": 0, "initiator_ip": "0.0.0.0", "initiator_port": 68, "responder_ip": "255.255.255.255", "responder_port": 67, "first_frame": 1, "last_frame": 3, "first_seen_epoch": "1725471151.318609", "last_seen_epoch": "1725471151.319898", "packets": 2, "bytes": 729, "initiator_bytes": 729, "responder_bytes": 0 }, { "flow_id": "flow-cfa91da2d597b916fdf39673", "transport": "udp", "stream": 1, "initiator_ip": "172.17.0.17", "initiator_port": 67, "responder_ip": "255.255.255.255", "responder_port": 68, "first_frame": 2, "last_frame": 4, "first_seen_epoch": "1725471151.319395", "last_seen_epoch": "1725471151.320804", "packets": 2, "bytes": 703, "initiator_bytes": 703, "responder_bytes": 0 }, { "flow_id": "flow-75a1f0293a0fb19934af9737", "transport": "udp", "stream": 2, "initiator_ip": "172.17.0.99", "initiator_port": 59123, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 7, "last_frame": 9, "first_seen_epoch": "1725471151.328745", "last_seen_epoch": "1725471151.328944", "packets": 2, "bytes": 318, "initiator_bytes": 126, "responder_bytes": 192 }, { "flow_id": "flow-1072cfda2919f811b1768257", "transport": "udp", "stream": 3, "initiator_ip": "172.17.0.99", "initiator_port": 5353, "responder_ip": "224.0.0.251", "responder_port": 5353, "first_frame": 8, "last_frame": 10, "first_seen_epoch": "1725471151.328859", "last_seen_epoch": "1725471151.328989", "packets": 2, "bytes": 172, "initiator_bytes": 172, "responder_bytes": 0 }, { "flow_id": "flow-3a9e4f47a0a8e44d331314a6", "transport": "udp", "stream": 4, "initiator_ip": "172.17.0.99", "initiator_port": 65173, "responder_ip": "224.0.0.252", "responder_port": 5355, "first_frame": 11, "last_frame": 11, "first_seen_epoch": "1725471151.329715", "last_seen_epoch": "1725471151.329715", "packets": 1, "bytes": 75, "initiator_bytes": 75, "responder_bytes": 0 }, { "flow_id": "flow-69fad417f83d5bb4bf60f766", "transport": "udp", "stream": 5, "initiator_ip": "172.17.0.99", "initiator_port": 59940, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 12, "last_frame": 19, "first_seen_epoch": "1725471151.329715", "last_seen_epoch": "1725471151.33256", "packets": 4, "bytes": 571, "initiator_bytes": 246, "responder_bytes": 325 }, { "flow_id": "flow-73ac8c3953e39f89b384ed81", "transport": "udp", "stream": 6, "initiator_ip": "172.17.0.99", "initiator_port": 51761, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 13, "last_frame": 25, "first_seen_epoch": "1725471151.329715", "last_seen_epoch": "1725471151.431808", "packets": 4, "bytes": 514, "initiator_bytes": 216, "responder_bytes": 298 }, { "flow_id": "flow-73ac4f52bbb4a03c2069dcd3", "transport": "udp", "stream": 7, "initiator_ip": "172.17.0.99", "initiator_port": 59941, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 16, "last_frame": 18, "first_seen_epoch": "1725471151.33043", "last_seen_epoch": "1725471151.330924", "packets": 2, "bytes": 501, "initiator_bytes": 265, "responder_bytes": 236 }, { "flow_id": "flow-bf80d742727aa496594f294f", "transport": "udp", "stream": 8, "initiator_ip": "172.17.0.99", "initiator_port": 137, "responder_ip": "172.17.0.255", "responder_port": 137, "first_frame": 20, "last_frame": 131, "first_seen_epoch": "1725471151.396549", "last_seen_epoch": "1725471188.167295", "packets": 17, "bytes": 1852, "initiator_bytes": 1852, "responder_bytes": 0 }, { "flow_id": "flow-186e146d0b4564bf94ab93a4", "transport": "tcp", "stream": 0, "initiator_ip": "172.17.0.99", "initiator_port": 49765, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 24, "last_frame": 37, "first_seen_epoch": "1725471151.431684", "last_seen_epoch": "1725471151.434301", "packets": 11, "bytes": 2975, "initiator_bytes": 2465, "responder_bytes": 510 }, { "flow_id": "flow-72cb91002a0ff8b8dc1e5fe1", "transport": "udp", "stream": 9, "initiator_ip": "172.17.0.99", "initiator_port": 59942, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 28, "last_frame": 29, "first_seen_epoch": "1725471151.432381", "last_seen_epoch": "1725471151.432523", "packets": 2, "bytes": 501, "initiator_bytes": 265, "responder_bytes": 236 }, { "flow_id": "flow-0028d4c63e6e5c2744f085ed", "transport": "udp", "stream": 10, "initiator_ip": "172.17.0.99", "initiator_port": 62363, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 39, "last_frame": 41, "first_seen_epoch": "1725471151.819433", "last_seen_epoch": "1725471151.819563", "packets": 2, "bytes": 235, "initiator_bytes": 79, "responder_bytes": 156 }, { "flow_id": "flow-57f238d919593b8bb28d4615", "transport": "udp", "stream": 11, "initiator_ip": "172.17.0.99", "initiator_port": 61360, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 40, "last_frame": 48, "first_seen_epoch": "1725471151.819433", "last_seen_epoch": "1725471151.893848", "packets": 4, "bytes": 545, "initiator_bytes": 162, "responder_bytes": 383 }, { "flow_id": "flow-e0534fad4f641f29e4658068", "transport": "tcp", "stream": 1, "initiator_ip": "172.17.0.99", "initiator_port": 49766, "responder_ip": "23.220.251.149", "responder_port": 80, "first_frame": 49, "last_frame": 58, "first_seen_epoch": "1725471151.894502", "last_seen_epoch": "1725471152.03503", "packets": 10, "bytes": 941, "initiator_bytes": 454, "responder_bytes": 487 }, { "flow_id": "flow-e4331f833a25a81ae23c4d5f", "transport": "udp", "stream": 12, "initiator_ip": "172.17.0.99", "initiator_port": 64451, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 67, "last_frame": 4420, "first_seen_epoch": "1725471152.993509", "last_seen_epoch": "1725473271.491784", "packets": 16, "bytes": 1821, "initiator_bytes": 630, "responder_bytes": 1191 }, { "flow_id": "flow-c404ec7355aabefd2f846b16", "transport": "tcp", "stream": 2, "initiator_ip": "172.17.0.99", "initiator_port": 49767, "responder_ip": "23.220.251.158", "responder_port": 80, "first_frame": 69, "last_frame": 79, "first_seen_epoch": "1725471152.99448", "last_seen_epoch": "1725471153.125097", "packets": 10, "bytes": 898, "initiator_bytes": 411, "responder_bytes": 487 }, { "flow_id": "flow-1b78631ddb1a677063ce8005", "transport": "udp", "stream": 13, "initiator_ip": "172.17.0.99", "initiator_port": 64452, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 87, "last_frame": 90, "first_seen_epoch": "1725471154.621671", "last_seen_epoch": "1725471154.622312", "packets": 4, "bytes": 1001, "initiator_bytes": 529, "responder_bytes": 472 }, { "flow_id": "flow-4f33ca3e69882e3f29649723", "transport": "udp", "stream": 14, "initiator_ip": "172.17.0.99", "initiator_port": 138, "responder_ip": "172.17.0.255", "responder_port": 138, "first_frame": 97, "last_frame": 4908, "first_seen_epoch": "1725471157.536757", "last_seen_epoch": "1725474279.648734", "packets": 18, "bytes": 4194, "initiator_bytes": 4194, "responder_bytes": 0 }, { "flow_id": "flow-9aaa0c47224e0fa3548a3a89", "transport": "udp", "stream": 15, "initiator_ip": "172.17.0.99", "initiator_port": 123, "responder_ip": "172.17.0.17", "responder_port": 123, "first_frame": 107, "last_frame": 4885, "first_seen_epoch": "1725471159.797886", "last_seen_epoch": "1725474231.811658", "packets": 8, "bytes": 1296, "initiator_bytes": 648, "responder_bytes": 648 }, { "flow_id": "flow-19299cde4a8912b046d70bca", "transport": "udp", "stream": 16, "initiator_ip": "172.17.0.99", "initiator_port": 57960, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 110, "last_frame": 805, "first_seen_epoch": "1725471169.837323", "last_seen_epoch": "1725471277.19832", "packets": 18, "bytes": 2482, "initiator_bytes": 704, "responder_bytes": 1778 }, { "flow_id": "flow-6bf928c61625288d406e2384", "transport": "tcp", "stream": 3, "initiator_ip": "172.17.0.99", "initiator_port": 49768, "responder_ip": "172.17.0.17", "responder_port": 445, "first_frame": 113, "last_frame": 158, "first_seen_epoch": "1725471178.212467", "last_seen_epoch": "1725471193.409844", "packets": 22, "bytes": 7130, "initiator_bytes": 5278, "responder_bytes": 1852 }, { "flow_id": "flow-8824832610cb3c4643a7e5b3", "transport": "udp", "stream": 17, "initiator_ip": "172.17.0.17", "initiator_port": 137, "responder_ip": "172.17.0.99", "responder_port": 137, "first_frame": 132, "last_frame": 132, "first_seen_epoch": "1725471188.167544", "last_seen_epoch": "1725471188.167544", "packets": 1, "bytes": 104, "initiator_bytes": 104, "responder_bytes": 0 }, { "flow_id": "flow-90d41e1303a68f076d21ba0a", "transport": "tcp", "stream": 4, "initiator_ip": "172.17.0.99", "initiator_port": 49769, "responder_ip": "172.17.0.17", "responder_port": 139, "first_frame": 133, "last_frame": 165, "first_seen_epoch": "1725471188.167849", "last_seen_epoch": "1725471198.76291", "packets": 24, "bytes": 3562, "initiator_bytes": 1749, "responder_bytes": 1813 }, { "flow_id": "flow-028b6694d9110ead09da1696", "transport": "tcp", "stream": 5, "initiator_ip": "172.17.0.99", "initiator_port": 49770, "responder_ip": "172.17.0.17", "responder_port": 139, "first_frame": 166, "last_frame": 223, "first_seen_epoch": "1725471218.194446", "last_seen_epoch": "1725471230.944399", "packets": 24, "bytes": 3568, "initiator_bytes": 1755, "responder_bytes": 1813 }, { "flow_id": "flow-addc38ef01af8494215ed68f", "transport": "tcp", "stream": 6, "initiator_ip": "172.17.0.99", "initiator_port": 49771, "responder_ip": "20.10.31.115", "responder_port": 443, "first_frame": 185, "last_frame": 4999, "first_seen_epoch": "1725471222.922365", "last_seen_epoch": "1725474602.839069", "packets": 59, "bytes": 11525, "initiator_bytes": 4536, "responder_bytes": 6989 }, { "flow_id": "flow-91c27bc83aa2a9b3fe4d9e8a", "transport": "tcp", "stream": 7, "initiator_ip": "172.17.0.99", "initiator_port": 49772, "responder_ip": "172.17.0.17", "responder_port": 139, "first_frame": 224, "last_frame": 289, "first_seen_epoch": "1725471248.253521", "last_seen_epoch": "1725471263.141565", "packets": 24, "bytes": 3562, "initiator_bytes": 1749, "responder_bytes": 1813 }, { "flow_id": "flow-7f5069c16a9311c69c793389", "transport": "tcp", "stream": 8, "initiator_ip": "172.17.0.99", "initiator_port": 49773, "responder_ip": "20.42.73.28", "responder_port": 443, "first_frame": 245, "last_frame": 280, "first_seen_epoch": "1725471255.699611", "last_seen_epoch": "1725471256.448135", "packets": 36, "bytes": 15792, "initiator_bytes": 10096, "responder_bytes": 5696 }, { "flow_id": "flow-6ec7c4f76102c26487e2ecc6", "transport": "tcp", "stream": 9, "initiator_ip": "172.17.0.99", "initiator_port": 49774, "responder_ip": "172.17.0.17", "responder_port": 88, "first_frame": 290, "last_frame": 297, "first_seen_epoch": "1725471275.303013", "last_seen_epoch": "1725471275.304524", "packets": 8, "bytes": 900, "initiator_bytes": 469, "responder_bytes": 431 }, { "flow_id": "flow-ef01ab4f8ae73c9637a7ebd4", "transport": "tcp", "stream": 10, "initiator_ip": "172.17.0.99", "initiator_port": 49775, "responder_ip": "172.17.0.17", "responder_port": 88, "first_frame": 298, "last_frame": 307, "first_seen_epoch": "1725471275.309245", "last_seen_epoch": "1725471275.31177", "packets": 10, "bytes": 2627, "initiator_bytes": 609, "responder_bytes": 2018 }, { "flow_id": "flow-6aae6c1d6ea0695dd3c47ec4", "transport": "tcp", "stream": 11, "initiator_ip": "172.17.0.99", "initiator_port": 49776, "responder_ip": "172.17.0.17", "responder_port": 88, "first_frame": 308, "last_frame": 321, "first_seen_epoch": "1725471275.312207", "last_seen_epoch": "1725471275.315786", "packets": 12, "bytes": 4006, "initiator_bytes": 1991, "responder_bytes": 2015 }, { "flow_id": "flow-a89cfe4a6ef7b02395c72b74", "transport": "udp", "stream": 18, "initiator_ip": "172.17.0.99", "initiator_port": 57961, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 314, "last_frame": 315, "first_seen_epoch": "1725471275.314316", "last_seen_epoch": "1725471275.314748", "packets": 2, "bytes": 501, "initiator_bytes": 265, "responder_bytes": 236 }, { "flow_id": "flow-7813cf0756f76c5615553862", "transport": "tcp", "stream": 12, "initiator_ip": "172.17.0.99", "initiator_port": 49777, "responder_ip": "172.17.0.17", "responder_port": 135, "first_frame": 322, "last_frame": 1243, "first_seen_epoch": "1725471275.476937", "last_seen_epoch": "1725471290.286396", "packets": 12, "bytes": 1412, "initiator_bytes": 742, "responder_bytes": 670 }, { "flow_id": "flow-44b24a8e5ec57dc8b357f345", "transport": "tcp", "stream": 13, "initiator_ip": "172.17.0.99", "initiator_port": 49778, "responder_ip": "172.17.0.17", "responder_port": 445, "first_frame": 329, "last_frame": 1236, "first_seen_epoch": "1725471275.478381", "last_seen_epoch": "1725471289.962891", "packets": 62, "bytes": 16831, "initiator_bytes": 9857, "responder_bytes": 6974 }, { "flow_id": "flow-871660595eb80b3456025e9e", "transport": "tcp", "stream": 14, "initiator_ip": "172.17.0.99", "initiator_port": 49779, "responder_ip": "172.17.0.17", "responder_port": 49668, "first_frame": 333, "last_frame": 1819, "first_seen_epoch": "1725471275.478728", "last_seen_epoch": "1725471310.283889", "packets": 22, "bytes": 6020, "initiator_bytes": 4005, "responder_bytes": 2015 }, { "flow_id": "flow-97d8eb0c662bbab2cccc6d7c", "transport": "tcp", "stream": 15, "initiator_ip": "172.17.0.99", "initiator_port": 49780, "responder_ip": "172.17.0.17", "responder_port": 88, "first_frame": 337, "last_frame": 364, "first_seen_epoch": "1725471275.48027", "last_seen_epoch": "1725471275.484826", "packets": 12, "bytes": 4269, "initiator_bytes": 2148, "responder_bytes": 2121 }, { "flow_id": "flow-d705ffc75146f100d864d5ba", "transport": "tcp", "stream": 16, "initiator_ip": "172.17.0.99", "initiator_port": 49781, "responder_ip": "172.17.0.17", "responder_port": 88, "first_frame": 339, "last_frame": 356, "first_seen_epoch": "1725471275.480452", "last_seen_epoch": "1725471275.484265", "packets": 12, "bytes": 4301, "initiator_bytes": 2164, "responder_bytes": 2137 }, { "flow_id": "flow-4aaccd317d9600e96e3e2fe5", "transport": "tcp", "stream": 17, "initiator_ip": "172.17.0.99", "initiator_port": 49782, "responder_ip": "172.17.0.17", "responder_port": 88, "first_frame": 361, "last_frame": 377, "first_seen_epoch": "1725471275.484631", "last_seen_epoch": "1725471275.486836", "packets": 12, "bytes": 3911, "initiator_bytes": 1941, "responder_bytes": 1970 }, { "flow_id": "flow-b24c9a4b061a02fb4088a666", "transport": "tcp", "stream": 18, "initiator_ip": "172.17.0.99", "initiator_port": 49783, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 404, "last_frame": 467, "first_seen_epoch": "1725471275.491393", "last_seen_epoch": "1725471275.512392", "packets": 15, "bytes": 4458, "initiator_bytes": 3312, "responder_bytes": 1146 }, { "flow_id": "flow-838f747c6a84794a7c0aa3cb", "transport": "tcp", "stream": 19, "initiator_ip": "172.17.0.99", "initiator_port": 49784, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 435, "last_frame": 463, "first_seen_epoch": "1725471275.499782", "last_seen_epoch": "1725471275.510003", "packets": 15, "bytes": 3823, "initiator_bytes": 2899, "responder_bytes": 924 }, { "flow_id": "flow-2c9dd5a226c08449e0d8b429", "transport": "tcp", "stream": 20, "initiator_ip": "172.17.0.99", "initiator_port": 49785, "responder_ip": "172.17.0.17", "responder_port": 445, "first_frame": 471, "last_frame": 5087, "first_seen_epoch": "1725471275.573153", "last_seen_epoch": "1725474720.709482", "packets": 156, "bytes": 22539, "initiator_bytes": 12573, "responder_bytes": 9966 }, { "flow_id": "flow-78dae8e22e4c7f3b0eb9928d", "transport": "tcp", "stream": 21, "initiator_ip": "172.17.0.99", "initiator_port": 49786, "responder_ip": "172.17.0.17", "responder_port": 88, "first_frame": 476, "last_frame": 487, "first_seen_epoch": "1725471275.574322", "last_seen_epoch": "1725471275.576251", "packets": 12, "bytes": 4224, "initiator_bytes": 2133, "responder_bytes": 2091 }, { "flow_id": "flow-2123da0873881692569e8d21", "transport": "tcp", "stream": 22, "initiator_ip": "172.17.0.99", "initiator_port": 49787, "responder_ip": "23.221.24.58", "responder_port": 443, "first_frame": 500, "last_frame": 2358, "first_seen_epoch": "1725471275.894579", "last_seen_epoch": "1725471385.860158", "packets": 36, "bytes": 8621, "initiator_bytes": 2063, "responder_bytes": 6558 }, { "flow_id": "flow-560c55b554b7652ff0027965", "transport": "tcp", "stream": 23, "initiator_ip": "172.17.0.99", "initiator_port": 49788, "responder_ip": "23.45.119.144", "responder_port": 443, "first_frame": 532, "last_frame": 2333, "first_seen_epoch": "1725471276.100652", "last_seen_epoch": "1725471336.367169", "packets": 24, "bytes": 9179, "initiator_bytes": 1205, "responder_bytes": 7974 }, { "flow_id": "flow-cbb6360fe016ac64d036a7df", "transport": "tcp", "stream": 24, "initiator_ip": "172.17.0.99", "initiator_port": 49789, "responder_ip": "23.45.119.144", "responder_port": 443, "first_frame": 533, "last_frame": 2334, "first_seen_epoch": "1725471276.100652", "last_seen_epoch": "1725471336.367169", "packets": 24, "bytes": 9178, "initiator_bytes": 1205, "responder_bytes": 7973 }, { "flow_id": "flow-9b315bf8ba0fbbfd9b74a5b4", "transport": "tcp", "stream": 25, "initiator_ip": "172.17.0.99", "initiator_port": 49790, "responder_ip": "20.96.153.111", "responder_port": 443, "first_frame": 576, "last_frame": 2360, "first_seen_epoch": "1725471276.337901", "last_seen_epoch": "1725471385.910247", "packets": 32, "bytes": 10428, "initiator_bytes": 3012, "responder_bytes": 7416 }, { "flow_id": "flow-9b12d3ba04b85f7c3f325dde", "transport": "tcp", "stream": 26, "initiator_ip": "172.17.0.99", "initiator_port": 49791, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 603, "last_frame": 2369, "first_seen_epoch": "1725471276.697176", "last_seen_epoch": "1725471386.692124", "packets": 52, "bytes": 19999, "initiator_bytes": 2722, "responder_bytes": 17277 }, { "flow_id": "flow-a28e67019ca5d78a8f51ce39", "transport": "tcp", "stream": 27, "initiator_ip": "172.17.0.99", "initiator_port": 49792, "responder_ip": "23.221.24.58", "responder_port": 443, "first_frame": 620, "last_frame": 2393, "first_seen_epoch": "1725471276.821898", "last_seen_epoch": "1725471397.360461", "packets": 156, "bytes": 93715, "initiator_bytes": 9635, "responder_bytes": 84080 }, { "flow_id": "flow-d4f85880ddd4b0f2cb1bff18", "transport": "tcp", "stream": 28, "initiator_ip": "172.17.0.99", "initiator_port": 49793, "responder_ip": "23.45.119.144", "responder_port": 443, "first_frame": 804, "last_frame": 2366, "first_seen_epoch": "1725471277.197063", "last_seen_epoch": "1725471386.665455", "packets": 128, "bytes": 79806, "initiator_bytes": 5305, "responder_bytes": 74501 }, { "flow_id": "flow-230e4d902bb0be6d0ccebb43", "transport": "tcp", "stream": 29, "initiator_ip": "172.17.0.99", "initiator_port": 49794, "responder_ip": "52.109.0.91", "responder_port": 443, "first_frame": 806, "last_frame": 2976, "first_seen_epoch": "1725471277.199017", "last_seen_epoch": "1725471409.954481", "packets": 37, "bytes": 10557, "initiator_bytes": 2027, "responder_bytes": 8530 }, { "flow_id": "flow-9c5d098d930ec8482a7a6683", "transport": "udp", "stream": 19, "initiator_ip": "172.17.0.99", "initiator_port": 51916, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 885, "last_frame": 886, "first_seen_epoch": "1725471277.731425", "last_seen_epoch": "1725471277.873237", "packets": 2, "bytes": 336, "initiator_bytes": 83, "responder_bytes": 253 }, { "flow_id": "flow-8143571dde0a44e910e9cb39", "transport": "tcp", "stream": 30, "initiator_ip": "172.17.0.99", "initiator_port": 49795, "responder_ip": "52.109.0.142", "responder_port": 443, "first_frame": 887, "last_frame": 2965, "first_seen_epoch": "1725471277.873835", "last_seen_epoch": "1725471402.355701", "packets": 29, "bytes": 9341, "initiator_bytes": 1629, "responder_bytes": 7712 }, { "flow_id": "flow-a058ab2cf86ed05dad4c84d0", "transport": "tcp", "stream": 31, "initiator_ip": "172.17.0.99", "initiator_port": 49796, "responder_ip": "172.17.0.17", "responder_port": 139, "first_frame": 933, "last_frame": 1239, "first_seen_epoch": "1725471278.295945", "last_seen_epoch": "1725471289.963415", "packets": 24, "bytes": 3562, "initiator_bytes": 1749, "responder_bytes": 1813 }, { "flow_id": "flow-699ea299e1f953bfc84440d9", "transport": "udp", "stream": 20, "initiator_ip": "172.17.0.99", "initiator_port": 56608, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 1051, "last_frame": 1052, "first_seen_epoch": "1725471279.97389", "last_seen_epoch": "1725471279.977517", "packets": 2, "bytes": 224, "initiator_bytes": 70, "responder_bytes": 154 }, { "flow_id": "flow-5040ea9b260a7dbec088e593", "transport": "tcp", "stream": 32, "initiator_ip": "172.17.0.99", "initiator_port": 49797, "responder_ip": "20.241.44.114", "responder_port": 443, "first_frame": 1053, "last_frame": 2242, "first_seen_epoch": "1725471279.979068", "last_seen_epoch": "1725471314.331476", "packets": 21, "bytes": 8637, "initiator_bytes": 1439, "responder_bytes": 7198 }, { "flow_id": "flow-a22379b0525a592742a36437", "transport": "tcp", "stream": 33, "initiator_ip": "172.17.0.99", "initiator_port": 49798, "responder_ip": "172.17.0.17", "responder_port": 135, "first_frame": 1057, "last_frame": 1224, "first_seen_epoch": "1725471280.058656", "last_seen_epoch": "1725471280.839222", "packets": 11, "bytes": 1776, "initiator_bytes": 904, "responder_bytes": 872 }, { "flow_id": "flow-9e3ed0b4df7068352ec35282", "transport": "tcp", "stream": 34, "initiator_ip": "172.17.0.99", "initiator_port": 49799, "responder_ip": "172.17.0.17", "responder_port": 49668, "first_frame": 1064, "last_frame": 1225, "first_seen_epoch": "1725471280.060858", "last_seen_epoch": "1725471280.839222", "packets": 23, "bytes": 6792, "initiator_bytes": 4397, "responder_bytes": 2395 }, { "flow_id": "flow-14b6def19a2e376d8bb023d9", "transport": "tcp", "stream": 35, "initiator_ip": "172.17.0.99", "initiator_port": 49800, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 1087, "last_frame": 1125, "first_seen_epoch": "1725471280.070541", "last_seen_epoch": "1725471280.080775", "packets": 21, "bytes": 7777, "initiator_bytes": 3638, "responder_bytes": 4139 }, { "flow_id": "flow-53fddea49f90c758d44f1fa1", "transport": "tcp", "stream": 36, "initiator_ip": "172.17.0.99", "initiator_port": 49801, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 1104, "last_frame": 1122, "first_seen_epoch": "1725471280.077303", "last_seen_epoch": "1725471280.080647", "packets": 18, "bytes": 7131, "initiator_bytes": 3008, "responder_bytes": 4123 }, { "flow_id": "flow-a80efda1cd79c5057282642a", "transport": "udp", "stream": 21, "initiator_ip": "172.17.0.99", "initiator_port": 51962, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 1126, "last_frame": 1245, "first_seen_epoch": "1725471280.106056", "last_seen_epoch": "1725471296.712511", "packets": 8, "bytes": 1315, "initiator_bytes": 334, "responder_bytes": 981 }, { "flow_id": "flow-6d93c0776e892306d90d7995", "transport": "tcp", "stream": 37, "initiator_ip": "172.17.0.99", "initiator_port": 49802, "responder_ip": "40.126.28.12", "responder_port": 443, "first_frame": 1141, "last_frame": 1226, "first_seen_epoch": "1725471280.153204", "last_seen_epoch": "1725471280.839505", "packets": 28, "bytes": 8377, "initiator_bytes": 2286, "responder_bytes": 6091 }, { "flow_id": "flow-f857c10aa1098b27103dbc72", "transport": "tcp", "stream": 38, "initiator_ip": "172.17.0.99", "initiator_port": 49803, "responder_ip": "23.40.145.142", "responder_port": 443, "first_frame": 1155, "last_frame": 2382, "first_seen_epoch": "1725471280.344296", "last_seen_epoch": "1725471389.930264", "packets": 28, "bytes": 11518, "initiator_bytes": 1686, "responder_bytes": 9832 }, { "flow_id": "flow-4f73edb824e9dcdc0535c8f1", "transport": "tcp", "stream": 39, "initiator_ip": "172.17.0.99", "initiator_port": 49804, "responder_ip": "23.195.212.189", "responder_port": 443, "first_frame": 1200, "last_frame": 1227, "first_seen_epoch": "1725471280.594513", "last_seen_epoch": "1725471280.840018", "packets": 25, "bytes": 12469, "initiator_bytes": 1561, "responder_bytes": 10908 }, { "flow_id": "flow-a08827f089b5ca96cb202e48", "transport": "tcp", "stream": 40, "initiator_ip": "172.17.0.99", "initiator_port": 49805, "responder_ip": "13.107.246.57", "responder_port": 443, "first_frame": 1246, "last_frame": 2377, "first_seen_epoch": "1725471296.71628", "last_seen_epoch": "1725471386.941229", "packets": 36, "bytes": 8883, "initiator_bytes": 2149, "responder_bytes": 6734 }, { "flow_id": "flow-17d9d124375190e759c5b948", "transport": "tcp", "stream": 41, "initiator_ip": "172.17.0.99", "initiator_port": 49806, "responder_ip": "46.254.34.201", "responder_port": 443, "first_frame": 1276, "last_frame": 2968, "first_seen_epoch": "1725471304.635538", "last_seen_epoch": "1725471406.583228", "packets": 260, "bytes": 228410, "initiator_bytes": 6998, "responder_bytes": 221412 }, { "flow_id": "flow-a7a7727dac9b6f88be277725", "transport": "tcp", "stream": 42, "initiator_ip": "172.17.0.99", "initiator_port": 49807, "responder_ip": "172.17.0.17", "responder_port": 135, "first_frame": 1424, "last_frame": 1660, "first_seen_epoch": "1725471306.284007", "last_seen_epoch": "1725471307.130969", "packets": 11, "bytes": 1776, "initiator_bytes": 904, "responder_bytes": 872 }, { "flow_id": "flow-32f9b04d55e522764a9362f4", "transport": "tcp", "stream": 43, "initiator_ip": "172.17.0.99", "initiator_port": 49808, "responder_ip": "172.17.0.17", "responder_port": 49668, "first_frame": 1431, "last_frame": 1661, "first_seen_epoch": "1725471306.286435", "last_seen_epoch": "1725471307.130969", "packets": 23, "bytes": 6792, "initiator_bytes": 4397, "responder_bytes": 2395 }, { "flow_id": "flow-2a295735df87eb8741ba8692", "transport": "tcp", "stream": 44, "initiator_ip": "172.17.0.99", "initiator_port": 49809, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 1454, "last_frame": 1493, "first_seen_epoch": "1725471306.297278", "last_seen_epoch": "1725471306.309837", "packets": 21, "bytes": 7777, "initiator_bytes": 3638, "responder_bytes": 4139 }, { "flow_id": "flow-294d14cb7afea5d0f5caf357", "transport": "tcp", "stream": 45, "initiator_ip": "172.17.0.99", "initiator_port": 49810, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 1472, "last_frame": 1491, "first_seen_epoch": "1725471306.304581", "last_seen_epoch": "1725471306.309717", "packets": 18, "bytes": 7131, "initiator_bytes": 3008, "responder_bytes": 4123 }, { "flow_id": "flow-8453fb8389f0ae96fe2dafb1", "transport": "tcp", "stream": 46, "initiator_ip": "172.17.0.99", "initiator_port": 49811, "responder_ip": "40.126.28.12", "responder_port": 443, "first_frame": 1494, "last_frame": 1662, "first_seen_epoch": "1725471306.329934", "last_seen_epoch": "1725471307.130969", "packets": 27, "bytes": 8317, "initiator_bytes": 2226, "responder_bytes": 6091 }, { "flow_id": "flow-d9f3443307c0ad79016c98a9", "transport": "udp", "stream": 22, "initiator_ip": "172.17.0.99", "initiator_port": 59001, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 1629, "last_frame": 3038, "first_seen_epoch": "1725471306.710868", "last_seen_epoch": "1725471471.488905", "packets": 14, "bytes": 1944, "initiator_bytes": 677, "responder_bytes": 1267 }, { "flow_id": "flow-b8e06c914ab29689e4dea57e", "transport": "tcp", "stream": 47, "initiator_ip": "172.17.0.99", "initiator_port": 49812, "responder_ip": "23.195.212.189", "responder_port": 443, "first_frame": 1631, "last_frame": 1663, "first_seen_epoch": "1725471306.752627", "last_seen_epoch": "1725471307.130969", "packets": 27, "bytes": 12590, "initiator_bytes": 1621, "responder_bytes": 10969 }, { "flow_id": "flow-c248273a29cb3bac12081352", "transport": "tcp", "stream": 48, "initiator_ip": "172.17.0.99", "initiator_port": 49813, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 1632, "last_frame": 2343, "first_seen_epoch": "1725471306.753489", "last_seen_epoch": "1725471377.56573", "packets": 20, "bytes": 2968, "initiator_bytes": 1882, "responder_bytes": 1086 }, { "flow_id": "flow-309f2db5c0ecbfcff538e039", "transport": "tcp", "stream": 49, "initiator_ip": "172.17.0.99", "initiator_port": 49814, "responder_ip": "172.17.0.17", "responder_port": 139, "first_frame": 1676, "last_frame": 2249, "first_seen_epoch": "1725471308.331422", "last_seen_epoch": "1725471322.159747", "packets": 24, "bytes": 3562, "initiator_bytes": 1749, "responder_bytes": 1813 }, { "flow_id": "flow-1875063290ffac70cfdf5a4e", "transport": "tcp", "stream": 50, "initiator_ip": "172.17.0.99", "initiator_port": 49815, "responder_ip": "46.254.34.201", "responder_port": 443, "first_frame": 1699, "last_frame": 2241, "first_seen_epoch": "1725471309.265242", "last_seen_epoch": "1725471313.32014", "packets": 522, "bytes": 491261, "initiator_bytes": 11380, "responder_bytes": 479881 }, { "flow_id": "flow-4c2eaff5fd046b64c4bdabe9", "transport": "tcp", "stream": 51, "initiator_ip": "172.17.0.99", "initiator_port": 49816, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 2223, "last_frame": 2240, "first_seen_epoch": "1725471310.933124", "last_seen_epoch": "1725471313.32014", "packets": 15, "bytes": 1551, "initiator_bytes": 734, "responder_bytes": 817 }, { "flow_id": "flow-8b21dd10cc35bb5d85fb9dd4", "transport": "udp", "stream": 23, "initiator_ip": "172.17.0.99", "initiator_port": 59002, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 2252, "last_frame": 2253, "first_seen_epoch": "1725471336.132393", "last_seen_epoch": "1725471336.132696", "packets": 2, "bytes": 501, "initiator_bytes": 265, "responder_bytes": 236 }, { "flow_id": "flow-38cfd42f2273f7a47ecaf770", "transport": "tcp", "stream": 52, "initiator_ip": "172.17.0.99", "initiator_port": 49817, "responder_ip": "172.17.0.17", "responder_port": 135, "first_frame": 2254, "last_frame": 2323, "first_seen_epoch": "1725471336.263856", "last_seen_epoch": "1725471336.316414", "packets": 10, "bytes": 1716, "initiator_bytes": 844, "responder_bytes": 872 }, { "flow_id": "flow-e1f6c1b73d65f2aebb7170ed", "transport": "tcp", "stream": 53, "initiator_ip": "172.17.0.99", "initiator_port": 49818, "responder_ip": "172.17.0.17", "responder_port": 49668, "first_frame": 2261, "last_frame": 2324, "first_seen_epoch": "1725471336.271409", "last_seen_epoch": "1725471336.316433", "packets": 22, "bytes": 6770, "initiator_bytes": 4375, "responder_bytes": 2395 }, { "flow_id": "flow-aaf749dab55cf6f0edeb8b4e", "transport": "tcp", "stream": 54, "initiator_ip": "172.17.0.99", "initiator_port": 49819, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 2284, "last_frame": 2322, "first_seen_epoch": "1725471336.293976", "last_seen_epoch": "1725471336.312396", "packets": 21, "bytes": 7815, "initiator_bytes": 3676, "responder_bytes": 4139 }, { "flow_id": "flow-1e8d2413bf8b03ed1a0e1284", "transport": "tcp", "stream": 55, "initiator_ip": "172.17.0.99", "initiator_port": 49820, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 2301, "last_frame": 2321, "first_seen_epoch": "1725471336.306205", "last_seen_epoch": "1725471336.312336", "packets": 18, "bytes": 7169, "initiator_bytes": 3046, "responder_bytes": 4123 }, { "flow_id": "flow-1c2b5dfca4881b773467ce33", "transport": "tcp", "stream": 56, "initiator_ip": "172.17.0.99", "initiator_port": 49821, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 2342, "last_frame": 2982, "first_seen_epoch": "1725471377.348644", "last_seen_epoch": "1725471446.689596", "packets": 12, "bytes": 1271, "initiator_bytes": 749, "responder_bytes": 522 }, { "flow_id": "flow-3a28bf4dd43d18e4655d4669", "transport": "udp", "stream": 24, "initiator_ip": "172.17.0.99", "initiator_port": 55220, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 2385, "last_frame": 2387, "first_seen_epoch": "1725471397.316273", "last_seen_epoch": "1725471397.316356", "packets": 2, "bytes": 225, "initiator_bytes": 75, "responder_bytes": 150 }, { "flow_id": "flow-d986a313a758545f753ebb6f", "transport": "udp", "stream": 25, "initiator_ip": "172.17.0.99", "initiator_port": 65466, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 2386, "last_frame": 2394, "first_seen_epoch": "1725471397.316273", "last_seen_epoch": "1725471397.361032", "packets": 2, "bytes": 209, "initiator_bytes": 75, "responder_bytes": 134 }, { "flow_id": "flow-93e4304a8b80183e41ac2704", "transport": "tcp", "stream": 57, "initiator_ip": "172.17.0.99", "initiator_port": 49822, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 2388, "last_frame": 2954, "first_seen_epoch": "1725471397.32639", "last_seen_epoch": "1725471400.845368", "packets": 25, "bytes": 10604, "initiator_bytes": 3080, "responder_bytes": 7524 }, { "flow_id": "flow-d5a2b0c6480d178ff5404f9f", "transport": "tcp", "stream": 58, "initiator_ip": "172.17.0.99", "initiator_port": 49823, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 2389, "last_frame": 2953, "first_seen_epoch": "1725471397.326979", "last_seen_epoch": "1725471400.845177", "packets": 25, "bytes": 10668, "initiator_bytes": 3144, "responder_bytes": 7524 }, { "flow_id": "flow-3d621232ceb3595e72e90520", "transport": "udp", "stream": 26, "initiator_ip": "172.17.0.99", "initiator_port": 58644, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 2437, "last_frame": 2439, "first_seen_epoch": "1725471397.772742", "last_seen_epoch": "1725471397.773492", "packets": 2, "bytes": 217, "initiator_bytes": 71, "responder_bytes": 146 }, { "flow_id": "flow-029b0cc994be9d69a29deb1d", "transport": "udp", "stream": 27, "initiator_ip": "172.17.0.99", "initiator_port": 54446, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 2438, "last_frame": 2440, "first_seen_epoch": "1725471397.772803", "last_seen_epoch": "1725471397.773492", "packets": 2, "bytes": 258, "initiator_bytes": 71, "responder_bytes": 187 }, { "flow_id": "flow-efadc6af2bc6db398120cf73", "transport": "tcp", "stream": 59, "initiator_ip": "172.17.0.99", "initiator_port": 49824, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 2441, "last_frame": 2962, "first_seen_epoch": "1725471397.773492", "last_seen_epoch": "1725471400.857473", "packets": 58, "bytes": 25967, "initiator_bytes": 5328, "responder_bytes": 20639 }, { "flow_id": "flow-b8ee114cefbf488ed2a5c5e9", "transport": "udp", "stream": 28, "initiator_ip": "172.17.0.99", "initiator_port": 62998, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 2485, "last_frame": 2490, "first_seen_epoch": "1725471398.149174", "last_seen_epoch": "1725471398.20546", "packets": 2, "bytes": 217, "initiator_bytes": 71, "responder_bytes": 146 }, { "flow_id": "flow-e6eee4b4d25b55d296aee100", "transport": "udp", "stream": 29, "initiator_ip": "172.17.0.99", "initiator_port": 63046, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 2486, "last_frame": 2491, "first_seen_epoch": "1725471398.149174", "last_seen_epoch": "1725471398.2055", "packets": 2, "bytes": 258, "initiator_bytes": 71, "responder_bytes": 187 }, { "flow_id": "flow-268601f7f2e4b92e80d93baf", "transport": "udp", "stream": 30, "initiator_ip": "172.17.0.99", "initiator_port": 58531, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 2487, "last_frame": 2489, "first_seen_epoch": "1725471398.149224", "last_seen_epoch": "1725471398.20546", "packets": 2, "bytes": 270, "initiator_bytes": 74, "responder_bytes": 196 }, { "flow_id": "flow-e9df4340ab335d07d519287f", "transport": "udp", "stream": 31, "initiator_ip": "172.17.0.99", "initiator_port": 61084, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 2488, "last_frame": 2495, "first_seen_epoch": "1725471398.149224", "last_seen_epoch": "1725471398.250673", "packets": 2, "bytes": 222, "initiator_bytes": 74, "responder_bytes": 148 }, { "flow_id": "flow-b1a31da14f688abd151f903d", "transport": "tcp", "stream": 60, "initiator_ip": "172.17.0.99", "initiator_port": 49825, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 2492, "last_frame": 2961, "first_seen_epoch": "1725471398.206299", "last_seen_epoch": "1725471400.857465", "packets": 39, "bytes": 14416, "initiator_bytes": 4161, "responder_bytes": 10255 }, { "flow_id": "flow-122ab6afc5b61115043d18fe", "transport": "udp", "stream": 32, "initiator_ip": "172.17.0.99", "initiator_port": 54541, "responder_ip": "23.45.119.144", "responder_port": 443, "first_frame": 2493, "last_frame": 2936, "first_seen_epoch": "1725471398.231353", "last_seen_epoch": "1725471399.754103", "packets": 93, "bytes": 47749, "initiator_bytes": 6925, "responder_bytes": 40824 }, { "flow_id": "flow-b082b87336ef88b1d4d318fb", "transport": "udp", "stream": 33, "initiator_ip": "172.17.0.99", "initiator_port": 49994, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 2535, "last_frame": 2537, "first_seen_epoch": "1725471398.400443", "last_seen_epoch": "1725471398.401014", "packets": 2, "bytes": 237, "initiator_bytes": 72, "responder_bytes": 165 }, { "flow_id": "flow-0add7e23436e523d3521f6d2", "transport": "udp", "stream": 34, "initiator_ip": "172.17.0.99", "initiator_port": 62207, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 2536, "last_frame": 2538, "first_seen_epoch": "1725471398.400443", "last_seen_epoch": "1725471398.401014", "packets": 2, "bytes": 278, "initiator_bytes": 72, "responder_bytes": 206 }, { "flow_id": "flow-374721f79a08ac6507fd096b", "transport": "tcp", "stream": 61, "initiator_ip": "172.17.0.99", "initiator_port": 49826, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 2539, "last_frame": 2956, "first_seen_epoch": "1725471398.401378", "last_seen_epoch": "1725471400.846082", "packets": 25, "bytes": 10662, "initiator_bytes": 3138, "responder_bytes": 7524 }, { "flow_id": "flow-500445934491b33002fe236b", "transport": "udp", "stream": 35, "initiator_ip": "172.17.0.99", "initiator_port": 55398, "responder_ip": "23.45.119.144", "responder_port": 443, "first_frame": 2556, "last_frame": 2624, "first_seen_epoch": "1725471398.483811", "last_seen_epoch": "1725471398.617445", "packets": 23, "bytes": 11629, "initiator_bytes": 3899, "responder_bytes": 7730 }, { "flow_id": "flow-0e9a2efdac8438e9367d31d2", "transport": "udp", "stream": 36, "initiator_ip": "172.17.0.99", "initiator_port": 56598, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 2563, "last_frame": 2579, "first_seen_epoch": "1725471398.493602", "last_seen_epoch": "1725471398.543132", "packets": 2, "bytes": 403, "initiator_bytes": 71, "responder_bytes": 332 }, { "flow_id": "flow-890d2fc40ef560eedad4481d", "transport": "udp", "stream": 37, "initiator_ip": "172.17.0.99", "initiator_port": 52408, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 2564, "last_frame": 2595, "first_seen_epoch": "1725471398.493679", "last_seen_epoch": "1725471398.581566", "packets": 2, "bytes": 259, "initiator_bytes": 71, "responder_bytes": 188 }, { "flow_id": "flow-b430d4062120303f5e38cde8", "transport": "udp", "stream": 38, "initiator_ip": "172.17.0.99", "initiator_port": 50109, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 2586, "last_frame": 2622, "first_seen_epoch": "1725471398.54906", "last_seen_epoch": "1725471398.606869", "packets": 2, "bytes": 239, "initiator_bytes": 87, "responder_bytes": 152 }, { "flow_id": "flow-2329023a62a765803d9e7c6c", "transport": "udp", "stream": 39, "initiator_ip": "172.17.0.99", "initiator_port": 56490, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 2587, "last_frame": 2625, "first_seen_epoch": "1725471398.549143", "last_seen_epoch": "1725471398.624249", "packets": 2, "bytes": 207, "initiator_bytes": 87, "responder_bytes": 120 }, { "flow_id": "flow-5d19e4f8da513f50aecb3f48", "transport": "udp", "stream": 40, "initiator_ip": "172.17.0.99", "initiator_port": 64936, "responder_ip": "23.221.24.69", "responder_port": 443, "first_frame": 2593, "last_frame": 2940, "first_seen_epoch": "1725471398.560894", "last_seen_epoch": "1725471399.790259", "packets": 215, "bytes": 170909, "initiator_bytes": 9973, "responder_bytes": 160936 }, { "flow_id": "flow-79ec7ad6c6e8882180e1e5a5", "transport": "tcp", "stream": 62, "initiator_ip": "172.17.0.99", "initiator_port": 49827, "responder_ip": "23.220.251.153", "responder_port": 443, "first_frame": 2626, "last_frame": 2950, "first_seen_epoch": "1725471398.624675", "last_seen_epoch": "1725471400.841096", "packets": 41, "bytes": 13960, "initiator_bytes": 3869, "responder_bytes": 10091 }, { "flow_id": "flow-9ee2b7e221d79965af33ff39", "transport": "tcp", "stream": 63, "initiator_ip": "172.17.0.99", "initiator_port": 49828, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 2980, "last_frame": 3073, "first_seen_epoch": "1725471446.479377", "last_seen_epoch": "1725471515.847481", "packets": 12, "bytes": 1271, "initiator_bytes": 749, "responder_bytes": 522 }, { "flow_id": "flow-df57f803d640941079977e4e", "transport": "tcp", "stream": 64, "initiator_ip": "172.17.0.99", "initiator_port": 49829, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 2995, "last_frame": 3023, "first_seen_epoch": "1725471470.86688", "last_seen_epoch": "1725471470.876903", "packets": 17, "bytes": 6696, "initiator_bytes": 3061, "responder_bytes": 3635 }, { "flow_id": "flow-3e6241edce5243e43208a1d7", "transport": "tcp", "stream": 65, "initiator_ip": "172.17.0.99", "initiator_port": 49830, "responder_ip": "172.17.0.17", "responder_port": 88, "first_frame": 3002, "last_frame": 3013, "first_seen_epoch": "1725471470.869353", "last_seen_epoch": "1725471470.87276", "packets": 12, "bytes": 4269, "initiator_bytes": 2148, "responder_bytes": 2121 }, { "flow_id": "flow-97a72c1789aec044952fa971", "transport": "tcp", "stream": 66, "initiator_ip": "172.17.0.99", "initiator_port": 49831, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 3024, "last_frame": 3036, "first_seen_epoch": "1725471470.884355", "last_seen_epoch": "1725471470.888209", "packets": 13, "bytes": 3343, "initiator_bytes": 2597, "responder_bytes": 746 }, { "flow_id": "flow-ee80ba29b142dd1c08cd9dec", "transport": "tcp", "stream": 67, "initiator_ip": "172.17.0.99", "initiator_port": 49832, "responder_ip": "20.96.153.111", "responder_port": 443, "first_frame": 3039, "last_frame": 3135, "first_seen_epoch": "1725471471.489849", "last_seen_epoch": "1725471595.186605", "packets": 29, "bytes": 10646, "initiator_bytes": 3026, "responder_bytes": 7620 }, { "flow_id": "flow-3f2bd78005559fee1553a0de", "transport": "tcp", "stream": 68, "initiator_ip": "172.17.0.99", "initiator_port": 49833, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 3072, "last_frame": 3126, "first_seen_epoch": "1725471515.631128", "last_seen_epoch": "1725471584.987135", "packets": 12, "bytes": 1271, "initiator_bytes": 749, "responder_bytes": 522 }, { "flow_id": "flow-377cf5840cc67219fe55a68e", "transport": "udp", "stream": 41, "initiator_ip": "172.17.0.99", "initiator_port": 62118, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 3089, "last_frame": 3139, "first_seen_epoch": "1725471576.751782", "last_seen_epoch": "1725471607.48657", "packets": 5, "bytes": 923, "initiator_bytes": 233, "responder_bytes": 690 }, { "flow_id": "flow-3bd4988eea8c8b3505dd2694", "transport": "tcp", "stream": 69, "initiator_ip": "172.17.0.99", "initiator_port": 49834, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 3093, "last_frame": 3107, "first_seen_epoch": "1725471576.754702", "last_seen_epoch": "1725471576.761111", "packets": 15, "bytes": 6576, "initiator_bytes": 3001, "responder_bytes": 3575 }, { "flow_id": "flow-ad7c58e28e3d4b1ba460a50c", "transport": "tcp", "stream": 70, "initiator_ip": "172.17.0.99", "initiator_port": 49835, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 3108, "last_frame": 3120, "first_seen_epoch": "1725471576.766103", "last_seen_epoch": "1725471576.769741", "packets": 13, "bytes": 3343, "initiator_bytes": 2597, "responder_bytes": 746 }, { "flow_id": "flow-4e068f18aed673bc8a4496cd", "transport": "tcp", "stream": 71, "initiator_ip": "172.17.0.99", "initiator_port": 49836, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 3124, "last_frame": 3179, "first_seen_epoch": "1725471584.77442", "last_seen_epoch": "1725471654.14488", "packets": 12, "bytes": 1271, "initiator_bytes": 749, "responder_bytes": 522 }, { "flow_id": "flow-8aba4616c9279bc7ddba20b4", "transport": "udp", "stream": 42, "initiator_ip": "172.17.0.99", "initiator_port": 63922, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 3140, "last_frame": 3204, "first_seen_epoch": "1725471611.266882", "last_seen_epoch": "1725471761.523258", "packets": 4, "bytes": 661, "initiator_bytes": 198, "responder_bytes": 463 }, { "flow_id": "flow-5505b35ea1bd53c5e0a01025", "transport": "tcp", "stream": 72, "initiator_ip": "172.17.0.99", "initiator_port": 49839, "responder_ip": "13.89.179.9", "responder_port": 443, "first_frame": 3142, "last_frame": 3167, "first_seen_epoch": "1725471611.312779", "last_seen_epoch": "1725471611.866071", "packets": 26, "bytes": 8457, "initiator_bytes": 3101, "responder_bytes": 5356 }, { "flow_id": "flow-928c0666d1c2a1bb1a0e14e9", "transport": "tcp", "stream": 73, "initiator_ip": "172.17.0.99", "initiator_port": 49840, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 3176, "last_frame": 3247, "first_seen_epoch": "1725471653.917872", "last_seen_epoch": "1725471836.601337", "packets": 19, "bytes": 2781, "initiator_bytes": 1755, "responder_bytes": 1026 }, { "flow_id": "flow-c756323db43855b6c57c3e72", "transport": "tcp", "stream": 74, "initiator_ip": "172.17.0.99", "initiator_port": 49841, "responder_ip": "23.194.68.140", "responder_port": 443, "first_frame": 3205, "last_frame": 3225, "first_seen_epoch": "1725471761.525267", "last_seen_epoch": "1725471761.813653", "packets": 21, "bytes": 8742, "initiator_bytes": 1257, "responder_bytes": 7485 }, { "flow_id": "flow-bd2872f11eecdf44d82a4622", "transport": "udp", "stream": 43, "initiator_ip": "172.17.0.99", "initiator_port": 63858, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 3237, "last_frame": 3260, "first_seen_epoch": "1725471829.837424", "last_seen_epoch": "1725471852.361183", "packets": 4, "bytes": 550, "initiator_bytes": 168, "responder_bytes": 382 }, { "flow_id": "flow-8aff1fa9f622b9fc6a893864", "transport": "tcp", "stream": 75, "initiator_ip": "172.17.0.99", "initiator_port": 49842, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 3245, "last_frame": 3383, "first_seen_epoch": "1725471836.403403", "last_seen_epoch": "1725471897.759875", "packets": 11, "bytes": 1211, "initiator_bytes": 749, "responder_bytes": 462 }, { "flow_id": "flow-91d5b7b19ebaedd96ed7543b", "transport": "tcp", "stream": 76, "initiator_ip": "172.17.0.99", "initiator_port": 49843, "responder_ip": "20.189.173.26", "responder_port": 443, "first_frame": 3261, "last_frame": 3288, "first_seen_epoch": "1725471852.362541", "last_seen_epoch": "1725471852.916613", "packets": 28, "bytes": 8707, "initiator_bytes": 3255, "responder_bytes": 5452 }, { "flow_id": "flow-f3c752a52ae046f279d0f9a6", "transport": "tcp", "stream": 77, "initiator_ip": "172.17.0.99", "initiator_port": 49844, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 3289, "last_frame": 3351, "first_seen_epoch": "1725471878.244781", "last_seen_epoch": "1725471878.483688", "packets": 31, "bytes": 9992, "initiator_bytes": 4862, "responder_bytes": 5130 }, { "flow_id": "flow-88c67b472435a1bdec0ffaef", "transport": "udp", "stream": 44, "initiator_ip": "172.17.0.99", "initiator_port": 53122, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 3304, "last_frame": 3353, "first_seen_epoch": "1725471878.252723", "last_seen_epoch": "1725471878.561381", "packets": 6, "bytes": 910, "initiator_bytes": 336, "responder_bytes": 574 }, { "flow_id": "flow-8f301576a57d732c62403c26", "transport": "udp", "stream": 45, "initiator_ip": "172.17.0.99", "initiator_port": 53123, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 3306, "last_frame": 3307, "first_seen_epoch": "1725471878.253744", "last_seen_epoch": "1725471878.254185", "packets": 2, "bytes": 487, "initiator_bytes": 243, "responder_bytes": 244 }, { "flow_id": "flow-95a625fee78e5797d1dc58be", "transport": "tcp", "stream": 78, "initiator_ip": "172.17.0.99", "initiator_port": 49845, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 3309, "last_frame": 3315, "first_seen_epoch": "1725471878.363394", "last_seen_epoch": "1725471878.364735", "packets": 6, "bytes": 372, "initiator_bytes": 186, "responder_bytes": 186 }, { "flow_id": "flow-ea4f7c551705b1aca6be8dcc", "transport": "udp", "stream": 46, "initiator_ip": "172.17.0.99", "initiator_port": 53124, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 3319, "last_frame": 3320, "first_seen_epoch": "1725471878.368239", "last_seen_epoch": "1725471878.368705", "packets": 2, "bytes": 487, "initiator_bytes": 243, "responder_bytes": 244 }, { "flow_id": "flow-b50238e6d5861cb0e685f90b", "transport": "tcp", "stream": 79, "initiator_ip": "172.17.0.99", "initiator_port": 49846, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 3322, "last_frame": 3328, "first_seen_epoch": "1725471878.472636", "last_seen_epoch": "1725471878.473909", "packets": 6, "bytes": 372, "initiator_bytes": 186, "responder_bytes": 186 }, { "flow_id": "flow-63dc27564a27ba182be69093", "transport": "tcp", "stream": 80, "initiator_ip": "172.17.0.99", "initiator_port": 49847, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 3330, "last_frame": 3336, "first_seen_epoch": "1725471878.475287", "last_seen_epoch": "1725471878.476844", "packets": 6, "bytes": 372, "initiator_bytes": 186, "responder_bytes": 186 }, { "flow_id": "flow-4164127dfacbd4cca763bd45", "transport": "tcp", "stream": 81, "initiator_ip": "172.17.0.99", "initiator_port": 49848, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 3338, "last_frame": 3344, "first_seen_epoch": "1725471878.479267", "last_seen_epoch": "1725471878.480772", "packets": 6, "bytes": 372, "initiator_bytes": 186, "responder_bytes": 186 }, { "flow_id": "flow-a5e6037cb0e87513f328af30", "transport": "tcp", "stream": 82, "initiator_ip": "172.17.0.99", "initiator_port": 49849, "responder_ip": "23.45.119.144", "responder_port": 443, "first_frame": 3354, "last_frame": 3428, "first_seen_epoch": "1725471878.562147", "last_seen_epoch": "1725471958.540447", "packets": 27, "bytes": 9560, "initiator_bytes": 1497, "responder_bytes": 8063 }, { "flow_id": "flow-b04b916f0da36ed53853132b", "transport": "tcp", "stream": 83, "initiator_ip": "172.17.0.99", "initiator_port": 49850, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 3379, "last_frame": 3460, "first_seen_epoch": "1725471897.540808", "last_seen_epoch": "1725472019.488297", "packets": 15, "bytes": 1996, "initiator_bytes": 1252, "responder_bytes": 744 }, { "flow_id": "flow-fc47ba2159e1073d4f8a1108", "transport": "udp", "stream": 47, "initiator_ip": "172.17.0.99", "initiator_port": 62045, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 3389, "last_frame": 3390, "first_seen_epoch": "1725471938.548601", "last_seen_epoch": "1725471938.579425", "packets": 2, "bytes": 248, "initiator_bytes": 96, "responder_bytes": 152 }, { "flow_id": "flow-24d9c4e718ea43256f0143ae", "transport": "tcp", "stream": 84, "initiator_ip": "172.17.0.99", "initiator_port": 49851, "responder_ip": "20.60.228.1", "responder_port": 443, "first_frame": 3391, "last_frame": 3470, "first_seen_epoch": "1725471938.580076", "last_seen_epoch": "1725472068.571195", "packets": 30, "bytes": 14115, "initiator_bytes": 2114, "responder_bytes": 12001 }, { "flow_id": "flow-e4bb12d964b98c1c36f79645", "transport": "udp", "stream": 48, "initiator_ip": "172.17.0.99", "initiator_port": 53686, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 3435, "last_frame": 3436, "first_seen_epoch": "1725471995.444071", "last_seen_epoch": "1725471995.498031", "packets": 2, "bytes": 265, "initiator_bytes": 78, "responder_bytes": 187 }, { "flow_id": "flow-06475ef46c98d7a3bb3a2247", "transport": "tcp", "stream": 85, "initiator_ip": "172.17.0.99", "initiator_port": 49852, "responder_ip": "23.220.251.47", "responder_port": 80, "first_frame": 3437, "last_frame": 3444, "first_seen_epoch": "1725471995.49992", "last_seen_epoch": "1725471995.853844", "packets": 8, "bytes": 1084, "initiator_bytes": 608, "responder_bytes": 476 }, { "flow_id": "flow-bff6e59ee6279f4cc3523fb0", "transport": "udp", "stream": 49, "initiator_ip": "172.17.0.99", "initiator_port": 60417, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 3445, "last_frame": 3504, "first_seen_epoch": "1725471996.162951", "last_seen_epoch": "1725472090.7166", "packets": 6, "bytes": 724, "initiator_bytes": 232, "responder_bytes": 492 }, { "flow_id": "flow-099d13a06261bcfc207ce3bc", "transport": "tcp", "stream": 86, "initiator_ip": "172.17.0.99", "initiator_port": 49853, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 3458, "last_frame": 3527, "first_seen_epoch": "1725472019.316095", "last_seen_epoch": "1725472104.555413", "packets": 12, "bytes": 1271, "initiator_bytes": 749, "responder_bytes": 522 }, { "flow_id": "flow-19c90f31a81b76ae8c563f4c", "transport": "tcp", "stream": 87, "initiator_ip": "172.17.0.99", "initiator_port": 49854, "responder_ip": "172.17.0.17", "responder_port": 445, "first_frame": 3475, "last_frame": 3502, "first_seen_epoch": "1725472078.208408", "last_seen_epoch": "1725472088.944485", "packets": 24, "bytes": 7649, "initiator_bytes": 5491, "responder_bytes": 2158 }, { "flow_id": "flow-5a822b79d678e9f18a3d7954", "transport": "tcp", "stream": 88, "initiator_ip": "172.17.0.99", "initiator_port": 49855, "responder_ip": "23.45.119.143", "responder_port": 443, "first_frame": 3505, "last_frame": 3542, "first_seen_epoch": "1725472090.718458", "last_seen_epoch": "1725472150.879645", "packets": 25, "bytes": 9240, "initiator_bytes": 1205, "responder_bytes": 8035 }, { "flow_id": "flow-31b05761ca8f4ecb402748f7", "transport": "tcp", "stream": 89, "initiator_ip": "172.17.0.99", "initiator_port": 49856, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 3526, "last_frame": 3767, "first_seen_epoch": "1725472104.358599", "last_seen_epoch": "1725472186.914021", "packets": 12, "bytes": 1271, "initiator_bytes": 749, "responder_bytes": 522 }, { "flow_id": "flow-ff9a3de645b7dfb77e1cf37e", "transport": "tcp", "stream": 90, "initiator_ip": "172.17.0.99", "initiator_port": 49857, "responder_ip": "172.17.0.17", "responder_port": 135, "first_frame": 3549, "last_frame": 3679, "first_seen_epoch": "1725472175.778226", "last_seen_epoch": "1725472176.725272", "packets": 11, "bytes": 1776, "initiator_bytes": 904, "responder_bytes": 872 }, { "flow_id": "flow-88d81c12f0dd008334b9cf23", "transport": "tcp", "stream": 91, "initiator_ip": "172.17.0.99", "initiator_port": 49858, "responder_ip": "172.17.0.17", "responder_port": 49668, "first_frame": 3556, "last_frame": 3680, "first_seen_epoch": "1725472175.780666", "last_seen_epoch": "1725472176.725272", "packets": 23, "bytes": 6792, "initiator_bytes": 4397, "responder_bytes": 2395 }, { "flow_id": "flow-171809f8b49ddb8ab553c676", "transport": "tcp", "stream": 92, "initiator_ip": "172.17.0.99", "initiator_port": 49859, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 3579, "last_frame": 3617, "first_seen_epoch": "1725472175.791793", "last_seen_epoch": "1725472175.802217", "packets": 21, "bytes": 7777, "initiator_bytes": 3638, "responder_bytes": 4139 }, { "flow_id": "flow-ac18175a652949d5ff538cf1", "transport": "tcp", "stream": 93, "initiator_ip": "172.17.0.99", "initiator_port": 49860, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 3596, "last_frame": 3614, "first_seen_epoch": "1725472175.798236", "last_seen_epoch": "1725472175.802086", "packets": 18, "bytes": 7131, "initiator_bytes": 3008, "responder_bytes": 4123 }, { "flow_id": "flow-7452394fa130e8427c7d4a4b", "transport": "udp", "stream": 50, "initiator_ip": "172.17.0.99", "initiator_port": 58869, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 3620, "last_frame": 3621, "first_seen_epoch": "1725472175.849105", "last_seen_epoch": "1725472175.894362", "packets": 2, "bytes": 413, "initiator_bytes": 85, "responder_bytes": 328 }, { "flow_id": "flow-da1396c16b6fefce55be5cfe", "transport": "tcp", "stream": 94, "initiator_ip": "172.17.0.99", "initiator_port": 49861, "responder_ip": "40.126.28.22", "responder_port": 443, "first_frame": 3622, "last_frame": 3681, "first_seen_epoch": "1725472175.895532", "last_seen_epoch": "1725472176.725456", "packets": 25, "bytes": 8203, "initiator_bytes": 2046, "responder_bytes": 6157 }, { "flow_id": "flow-5d935d7f886ec1fa841132b1", "transport": "udp", "stream": 51, "initiator_ip": "172.17.0.99", "initiator_port": 55334, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 3645, "last_frame": 3647, "first_seen_epoch": "1725472176.363115", "last_seen_epoch": "1725472176.384136", "packets": 2, "bytes": 243, "initiator_bytes": 75, "responder_bytes": 168 }, { "flow_id": "flow-b80e9ce700a2f1a0981926f6", "transport": "tcp", "stream": 95, "initiator_ip": "172.17.0.99", "initiator_port": 49862, "responder_ip": "23.195.212.189", "responder_port": 443, "first_frame": 3648, "last_frame": 3682, "first_seen_epoch": "1725472176.384716", "last_seen_epoch": "1725472176.725498", "packets": 26, "bytes": 12529, "initiator_bytes": 1621, "responder_bytes": 10908 }, { "flow_id": "flow-eef518d200c5d15bec306560", "transport": "udp", "stream": 52, "initiator_ip": "172.17.0.99", "initiator_port": 56840, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 3666, "last_frame": 3667, "first_seen_epoch": "1725472176.534461", "last_seen_epoch": "1725472176.569111", "packets": 2, "bytes": 315, "initiator_bytes": 89, "responder_bytes": 226 }, { "flow_id": "flow-6a256ed4bed5b509b3fe4c16", "transport": "tcp", "stream": 96, "initiator_ip": "172.17.0.99", "initiator_port": 49863, "responder_ip": "20.189.173.1", "responder_port": 443, "first_frame": 3668, "last_frame": 3717, "first_seen_epoch": "1725472176.569848", "last_seen_epoch": "1725472177.264116", "packets": 33, "bytes": 10910, "initiator_bytes": 5238, "responder_bytes": 5672 }, { "flow_id": "flow-fad88b5ebe57d93aa05e22f4", "transport": "udp", "stream": 53, "initiator_ip": "172.17.0.99", "initiator_port": 57455, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 3683, "last_frame": 3691, "first_seen_epoch": "1725472176.753545", "last_seen_epoch": "1725472176.78464", "packets": 2, "bytes": 318, "initiator_bytes": 91, "responder_bytes": 227 }, { "flow_id": "flow-ba318362b4068faa9f16e4b0", "transport": "tcp", "stream": 97, "initiator_ip": "172.17.0.99", "initiator_port": 49864, "responder_ip": "40.119.249.228", "responder_port": 443, "first_frame": 3692, "last_frame": 3737, "first_seen_epoch": "1725472176.787379", "last_seen_epoch": "1725472178.319885", "packets": 24, "bytes": 7353, "initiator_bytes": 2242, "responder_bytes": 5111 }, { "flow_id": "flow-557fa6bd870272d94796c474", "transport": "tcp", "stream": 98, "initiator_ip": "172.17.0.99", "initiator_port": 49865, "responder_ip": "40.119.249.228", "responder_port": 443, "first_frame": 3738, "last_frame": 3761, "first_seen_epoch": "1725472178.400164", "last_seen_epoch": "1725472179.914223", "packets": 24, "bytes": 6844, "initiator_bytes": 1905, "responder_bytes": 4939 }, { "flow_id": "flow-1d5050b9410515bc19c3f447", "transport": "tcp", "stream": 99, "initiator_ip": "172.17.0.99", "initiator_port": 49866, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 3768, "last_frame": 3795, "first_seen_epoch": "1725472189.423991", "last_seen_epoch": "1725472274.811865", "packets": 12, "bytes": 1271, "initiator_bytes": 749, "responder_bytes": 522 }, { "flow_id": "flow-a618319c596751277e63f42c", "transport": "tcp", "stream": 100, "initiator_ip": "172.17.0.99", "initiator_port": 49867, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 3794, "last_frame": 3869, "first_seen_epoch": "1725472274.578517", "last_seen_epoch": "1725472359.945583", "packets": 12, "bytes": 1271, "initiator_bytes": 749, "responder_bytes": 522 }, { "flow_id": "flow-2ce470392f4deba6c4979688", "transport": "udp", "stream": 54, "initiator_ip": "172.17.0.99", "initiator_port": 61207, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 3803, "last_frame": 3804, "first_seen_epoch": "1725472296.389804", "last_seen_epoch": "1725472296.427304", "packets": 2, "bytes": 225, "initiator_bytes": 75, "responder_bytes": 150 }, { "flow_id": "flow-a572aa1eb5607891b13561f8", "transport": "tcp", "stream": 101, "initiator_ip": "172.17.0.99", "initiator_port": 49868, "responder_ip": "204.79.197.203", "responder_port": 443, "first_frame": 3805, "last_frame": 3880, "first_seen_epoch": "1725472296.428614", "last_seen_epoch": "1725472406.415203", "packets": 37, "bytes": 11087, "initiator_bytes": 2078, "responder_bytes": 9009 }, { "flow_id": "flow-ec9797dd4f6a0bef0c8b58b4", "transport": "tcp", "stream": 102, "initiator_ip": "172.17.0.99", "initiator_port": 49869, "responder_ip": "23.45.119.144", "responder_port": 443, "first_frame": 3838, "last_frame": 3902, "first_seen_epoch": "1725472298.530294", "last_seen_epoch": "1725472448.548527", "packets": 22, "bytes": 6667, "initiator_bytes": 1728, "responder_bytes": 4939 }, { "flow_id": "flow-ddacf8e02e7415c890d2bedf", "transport": "tcp", "stream": 103, "initiator_ip": "172.17.0.99", "initiator_port": 49870, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 3868, "last_frame": 3941, "first_seen_epoch": "1725472359.733507", "last_seen_epoch": "1725472483.866943", "packets": 17, "bytes": 1571, "initiator_bytes": 1109, "responder_bytes": 462 }, { "flow_id": "flow-84d622928b2fb6189df37138", "transport": "udp", "stream": 55, "initiator_ip": "172.17.0.99", "initiator_port": 49396, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 3886, "last_frame": 4035, "first_seen_epoch": "1725472429.82917", "last_seen_epoch": "1725472805.204482", "packets": 4, "bytes": 539, "initiator_bytes": 171, "responder_bytes": 368 }, { "flow_id": "flow-0ce474be489bd34f63a21ed0", "transport": "tcp", "stream": 104, "initiator_ip": "172.17.0.99", "initiator_port": 49871, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 3904, "last_frame": 3945, "first_seen_epoch": "1725472449.885494", "last_seen_epoch": "1725472516.927079", "packets": 12, "bytes": 1271, "initiator_bytes": 749, "responder_bytes": 522 }, { "flow_id": "flow-bf24babb6ea567c1a5d8a7a6", "transport": "tcp", "stream": 105, "initiator_ip": "172.17.0.99", "initiator_port": 49872, "responder_ip": "23.45.119.144", "responder_port": 443, "first_frame": 3919, "last_frame": 4005, "first_seen_epoch": "1725472478.544815", "last_seen_epoch": "1725472698.578533", "packets": 35, "bytes": 15076, "initiator_bytes": 2404, "responder_bytes": 12672 }, { "flow_id": "flow-75aa56273d3d1b4412c7bf37", "transport": "tcp", "stream": 106, "initiator_ip": "172.17.0.99", "initiator_port": 49873, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 3958, "last_frame": 3990, "first_seen_epoch": "1725472539.99979", "last_seen_epoch": "1725472659.790108", "packets": 17, "bytes": 1571, "initiator_bytes": 1109, "responder_bytes": 462 }, { "flow_id": "flow-a624932195298031add1818c", "transport": "tcp", "stream": 107, "initiator_ip": "172.17.0.99", "initiator_port": 49874, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 3979, "last_frame": 4022, "first_seen_epoch": "1725472630.065948", "last_seen_epoch": "1725472756.900991", "packets": 17, "bytes": 1571, "initiator_bytes": 1109, "responder_bytes": 462 }, { "flow_id": "flow-e9cf648d6e2f8dcd06ad47af", "transport": "tcp", "stream": 108, "initiator_ip": "172.17.0.99", "initiator_port": 49875, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 4007, "last_frame": 4076, "first_seen_epoch": "1725472720.208315", "last_seen_epoch": "1725472840.532364", "packets": 17, "bytes": 1571, "initiator_bytes": 1109, "responder_bytes": 462 }, { "flow_id": "flow-f0e86efe89ee310f8fea6751", "transport": "tcp", "stream": 109, "initiator_ip": "172.17.0.99", "initiator_port": 49876, "responder_ip": "20.189.173.18", "responder_port": 443, "first_frame": 4036, "last_frame": 4143, "first_seen_epoch": "1725472805.211273", "last_seen_epoch": "1725472915.243816", "packets": 26, "bytes": 10324, "initiator_bytes": 2599, "responder_bytes": 7725 }, { "flow_id": "flow-d8416c7b034db428e0247f1d", "transport": "tcp", "stream": 110, "initiator_ip": "172.17.0.99", "initiator_port": 49877, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 4060, "last_frame": 4133, "first_seen_epoch": "1725472806.316931", "last_seen_epoch": "1725472892.658239", "packets": 12, "bytes": 1271, "initiator_bytes": 749, "responder_bytes": 522 }, { "flow_id": "flow-a7b55b0721aa424be7c9563c", "transport": "udp", "stream": 56, "initiator_ip": "172.17.0.99", "initiator_port": 52096, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 4077, "last_frame": 4078, "first_seen_epoch": "1725472852.139802", "last_seen_epoch": "1725472852.165472", "packets": 2, "bytes": 303, "initiator_bytes": 74, "responder_bytes": 229 }, { "flow_id": "flow-b9511cc92d12004d00b8c872", "transport": "tcp", "stream": 111, "initiator_ip": "172.17.0.99", "initiator_port": 49878, "responder_ip": "52.113.194.132", "responder_port": 443, "first_frame": 4079, "last_frame": 4155, "first_seen_epoch": "1725472852.166591", "last_seen_epoch": "1725472924.629533", "packets": 34, "bytes": 12075, "initiator_bytes": 2807, "responder_bytes": 9268 }, { "flow_id": "flow-20db7f6cbf2d4d513c8a27c8", "transport": "udp", "stream": 57, "initiator_ip": "172.17.0.99", "initiator_port": 53858, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 4115, "last_frame": 4116, "first_seen_epoch": "1725472865.537171", "last_seen_epoch": "1725472865.560513", "packets": 2, "bytes": 334, "initiator_bytes": 83, "responder_bytes": 251 }, { "flow_id": "flow-cdcc0d3da5a0094f6e4cb539", "transport": "tcp", "stream": 112, "initiator_ip": "172.17.0.99", "initiator_port": 49879, "responder_ip": "199.232.210.172", "responder_port": 80, "first_frame": 4117, "last_frame": 4182, "first_seen_epoch": "1725472865.565177", "last_seen_epoch": "1725472925.764937", "packets": 14, "bytes": 1798, "initiator_bytes": 981, "responder_bytes": 817 }, { "flow_id": "flow-1584997e24866b64348da162", "transport": "tcp", "stream": 113, "initiator_ip": "172.17.0.99", "initiator_port": 49880, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 4130, "last_frame": 4187, "first_seen_epoch": "1725472892.434798", "last_seen_epoch": "1725472956.898257", "packets": 11, "bytes": 1211, "initiator_bytes": 749, "responder_bytes": 462 }, { "flow_id": "flow-ebe6418e18be3cf70c98ee64", "transport": "tcp", "stream": 114, "initiator_ip": "172.17.0.99", "initiator_port": 49881, "responder_ip": "52.113.194.132", "responder_port": 443, "first_frame": 4151, "last_frame": 4223, "first_seen_epoch": "1725472924.551041", "last_seen_epoch": "1725472992.217484", "packets": 26, "bytes": 11097, "initiator_bytes": 2852, "responder_bytes": 8245 }, { "flow_id": "flow-e1cc8458a96f0c0b1a735dfc", "transport": "tcp", "stream": 115, "initiator_ip": "172.17.0.99", "initiator_port": 49882, "responder_ip": "172.17.0.17", "responder_port": 445, "first_frame": 4190, "last_frame": 4222, "first_seen_epoch": "1725472978.206904", "last_seen_epoch": "1725472988.919339", "packets": 25, "bytes": 7709, "initiator_bytes": 5491, "responder_bytes": 2218 }, { "flow_id": "flow-54e7719a40490aea7c6e5bb9", "transport": "tcp", "stream": 116, "initiator_ip": "172.17.0.99", "initiator_port": 49883, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 4210, "last_frame": 4296, "first_seen_epoch": "1725472978.524424", "last_seen_epoch": "1725473096.257038", "packets": 17, "bytes": 1571, "initiator_bytes": 1109, "responder_bytes": 462 }, { "flow_id": "flow-b3600e033591950019788fa3", "transport": "udp", "stream": 58, "initiator_ip": "172.17.0.99", "initiator_port": 61567, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 4227, "last_frame": 4256, "first_seen_epoch": "1725473029.804509", "last_seen_epoch": "1725473078.775806", "packets": 4, "bytes": 557, "initiator_bytes": 168, "responder_bytes": 389 }, { "flow_id": "flow-2a35244ac2b596089812ae9e", "transport": "tcp", "stream": 117, "initiator_ip": "172.17.0.99", "initiator_port": 49884, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 4243, "last_frame": 4351, "first_seen_epoch": "1725473064.603501", "last_seen_epoch": "1725473187.511429", "packets": 17, "bytes": 1571, "initiator_bytes": 1109, "responder_bytes": 462 }, { "flow_id": "flow-b4d209aa4d7c1b3574e7e7c4", "transport": "tcp", "stream": 118, "initiator_ip": "172.17.0.99", "initiator_port": 49885, "responder_ip": "13.70.79.200", "responder_port": 443, "first_frame": 4257, "last_frame": 4289, "first_seen_epoch": "1725473078.777225", "last_seen_epoch": "1725473080.470605", "packets": 32, "bytes": 10354, "initiator_bytes": 4682, "responder_bytes": 5672 }, { "flow_id": "flow-c115c6358c22cb85433a1820", "transport": "udp", "stream": 59, "initiator_ip": "172.17.0.99", "initiator_port": 50983, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 4303, "last_frame": 4304, "first_seen_epoch": "1725473139.491801", "last_seen_epoch": "1725473139.509498", "packets": 2, "bytes": 253, "initiator_bytes": 74, "responder_bytes": 179 }, { "flow_id": "flow-6d4edd24772338d3ecca39f0", "transport": "tcp", "stream": 119, "initiator_ip": "172.17.0.99", "initiator_port": 49886, "responder_ip": "184.29.137.96", "responder_port": 80, "first_frame": 4305, "last_frame": 4358, "first_seen_epoch": "1725473139.516337", "last_seen_epoch": "1725473199.738788", "packets": 10, "bytes": 1090, "initiator_bytes": 587, "responder_bytes": 503 }, { "flow_id": "flow-5c629e8f6691136b48509a13", "transport": "udp", "stream": 60, "initiator_ip": "172.17.0.99", "initiator_port": 53709, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 4311, "last_frame": 4696, "first_seen_epoch": "1725473139.609153", "last_seen_epoch": "1725473809.500722", "packets": 8, "bytes": 1205, "initiator_bytes": 362, "responder_bytes": 843 }, { "flow_id": "flow-d2f477e719f28daabff4371e", "transport": "tcp", "stream": 120, "initiator_ip": "172.17.0.99", "initiator_port": 49887, "responder_ip": "199.232.214.172", "responder_port": 80, "first_frame": 4313, "last_frame": 4356, "first_seen_epoch": "1725473139.610865", "last_seen_epoch": "1725473199.723036", "packets": 11, "bytes": 1145, "initiator_bytes": 642, "responder_bytes": 503 }, { "flow_id": "flow-12c984f4bc0e341ae4381b52", "transport": "tcp", "stream": 121, "initiator_ip": "172.17.0.99", "initiator_port": 49888, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 4326, "last_frame": 4427, "first_seen_epoch": "1725473152.714312", "last_seen_epoch": "1725473281.747385", "packets": 25, "bytes": 3141, "initiator_bytes": 2175, "responder_bytes": 966 }, { "flow_id": "flow-524922a1a422c4af6b5e7c0f", "transport": "tcp", "stream": 122, "initiator_ip": "172.17.0.99", "initiator_port": 49889, "responder_ip": "52.113.194.132", "responder_port": 443, "first_frame": 4371, "last_frame": 4428, "first_seen_epoch": "1725473224.864606", "last_seen_epoch": "1725473290.551202", "packets": 27, "bytes": 11157, "initiator_bytes": 2912, "responder_bytes": 8245 }, { "flow_id": "flow-04c1fcd618ff2eca07293780", "transport": "tcp", "stream": 123, "initiator_ip": "172.17.0.99", "initiator_port": 49890, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 4398, "last_frame": 4451, "first_seen_epoch": "1725473242.035638", "last_seen_epoch": "1725473360.233343", "packets": 23, "bytes": 2417, "initiator_bytes": 1289, "responder_bytes": 1128 }, { "flow_id": "flow-e363d29455960a12bb901e76", "transport": "tcp", "stream": 124, "initiator_ip": "172.17.0.99", "initiator_port": 49891, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 4436, "last_frame": 4461, "first_seen_epoch": "1725473330.035379", "last_seen_epoch": "1725473396.873964", "packets": 12, "bytes": 1271, "initiator_bytes": 749, "responder_bytes": 522 }, { "flow_id": "flow-4b075face9b9a80f8c19c6b4", "transport": "udp", "stream": 61, "initiator_ip": "172.17.0.99", "initiator_port": 55963, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 4452, "last_frame": 4453, "first_seen_epoch": "1725473361.436836", "last_seen_epoch": "1725473361.448204", "packets": 2, "bytes": 168, "initiator_bytes": 76, "responder_bytes": 92 }, { "flow_id": "flow-a47e6d4a6b59aca45acbae1a", "transport": "tcp", "stream": 125, "initiator_ip": "172.17.0.99", "initiator_port": 49892, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 4473, "last_frame": 4495, "first_seen_epoch": "1725473418.176138", "last_seen_epoch": "1725473496.537287", "packets": 12, "bytes": 1271, "initiator_bytes": 749, "responder_bytes": 522 }, { "flow_id": "flow-c87c83066b33b6e0c8707367", "transport": "tcp", "stream": 126, "initiator_ip": "172.17.0.99", "initiator_port": 49893, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 4494, "last_frame": 4543, "first_seen_epoch": "1725473496.328294", "last_seen_epoch": "1725473574.665327", "packets": 12, "bytes": 1271, "initiator_bytes": 749, "responder_bytes": 522 }, { "flow_id": "flow-2a906b66cd2cbb55edf097fc", "transport": "tcp", "stream": 127, "initiator_ip": "172.17.0.99", "initiator_port": 49894, "responder_ip": "52.113.194.132", "responder_port": 443, "first_frame": 4507, "last_frame": 4628, "first_seen_epoch": "1725473525.323013", "last_seen_epoch": "1725473592.450041", "packets": 26, "bytes": 11097, "initiator_bytes": 2852, "responder_bytes": 8245 }, { "flow_id": "flow-83f47d4fe1f09f5469785f3a", "transport": "tcp", "stream": 128, "initiator_ip": "172.17.0.99", "initiator_port": 49895, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 4540, "last_frame": 4650, "first_seen_epoch": "1725473574.438835", "last_seen_epoch": "1725473653.703508", "packets": 12, "bytes": 1271, "initiator_bytes": 749, "responder_bytes": 522 }, { "flow_id": "flow-c1f1cdd077010984c08c896c", "transport": "udp", "stream": 62, "initiator_ip": "172.17.0.99", "initiator_port": 55964, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 4551, "last_frame": 4552, "first_seen_epoch": "1725473582.021341", "last_seen_epoch": "1725473582.021815", "packets": 2, "bytes": 501, "initiator_bytes": 265, "responder_bytes": 236 }, { "flow_id": "flow-b5fc1a44f0183cb75fb34f63", "transport": "tcp", "stream": 129, "initiator_ip": "172.17.0.99", "initiator_port": 49896, "responder_ip": "172.17.0.17", "responder_port": 135, "first_frame": 4553, "last_frame": 4626, "first_seen_epoch": "1725473582.13089", "last_seen_epoch": "1725473582.276482", "packets": 11, "bytes": 1776, "initiator_bytes": 904, "responder_bytes": 872 }, { "flow_id": "flow-e00fd4abc9dcaddca3974384", "transport": "tcp", "stream": 130, "initiator_ip": "172.17.0.99", "initiator_port": 49897, "responder_ip": "172.17.0.17", "responder_port": 49668, "first_frame": 4560, "last_frame": 4627, "first_seen_epoch": "1725473582.133477", "last_seen_epoch": "1725473582.276609", "packets": 23, "bytes": 6830, "initiator_bytes": 4435, "responder_bytes": 2395 }, { "flow_id": "flow-89894c57e8e2badcdfb4561f", "transport": "udp", "stream": 63, "initiator_ip": "172.17.0.99", "initiator_port": 55966, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 4583, "last_frame": 4584, "first_seen_epoch": "1725473582.14406", "last_seen_epoch": "1725473582.144467", "packets": 2, "bytes": 501, "initiator_bytes": 265, "responder_bytes": 236 }, { "flow_id": "flow-ce17285f62fcdc4c2b9dd436", "transport": "tcp", "stream": 131, "initiator_ip": "172.17.0.99", "initiator_port": 49898, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 4587, "last_frame": 4625, "first_seen_epoch": "1725473582.248916", "last_seen_epoch": "1725473582.270537", "packets": 21, "bytes": 7815, "initiator_bytes": 3676, "responder_bytes": 4139 }, { "flow_id": "flow-e04e42f90d68f0550cf522da", "transport": "tcp", "stream": 132, "initiator_ip": "172.17.0.99", "initiator_port": 49899, "responder_ip": "172.17.0.17", "responder_port": 389, "first_frame": 4604, "last_frame": 4621, "first_seen_epoch": "1725473582.262352", "last_seen_epoch": "1725473582.270043", "packets": 18, "bytes": 7169, "initiator_bytes": 3046, "responder_bytes": 4123 }, { "flow_id": "flow-e4a30db1e7b40e04daaa192a", "transport": "udp", "stream": 64, "initiator_ip": "172.17.0.99", "initiator_port": 56520, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 4632, "last_frame": 4882, "first_seen_epoch": "1725473629.795107", "last_seen_epoch": "1725474229.786354", "packets": 4, "bytes": 470, "initiator_bytes": 158, "responder_bytes": 312 }, { "flow_id": "flow-c740d724afc977c76c6f2395", "transport": "tcp", "stream": 133, "initiator_ip": "172.17.0.99", "initiator_port": 49900, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 4648, "last_frame": 4666, "first_seen_epoch": "1725473653.508445", "last_seen_epoch": "1725473726.84227", "packets": 12, "bytes": 1271, "initiator_bytes": 749, "responder_bytes": 522 }, { "flow_id": "flow-d48f058d714852a164e823f6", "transport": "tcp", "stream": 134, "initiator_ip": "172.17.0.99", "initiator_port": 49901, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 4667, "last_frame": 4688, "first_seen_epoch": "1725473731.550024", "last_seen_epoch": "1725473807.080546", "packets": 12, "bytes": 1271, "initiator_bytes": 749, "responder_bytes": 522 }, { "flow_id": "flow-6b2a9b2a18d2d18e673092c1", "transport": "tcp", "stream": 135, "initiator_ip": "172.17.0.99", "initiator_port": 49902, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 4686, "last_frame": 4782, "first_seen_epoch": "1725473806.855953", "last_seen_epoch": "1725473881.193784", "packets": 12, "bytes": 1271, "initiator_bytes": 749, "responder_bytes": 522 }, { "flow_id": "flow-550fd08dec99ef23623518bb", "transport": "tcp", "stream": 136, "initiator_ip": "172.17.0.99", "initiator_port": 49903, "responder_ip": "23.45.119.147", "responder_port": 443, "first_frame": 4697, "last_frame": 4752, "first_seen_epoch": "1725473809.502685", "last_seen_epoch": "1725473869.739024", "packets": 25, "bytes": 9241, "initiator_bytes": 1265, "responder_bytes": 7976 }, { "flow_id": "flow-63b2d37fc4ea5b437864351c", "transport": "tcp", "stream": 137, "initiator_ip": "172.17.0.99", "initiator_port": 49904, "responder_ip": "52.113.194.132", "responder_port": 443, "first_frame": 4721, "last_frame": 4795, "first_seen_epoch": "1725473825.811456", "last_seen_epoch": "1725473891.478871", "packets": 28, "bytes": 11217, "initiator_bytes": 2972, "responder_bytes": 8245 }, { "flow_id": "flow-963ce72c7becbfb4d440cb68", "transport": "tcp", "stream": 138, "initiator_ip": "172.17.0.99", "initiator_port": 49905, "responder_ip": "172.17.0.17", "responder_port": 445, "first_frame": 4759, "last_frame": 4794, "first_seen_epoch": "1725473878.190108", "last_seen_epoch": "1725473888.925938", "packets": 24, "bytes": 7649, "initiator_bytes": 5491, "responder_bytes": 2158 }, { "flow_id": "flow-97587516bc1e08e8d2d78479", "transport": "tcp", "stream": 139, "initiator_ip": "172.17.0.99", "initiator_port": 49906, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 4781, "last_frame": 4802, "first_seen_epoch": "1725473880.960805", "last_seen_epoch": "1725473946.872454", "packets": 11, "bytes": 1211, "initiator_bytes": 749, "responder_bytes": 462 }, { "flow_id": "flow-1ba72454ab0e9ba4ee6d430b", "transport": "tcp", "stream": 140, "initiator_ip": "172.17.0.99", "initiator_port": 49907, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 4807, "last_frame": 4829, "first_seen_epoch": "1725473955.128598", "last_seen_epoch": "1725474029.475827", "packets": 12, "bytes": 1271, "initiator_bytes": 749, "responder_bytes": 522 }, { "flow_id": "flow-04b64dcccec42a1051c8589e", "transport": "tcp", "stream": 141, "initiator_ip": "172.17.0.99", "initiator_port": 49908, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 4827, "last_frame": 4852, "first_seen_epoch": "1725474029.241662", "last_seen_epoch": "1725474103.634106", "packets": 12, "bytes": 1271, "initiator_bytes": 749, "responder_bytes": 522 }, { "flow_id": "flow-64b1d2713d425d47825efab1", "transport": "tcp", "stream": 142, "initiator_ip": "172.17.0.99", "initiator_port": 49909, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 4849, "last_frame": 4867, "first_seen_epoch": "1725474103.410869", "last_seen_epoch": "1725474166.848629", "packets": 11, "bytes": 1211, "initiator_bytes": 749, "responder_bytes": 462 }, { "flow_id": "flow-cc62dee30f0926a9455ede15", "transport": "tcp", "stream": 143, "initiator_ip": "172.17.0.99", "initiator_port": 49910, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 4872, "last_frame": 4901, "first_seen_epoch": "1725474175.474189", "last_seen_epoch": "1725474247.824277", "packets": 12, "bytes": 1271, "initiator_bytes": 749, "responder_bytes": 522 }, { "flow_id": "flow-7d7ddf8030a011b2820ca04b", "transport": "udp", "stream": 65, "initiator_ip": "172.17.0.99", "initiator_port": 51415, "responder_ip": "172.17.0.17", "responder_port": 53, "first_frame": 4881, "last_frame": 4883, "first_seen_epoch": "1725474229.786291", "last_seen_epoch": "1725474229.786887", "packets": 2, "bytes": 235, "initiator_bytes": 79, "responder_bytes": 156 }, { "flow_id": "flow-e4420dbaf565dfddd453ad0c", "transport": "tcp", "stream": 144, "initiator_ip": "172.17.0.99", "initiator_port": 49911, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 4899, "last_frame": 4917, "first_seen_epoch": "1725474247.611487", "last_seen_epoch": "1725474319.989976", "packets": 12, "bytes": 1271, "initiator_bytes": 749, "responder_bytes": 522 }, { "flow_id": "flow-988f76d67c2a37839568747a", "transport": "tcp", "stream": 145, "initiator_ip": "172.17.0.99", "initiator_port": 49912, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 4916, "last_frame": 4936, "first_seen_epoch": "1725474319.761639", "last_seen_epoch": "1725474386.84842", "packets": 12, "bytes": 1271, "initiator_bytes": 749, "responder_bytes": 522 }, { "flow_id": "flow-3d18dea8aa2ebf90e82251e1", "transport": "tcp", "stream": 146, "initiator_ip": "172.17.0.99", "initiator_port": 49913, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 4939, "last_frame": 4956, "first_seen_epoch": "1725474391.919863", "last_seen_epoch": "1725474464.32209", "packets": 12, "bytes": 1271, "initiator_bytes": 749, "responder_bytes": 522 }, { "flow_id": "flow-e334b5c21242e18dacc6c0b2", "transport": "tcp", "stream": 147, "initiator_ip": "172.17.0.99", "initiator_port": 49914, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 4954, "last_frame": 4971, "first_seen_epoch": "1725474464.080275", "last_seen_epoch": "1725474526.477337", "packets": 11, "bytes": 1211, "initiator_bytes": 749, "responder_bytes": 462 }, { "flow_id": "flow-5ac224b9746ab9f444b2bc3c", "transport": "tcp", "stream": 148, "initiator_ip": "172.17.0.99", "initiator_port": 49915, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 4968, "last_frame": 4983, "first_seen_epoch": "1725474526.254263", "last_seen_epoch": "1725474588.622105", "packets": 11, "bytes": 1211, "initiator_bytes": 749, "responder_bytes": 462 }, { "flow_id": "flow-b36597c617d608edb027e6cf", "transport": "tcp", "stream": 149, "initiator_ip": "172.17.0.99", "initiator_port": 49916, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 4981, "last_frame": 5030, "first_seen_epoch": "1725474588.402379", "last_seen_epoch": "1725474650.783033", "packets": 11, "bytes": 1211, "initiator_bytes": 749, "responder_bytes": 462 }, { "flow_id": "flow-fee075d8b352584067e14fdd", "transport": "tcp", "stream": 150, "initiator_ip": "172.17.0.99", "initiator_port": 49917, "responder_ip": "20.189.173.18", "responder_port": 443, "first_frame": 5000, "last_frame": 5081, "first_seen_epoch": "1725474605.081618", "last_seen_epoch": "1725474715.181862", "packets": 26, "bytes": 10437, "initiator_bytes": 2786, "responder_bytes": 7651 }, { "flow_id": "flow-a4ea526e2dc7f4daaa00c6de", "transport": "tcp", "stream": 151, "initiator_ip": "172.17.0.99", "initiator_port": 49918, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 5026, "last_frame": 5075, "first_seen_epoch": "1725474650.566609", "last_seen_epoch": "1725474712.902765", "packets": 11, "bytes": 1211, "initiator_bytes": 749, "responder_bytes": 462 }, { "flow_id": "flow-396b6bcf79323b46845d9f00", "transport": "tcp", "stream": 152, "initiator_ip": "172.17.0.99", "initiator_port": 49919, "responder_ip": "172.17.0.17", "responder_port": 135, "first_frame": 5042, "last_frame": 5091, "first_seen_epoch": "1725474712.479894", "last_seen_epoch": "1725474727.478593", "packets": 12, "bytes": 1412, "initiator_bytes": 742, "responder_bytes": 670 }, { "flow_id": "flow-26315e6a344e6f7135f9268e", "transport": "tcp", "stream": 153, "initiator_ip": "172.17.0.99", "initiator_port": 49920, "responder_ip": "172.17.0.17", "responder_port": 49668, "first_frame": 5049, "last_frame": 5068, "first_seen_epoch": "1725474712.481692", "last_seen_epoch": "1725474712.530511", "packets": 20, "bytes": 6424, "initiator_bytes": 4207, "responder_bytes": 2217 }, { "flow_id": "flow-226a8c39b721d8358f2b65e8", "transport": "tcp", "stream": 154, "initiator_ip": "172.17.0.99", "initiator_port": 49921, "responder_ip": "79.124.78.197", "responder_port": 80, "first_frame": 5071, "last_frame": 5083, "first_seen_epoch": "1725474712.687836", "last_seen_epoch": "1725474715.927104", "packets": 8, "bytes": 1031, "initiator_bytes": 629, "responder_bytes": 402 } ], "events": { "dns": [ { "event_id": "evt-dac88548aab475aec8d81c5f", "kind": "dns", "frame_number": 7, "timestamp_epoch": "1725471151.328745000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 59123, "dst_port": 53, "tcp_stream": null, "udp_stream": 2, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.bepositive.com", "dns.qry.type": "33" } }, { "event_id": "evt-ad89d28af1f7da2e1f5590d4", "kind": "dns", "frame_number": 9, "timestamp_epoch": "1725471151.328944000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 59123, "tcp_stream": null, "udp_stream": 2, "fields": { "dns.a": "172.17.0.17", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.bepositive.com", "dns.qry.type": "33" } }, { "event_id": "evt-ed29a927baea1640e79ffb24", "kind": "dns", "frame_number": 12, "timestamp_epoch": "1725471151.329715000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 59940, "dst_port": 53, "tcp_stream": null, "udp_stream": 5, "fields": { "dns.flags.response": "False", "dns.qry.name": "DESKTOP-RNVO9AT.bepositive.com", "dns.qry.type": "6" } }, { "event_id": "evt-8c115593eecd1d0b5e8b3297", "kind": "dns", "frame_number": 13, "timestamp_epoch": "1725471151.329715000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 51761, "dst_port": 53, "tcp_stream": null, "udp_stream": 6, "fields": { "dns.flags.response": "False", "dns.qry.name": "win-ctl9xbq9y19.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-6853998b063d0719fb63c93b", "kind": "dns", "frame_number": 14, "timestamp_epoch": "1725471151.329895000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 59940, "tcp_stream": null, "udp_stream": 5, "fields": { "dns.a": "172.17.0.17", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "DESKTOP-RNVO9AT.bepositive.com", "dns.qry.type": "6" } }, { "event_id": "evt-a1fe8a6f14a58083c4dbd6d6", "kind": "dns", "frame_number": 15, "timestamp_epoch": "1725471151.329895000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 51761, "tcp_stream": null, "udp_stream": 6, "fields": { "dns.a": "172.17.0.17", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "win-ctl9xbq9y19.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-e7e9f2d171535ec35774cac2", "kind": "dns", "frame_number": 17, "timestamp_epoch": "1725471151.330497000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 59940, "dst_port": 53, "tcp_stream": null, "udp_stream": 5, "fields": { "dns.a": "172.17.0.99", "dns.flags.response": "False", "dns.qry.name": "bepositive.com", "dns.qry.type": "6" } }, { "event_id": "evt-bbebd610c4fc1114b60e6638", "kind": "dns", "frame_number": 19, "timestamp_epoch": "1725471151.332560000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 59940, "tcp_stream": null, "udp_stream": 5, "fields": { "dns.a": "172.17.0.99", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "bepositive.com", "dns.qry.type": "6" } }, { "event_id": "evt-eeb19b369e362d2230fbb339", "kind": "dns", "frame_number": 23, "timestamp_epoch": "1725471151.431684000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 51761, "dst_port": 53, "tcp_stream": null, "udp_stream": 6, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.bepositive.com", "dns.qry.type": "33" } }, { "event_id": "evt-11364f872d5442ab4d836ed6", "kind": "dns", "frame_number": 25, "timestamp_epoch": "1725471151.431808000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 51761, "tcp_stream": null, "udp_stream": 6, "fields": { "dns.a": "172.17.0.17", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.bepositive.com", "dns.qry.type": "33" } }, { "event_id": "evt-ef92fb340f46495fb6ae16f2", "kind": "dns", "frame_number": 39, "timestamp_epoch": "1725471151.819433000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 62363, "dst_port": 53, "tcp_stream": null, "udp_stream": 10, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-08c9cc7e5bb4488c84fa969c", "kind": "dns", "frame_number": 40, "timestamp_epoch": "1725471151.819433000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 61360, "dst_port": 53, "tcp_stream": null, "udp_stream": 11, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-b1a38f9f1971d73355949352", "kind": "dns", "frame_number": 41, "timestamp_epoch": "1725471151.819563000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 62363, "tcp_stream": null, "udp_stream": 10, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-07d05d5937b709c54ff110e0", "kind": "dns", "frame_number": 42, "timestamp_epoch": "1725471151.819563000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 61360, "tcp_stream": null, "udp_stream": 11, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-f3d6c93fc11738365c5069d5", "kind": "dns", "frame_number": 47, "timestamp_epoch": "1725471151.835596000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 61360, "dst_port": 53, "tcp_stream": null, "udp_stream": 11, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.msftconnecttest.com", "dns.qry.type": "1" } }, { "event_id": "evt-61e538ac5eac144f9da5c646", "kind": "dns", "frame_number": 48, "timestamp_epoch": "1725471151.893848000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 61360, "tcp_stream": null, "udp_stream": 11, "fields": { "dns.a": "23.220.251.149,23.220.251.158", "dns.cname": "ncsi-geo.trafficmanager.net,www.msftncsi.com.edgesuite.net,a1961.g2.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.msftconnecttest.com", "dns.qry.type": "1" } }, { "event_id": "evt-a516053cbab9d2eae15971b6", "kind": "dns", "frame_number": 67, "timestamp_epoch": "1725471152.993509000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 64451, "dst_port": 53, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.msftconnecttest.com", "dns.qry.type": "1" } }, { "event_id": "evt-7d1c60ae0841e05a8e1bbaeb", "kind": "dns", "frame_number": 68, "timestamp_epoch": "1725471152.994150000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 64451, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.a": "23.220.251.158,23.220.251.149", "dns.cname": "ncsi-geo.trafficmanager.net,www.msftncsi.com.edgesuite.net,a1961.g2.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.msftconnecttest.com", "dns.qry.type": "1" } }, { "event_id": "evt-bf1208edaaa058129be7795d", "kind": "dns", "frame_number": 105, "timestamp_epoch": "1725471157.933111000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 64451, "dst_port": 53, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.response": "False", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-65cf3ee33f361aa74091b8d4", "kind": "dns", "frame_number": 106, "timestamp_epoch": "1725471157.973714000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 64451, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.a": "131.107.255.255", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-a29a18c08599998c84b89763", "kind": "dns", "frame_number": 109, "timestamp_epoch": "1725471169.837118000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 64451, "dst_port": 53, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-6409461a1061c8b7db6d95d5", "kind": "dns", "frame_number": 110, "timestamp_epoch": "1725471169.837323000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 57960, "dst_port": 53, "tcp_stream": null, "udp_stream": 16, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-e0e66f78b70ecd19fa35e910", "kind": "dns", "frame_number": 111, "timestamp_epoch": "1725471169.837437000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 64451, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-1d7129abec7d81bf378e08d7", "kind": "dns", "frame_number": 112, "timestamp_epoch": "1725471169.837588000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 57960, "tcp_stream": null, "udp_stream": 16, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-3aa6eebd4d226ea24a352829", "kind": "dns", "frame_number": 152, "timestamp_epoch": "1725471193.048261000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 57960, "dst_port": 53, "tcp_stream": null, "udp_stream": 16, "fields": { "dns.flags.response": "False", "dns.qry.name": "pti.store.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-9c406208cd2de94755f6a63f", "kind": "dns", "frame_number": 153, "timestamp_epoch": "1725471193.099436000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 57960, "tcp_stream": null, "udp_stream": 16, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "pti.store.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-383cd558a817ca6a2cf4d3e8", "kind": "dns", "frame_number": 213, "timestamp_epoch": "1725471229.852947000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 57960, "dst_port": 53, "tcp_stream": null, "udp_stream": 16, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-3d3d060ef03bb4e268c2f0fb", "kind": "dns", "frame_number": 214, "timestamp_epoch": "1725471229.852947000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 64451, "dst_port": 53, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-49d2c5ed37ad006bc857cf74", "kind": "dns", "frame_number": 215, "timestamp_epoch": "1725471229.852947000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 57960, "tcp_stream": null, "udp_stream": 16, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-0d98c370c31b9ec8e2e3a302", "kind": "dns", "frame_number": 216, "timestamp_epoch": "1725471229.853010000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 64451, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-4abb51dd4e15901a0c15b047", "kind": "dns", "frame_number": 243, "timestamp_epoch": "1725471255.643683000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 57960, "dst_port": 53, "tcp_stream": null, "udp_stream": 16, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-d9d505b87afdeb580b44a597", "kind": "dns", "frame_number": 244, "timestamp_epoch": "1725471255.698202000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 57960, "tcp_stream": null, "udp_stream": 16, "fields": { "dns.a": "20.42.73.28", "dns.cname": "win-global-asimov-leafs-events-data.trafficmanager.net,onedscolprdeus15.eastus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-00353e6fa307c4819a2d5a2d", "kind": "dns", "frame_number": 498, "timestamp_epoch": "1725471275.832629000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 57960, "dst_port": 53, "tcp_stream": null, "udp_stream": 16, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-90f248dcf7fe1bb115425f83", "kind": "dns", "frame_number": 499, "timestamp_epoch": "1725471275.893014000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 57960, "tcp_stream": null, "udp_stream": 16, "fields": { "dns.a": "23.221.24.58,23.221.24.51,23.221.24.56,23.221.24.57,23.221.24.49,23.221.24.53,23.221.24.50,23.221.24.52,23.221.24.55", "dns.cname": "www-www.bing.com.trafficmanager.net,www.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-48913d770074bdccf4812910", "kind": "dns", "frame_number": 528, "timestamp_epoch": "1725471276.051539000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 57960, "dst_port": 53, "tcp_stream": null, "udp_stream": 16, "fields": { "dns.flags.response": "False", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-3663d776967722545e98c7ce", "kind": "dns", "frame_number": 531, "timestamp_epoch": "1725471276.098646000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 57960, "tcp_stream": null, "udp_stream": 16, "fields": { "dns.a": "23.45.119.144,23.45.119.143", "dns.cname": "assets.msn.com.edgekey.net,e28578.d.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-b6e19d49463bcb61352463bb", "kind": "dns", "frame_number": 565, "timestamp_epoch": "1725471276.287268000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 57960, "dst_port": 53, "tcp_stream": null, "udp_stream": 16, "fields": { "dns.flags.response": "False", "dns.qry.name": "arc.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-f49ff867d63bf3284cb1247e", "kind": "dns", "frame_number": 575, "timestamp_epoch": "1725471276.337426000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 57960, "tcp_stream": null, "udp_stream": 16, "fields": { "dns.a": "20.96.153.111", "dns.cname": "arc.trafficmanager.net,iris-de-prod-azsc-v2-eus2.eastus2.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "arc.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-b3f16c441092b7a3f8a0d567", "kind": "dns", "frame_number": 599, "timestamp_epoch": "1725471276.652439000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 57960, "dst_port": 53, "tcp_stream": null, "udp_stream": 16, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-75f06c7dfd243af3d2cbbf5d", "kind": "dns", "frame_number": 602, "timestamp_epoch": "1725471276.695416000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 57960, "tcp_stream": null, "udp_stream": 16, "fields": { "dns.a": "204.79.197.203", "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-9e475721e99803d209335977", "kind": "dns", "frame_number": 668, "timestamp_epoch": "1725471276.987349000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 57960, "dst_port": 53, "tcp_stream": null, "udp_stream": 16, "fields": { "dns.flags.response": "False", "dns.qry.name": "officeclient.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-da8c89c69b8f8690f590046e", "kind": "dns", "frame_number": 805, "timestamp_epoch": "1725471277.198320000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 57960, "tcp_stream": null, "udp_stream": 16, "fields": { "dns.a": "52.109.0.91", "dns.cname": "config.officeapps.live.com,prod.configsvc1.live.com.akadns.net,us.configsvc1.live.com.akadns.net,wus-azsc-config.officeapps.live.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "officeclient.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-60abd286d7f407554ac41ba4", "kind": "dns", "frame_number": 885, "timestamp_epoch": "1725471277.731425000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 51916, "dst_port": 53, "tcp_stream": null, "udp_stream": 19, "fields": { "dns.flags.response": "False", "dns.qry.name": "odc.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-7108b8b440edfda1ef7be149", "kind": "dns", "frame_number": 886, "timestamp_epoch": "1725471277.873237000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 51916, "tcp_stream": null, "udp_stream": 19, "fields": { "dns.a": "52.109.0.142", "dns.cname": "prod.odcsm1.live.com.akadns.net,us2.odcsm1.live.com.akadns.net,wus-azsc-000.odc.officeapps.live.com,osiprod-wus-bronze-azsc-000.westus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "odc.officeapps.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-5ec2c356d6e50d8590f2ffb1", "kind": "dns", "frame_number": 1051, "timestamp_epoch": "1725471279.973890000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 56608, "dst_port": 53, "tcp_stream": null, "udp_stream": 20, "fields": { "dns.flags.response": "False", "dns.qry.name": "g.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-6b06d1cc36b4d25668cc7e26", "kind": "dns", "frame_number": 1052, "timestamp_epoch": "1725471279.977517000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 56608, "tcp_stream": null, "udp_stream": 20, "fields": { "dns.a": "20.241.44.114", "dns.cname": "g.msn.com,g-msn-com-nsatc.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "g.live.com", "dns.qry.type": "1" } }, { "event_id": "evt-a6dcb732e8c4fa83ccf3d33c", "kind": "dns", "frame_number": 1126, "timestamp_epoch": "1725471280.106056000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 51962, "dst_port": 53, "tcp_stream": null, "udp_stream": 21, "fields": { "dns.flags.response": "False", "dns.qry.name": "login.microsoftonline.com", "dns.qry.type": "1" } }, { "event_id": "evt-2b36cf20242cd18bd811fbc6", "kind": "dns", "frame_number": 1140, "timestamp_epoch": "1725471280.152646000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 51962, "tcp_stream": null, "udp_stream": 21, "fields": { "dns.a": "40.126.28.12,40.126.28.20,40.126.28.23,40.126.7.35,40.126.28.11,40.126.28.13,40.126.28.18,40.126.7.32", "dns.cname": "login.mso.msidentity.com,ak.privatelink.msidentity.com,www.tm.ak.prd.aadg.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "login.microsoftonline.com", "dns.qry.type": "1" } }, { "event_id": "evt-ef53a8f815625ac2bb0f910e", "kind": "dns", "frame_number": 1150, "timestamp_epoch": "1725471280.294043000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 51962, "dst_port": 53, "tcp_stream": null, "udp_stream": 21, "fields": { "dns.flags.response": "False", "dns.qry.name": "oneclient.sfx.ms", "dns.qry.type": "1" } }, { "event_id": "evt-0b5a29a376bcda093a5e90f7", "kind": "dns", "frame_number": 1154, "timestamp_epoch": "1725471280.344228000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 51962, "tcp_stream": null, "udp_stream": 21, "fields": { "dns.a": "23.40.145.142", "dns.cname": "oneclient.sfx.ms.edgekey.net,e9659.dspg.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "oneclient.sfx.ms", "dns.qry.type": "1" } }, { "event_id": "evt-fb6c70d234a2a530ed9508c0", "kind": "dns", "frame_number": 1198, "timestamp_epoch": "1725471280.556909000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 51962, "dst_port": 53, "tcp_stream": null, "udp_stream": 21, "fields": { "dns.flags.response": "False", "dns.qry.name": "sso.godaddy.com", "dns.qry.type": "1" } }, { "event_id": "evt-d3e6855f214c9ccb2994dbaa", "kind": "dns", "frame_number": 1199, "timestamp_epoch": "1725471280.593815000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 51962, "tcp_stream": null, "udp_stream": 21, "fields": { "dns.a": "23.195.212.189", "dns.cname": "sso.godaddy.com-v1.edgekey.net,e6225.x.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "sso.godaddy.com", "dns.qry.type": "1" } }, { "event_id": "evt-d3d940291d21cf915a95224f", "kind": "dns", "frame_number": 1244, "timestamp_epoch": "1725471296.652976000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 51962, "dst_port": 53, "tcp_stream": null, "udp_stream": 21, "fields": { "dns.flags.response": "False", "dns.qry.name": "inputsuggestions.msdxcdn.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-1672a0a35e5654c4cc8e061a", "kind": "dns", "frame_number": 1245, "timestamp_epoch": "1725471296.712511000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 51962, "tcp_stream": null, "udp_stream": 21, "fields": { "dns.a": "13.107.246.57", "dns.cname": "msdx-cdn-y86ykn8r9v.azureedge.net,msdx-cdn-y86ykn8r9v.afd.azureedge.net,azureedge-t-prod.trafficmanager.net,shed.dual-low.s-part-0029.t-0009.t-msedge.net,s-part-0029.t-0009.t-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "inputsuggestions.msdxcdn.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-f2cc8165f92e2e0112c71b01", "kind": "dns", "frame_number": 1629, "timestamp_epoch": "1725471306.710868000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 59001, "dst_port": 53, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.response": "False", "dns.qry.name": "sso.godaddy.com", "dns.qry.type": "1" } }, { "event_id": "evt-c8561fa9da3c802ddf5e8f02", "kind": "dns", "frame_number": 1630, "timestamp_epoch": "1725471306.752557000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 59001, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.a": "23.195.212.189", "dns.cname": "sso.godaddy.com-v1.edgekey.net,e6225.x.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "sso.godaddy.com", "dns.qry.type": "1" } }, { "event_id": "evt-678c9c85547c690f4cf4a1aa", "kind": "dns", "frame_number": 2250, "timestamp_epoch": "1725471336.131431000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 59001, "dst_port": 53, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.bepositive.com", "dns.qry.type": "33" } }, { "event_id": "evt-e6080f087c14b2879b4913f8", "kind": "dns", "frame_number": 2251, "timestamp_epoch": "1725471336.131495000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 59001, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.a": "172.17.0.17", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.bepositive.com", "dns.qry.type": "33" } }, { "event_id": "evt-5e191a3788fde42484a8164a", "kind": "dns", "frame_number": 2383, "timestamp_epoch": "1725471397.236915000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 59001, "dst_port": 53, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-89be5ac2c504bf8326b7deb8", "kind": "dns", "frame_number": 2384, "timestamp_epoch": "1725471397.237001000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 59001, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-ad4f5dd26fe239274e281ba0", "kind": "dns", "frame_number": 2385, "timestamp_epoch": "1725471397.316273000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 55220, "dst_port": 53, "tcp_stream": null, "udp_stream": 24, "fields": { "dns.flags.response": "False", "dns.qry.name": "windows.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-15ea4bda0ea7d29ec55fcad3", "kind": "dns", "frame_number": 2386, "timestamp_epoch": "1725471397.316273000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 65466, "dst_port": 53, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.flags.response": "False", "dns.qry.name": "windows.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-aca5b73653944b3513c3616e", "kind": "dns", "frame_number": 2387, "timestamp_epoch": "1725471397.316356000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 55220, "tcp_stream": null, "udp_stream": 24, "fields": { "dns.a": "204.79.197.203", "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "windows.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-a124b5e87ecca65f4850b00d", "kind": "dns", "frame_number": 2394, "timestamp_epoch": "1725471397.361032000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 65466, "tcp_stream": null, "udp_stream": 25, "fields": { "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "windows.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-fb419c1e4e1a15b6e90490bc", "kind": "dns", "frame_number": 2437, "timestamp_epoch": "1725471397.772742000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 58644, "dst_port": 53, "tcp_stream": null, "udp_stream": 26, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-2f70b66c91e547511794f8a3", "kind": "dns", "frame_number": 2438, "timestamp_epoch": "1725471397.772803000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 54446, "dst_port": 53, "tcp_stream": null, "udp_stream": 27, "fields": { "dns.flags.response": "False", "dns.qry.name": "www.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-b419f62e4b62746cc2f8d9dc", "kind": "dns", "frame_number": 2439, "timestamp_epoch": "1725471397.773492000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 58644, "tcp_stream": null, "udp_stream": 26, "fields": { "dns.a": "204.79.197.203", "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-6dfb5484210cb55013942b8d", "kind": "dns", "frame_number": 2440, "timestamp_epoch": "1725471397.773492000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 54446, "tcp_stream": null, "udp_stream": 27, "fields": { "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "www.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-8bb23157663e588e7fb68e76", "kind": "dns", "frame_number": 2485, "timestamp_epoch": "1725471398.149174000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 62998, "dst_port": 53, "tcp_stream": null, "udp_stream": 28, "fields": { "dns.flags.response": "False", "dns.qry.name": "api.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-472ffecb6703121f8d123988", "kind": "dns", "frame_number": 2486, "timestamp_epoch": "1725471398.149174000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 63046, "dst_port": 53, "tcp_stream": null, "udp_stream": 29, "fields": { "dns.flags.response": "False", "dns.qry.name": "api.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-c9db30676d0a30f68a371013", "kind": "dns", "frame_number": 2487, "timestamp_epoch": "1725471398.149224000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 58531, "dst_port": 53, "tcp_stream": null, "udp_stream": 30, "fields": { "dns.flags.response": "False", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-d0e977f33c2296ba13747a29", "kind": "dns", "frame_number": 2488, "timestamp_epoch": "1725471398.149224000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 61084, "dst_port": 53, "tcp_stream": null, "udp_stream": 31, "fields": { "dns.flags.response": "False", "dns.qry.name": "assets.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-6f73e01b3b9042510c776c22", "kind": "dns", "frame_number": 2489, "timestamp_epoch": "1725471398.205460000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 58531, "tcp_stream": null, "udp_stream": 30, "fields": { "dns.a": "23.45.119.144,23.45.119.143,23.45.119.146", "dns.cname": "assets.msn.com.edgekey.net,e28578.d.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-3decb82e3dfa25b083215452", "kind": "dns", "frame_number": 2490, "timestamp_epoch": "1725471398.205460000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 62998, "tcp_stream": null, "udp_stream": 28, "fields": { "dns.a": "204.79.197.203", "dns.cname": "api-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "api.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-730b3b5f8fc2a478ce1d6b3c", "kind": "dns", "frame_number": 2491, "timestamp_epoch": "1725471398.205500000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 63046, "tcp_stream": null, "udp_stream": 29, "fields": { "dns.cname": "api-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "api.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-6f65a9e3f51dee3c07c0535d", "kind": "dns", "frame_number": 2495, "timestamp_epoch": "1725471398.250673000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 61084, "tcp_stream": null, "udp_stream": 31, "fields": { "dns.cname": "assets.msn.com.edgekey.net,e28578.d.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "assets.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-e4d1da9fe578c9a5c0243f40", "kind": "dns", "frame_number": 2535, "timestamp_epoch": "1725471398.400443000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 49994, "dst_port": 53, "tcp_stream": null, "udp_stream": 33, "fields": { "dns.flags.response": "False", "dns.qry.name": "srtb.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-637ea5c23af561eeaf832788", "kind": "dns", "frame_number": 2536, "timestamp_epoch": "1725471398.400443000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 62207, "dst_port": 53, "tcp_stream": null, "udp_stream": 34, "fields": { "dns.flags.response": "False", "dns.qry.name": "srtb.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-5e68ad2f12c219998b111399", "kind": "dns", "frame_number": 2537, "timestamp_epoch": "1725471398.401014000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 49994, "tcp_stream": null, "udp_stream": 33, "fields": { "dns.a": "204.79.197.203", "dns.cname": "www.msn.com,www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "srtb.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-3ef772d5b19163b5f402f23a", "kind": "dns", "frame_number": 2538, "timestamp_epoch": "1725471398.401014000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 62207, "tcp_stream": null, "udp_stream": 34, "fields": { "dns.cname": "www.msn.com,www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "srtb.msn.com", "dns.qry.type": "65" } }, { "event_id": "evt-e8b2dcb22dc54bdd5092bbcc", "kind": "dns", "frame_number": 2563, "timestamp_epoch": "1725471398.493602000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 56598, "dst_port": 53, "tcp_stream": null, "udp_stream": 36, "fields": { "dns.flags.response": "False", "dns.qry.name": "th.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-32dfd9f010491c02550fd404", "kind": "dns", "frame_number": 2564, "timestamp_epoch": "1725471398.493679000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 52408, "dst_port": 53, "tcp_stream": null, "udp_stream": 37, "fields": { "dns.flags.response": "False", "dns.qry.name": "th.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-ed53e52cc9ecbc9b042a0976", "kind": "dns", "frame_number": 2579, "timestamp_epoch": "1725471398.543132000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 56598, "tcp_stream": null, "udp_stream": 36, "fields": { "dns.a": "23.221.24.69,23.221.24.68,23.221.24.63,23.221.24.62,23.221.24.73,23.221.24.56,23.221.24.64,23.221.24.70,23.221.24.58", "dns.cname": "p-th.bing.com.trafficmanager.net,th.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "th.bing.com", "dns.qry.type": "1" } }, { "event_id": "evt-44523a3ceac468a40a3a584f", "kind": "dns", "frame_number": 2586, "timestamp_epoch": "1725471398.549060000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 50109, "dst_port": 53, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.flags.response": "False", "dns.qry.name": "img-s-msn-com.akamaized.net", "dns.qry.type": "1" } }, { "event_id": "evt-3acbe54cf0d44f4b521cf1c1", "kind": "dns", "frame_number": 2587, "timestamp_epoch": "1725471398.549143000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 56490, "dst_port": 53, "tcp_stream": null, "udp_stream": 39, "fields": { "dns.flags.response": "False", "dns.qry.name": "img-s-msn-com.akamaized.net", "dns.qry.type": "65" } }, { "event_id": "evt-d5cdbe139164558c0ee89846", "kind": "dns", "frame_number": 2595, "timestamp_epoch": "1725471398.581566000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 52408, "tcp_stream": null, "udp_stream": 37, "fields": { "dns.cname": "p-th.bing.com.trafficmanager.net,th.bing.com.edgekey.net,e86303.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "th.bing.com", "dns.qry.type": "65" } }, { "event_id": "evt-251801b02b1bc0277d916748", "kind": "dns", "frame_number": 2622, "timestamp_epoch": "1725471398.606869000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 50109, "tcp_stream": null, "udp_stream": 38, "fields": { "dns.a": "23.220.251.153,23.220.251.160", "dns.cname": "a1834.dscg2.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "img-s-msn-com.akamaized.net", "dns.qry.type": "1" } }, { "event_id": "evt-e92c17948f8f29ab6474a25a", "kind": "dns", "frame_number": 2625, "timestamp_epoch": "1725471398.624249000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 56490, "tcp_stream": null, "udp_stream": 39, "fields": { "dns.cname": "a1834.dscg2.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "img-s-msn-com.akamaized.net", "dns.qry.type": "65" } }, { "event_id": "evt-07f71ea486521c34e243cd23", "kind": "dns", "frame_number": 2966, "timestamp_epoch": "1725471405.244456000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 59001, "dst_port": 53, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-27cefea04d24028bf5af0900", "kind": "dns", "frame_number": 2967, "timestamp_epoch": "1725471405.244456000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 59001, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-3d4420153697e6b33262fb79", "kind": "dns", "frame_number": 2991, "timestamp_epoch": "1725471470.862325000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 59001, "dst_port": 53, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.WIN-CTL9XBQ9Y19.bepositive.com", "dns.qry.type": "33" } }, { "event_id": "evt-169ad574ba320151dacce005", "kind": "dns", "frame_number": 2992, "timestamp_epoch": "1725471470.862435000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 59001, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.WIN-CTL9XBQ9Y19.bepositive.com", "dns.qry.type": "33" } }, { "event_id": "evt-914572d3948c67d0e8d4d478", "kind": "dns", "frame_number": 2993, "timestamp_epoch": "1725471470.863044000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 59001, "dst_port": 53, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.WIN-CTL9XBQ9Y19.bepositive.com", "dns.qry.type": "33" } }, { "event_id": "evt-73aeedad0504bb051c825f1a", "kind": "dns", "frame_number": 2994, "timestamp_epoch": "1725471470.863044000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 59001, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.WIN-CTL9XBQ9Y19.bepositive.com", "dns.qry.type": "33" } }, { "event_id": "evt-967393da3eb0c2b7aef89c54", "kind": "dns", "frame_number": 3037, "timestamp_epoch": "1725471471.481874000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 59001, "dst_port": 53, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.flags.response": "False", "dns.qry.name": "fd.api.iris.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-adfc9c8709960bc3bda0c3cb", "kind": "dns", "frame_number": 3038, "timestamp_epoch": "1725471471.488905000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 59001, "tcp_stream": null, "udp_stream": 22, "fields": { "dns.a": "20.96.153.111", "dns.cname": "fd-api-iris.trafficmanager.net,iris-de-prod-azsc-v2-eus2.eastus2.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "fd.api.iris.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-58c8cc3808d918e6fb6bca20", "kind": "dns", "frame_number": 3089, "timestamp_epoch": "1725471576.751782000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 62118, "dst_port": 53, "tcp_stream": null, "udp_stream": 41, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.WIN-CTL9XBQ9Y19.bepositive.com", "dns.qry.type": "33" } }, { "event_id": "evt-040de68b32b67aa3acd115c4", "kind": "dns", "frame_number": 3090, "timestamp_epoch": "1725471576.751908000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 62118, "tcp_stream": null, "udp_stream": 41, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.WIN-CTL9XBQ9Y19.bepositive.com", "dns.qry.type": "33" } }, { "event_id": "evt-65d2d4330da034e1353d88eb", "kind": "dns", "frame_number": 3091, "timestamp_epoch": "1725471576.751986000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 62118, "dst_port": 53, "tcp_stream": null, "udp_stream": 41, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.WIN-CTL9XBQ9Y19.bepositive.com", "dns.qry.type": "33" } }, { "event_id": "evt-5afbafc334890329f83d356f", "kind": "dns", "frame_number": 3092, "timestamp_epoch": "1725471576.752615000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 62118, "tcp_stream": null, "udp_stream": 41, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.WIN-CTL9XBQ9Y19.bepositive.com", "dns.qry.type": "33" } }, { "event_id": "evt-25fa37b9caa4a78bfd754577", "kind": "dns", "frame_number": 3139, "timestamp_epoch": "1725471607.486570000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 62118, "tcp_stream": null, "udp_stream": 41, "fields": { "dns.a": "23.45.119.166,23.45.119.174", "dns.cname": "download.windowsupdate.com.delivery.microsoft.com,wu-f-net.trafficmanager.net,download.windowsupdate.com.edgesuite.net,a767.dspw65.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "download.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-06e0fafafeae5204ddec0cca", "kind": "dns", "frame_number": 3140, "timestamp_epoch": "1725471611.266882000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 63922, "dst_port": 53, "tcp_stream": null, "udp_stream": 42, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-43932424fb61dc227d0e838e", "kind": "dns", "frame_number": 3141, "timestamp_epoch": "1725471611.311344000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 63922, "tcp_stream": null, "udp_stream": 42, "fields": { "dns.a": "13.89.179.9", "dns.cname": "win-global-asimov-leafs-events-data.trafficmanager.net,onedscolprdcus09.centralus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-5edd1cfb0da3ee5292c44a40", "kind": "dns", "frame_number": 3203, "timestamp_epoch": "1725471761.511296000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 63922, "dst_port": 53, "tcp_stream": null, "udp_stream": 42, "fields": { "dns.flags.response": "False", "dns.qry.name": "storecatalogrevocation.storequality.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-0e9d8395f0be85c053860b70", "kind": "dns", "frame_number": 3204, "timestamp_epoch": "1725471761.523258000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 63922, "tcp_stream": null, "udp_stream": 42, "fields": { "dns.a": "23.194.68.140", "dns.cname": "storecatalogrevocation.storequality.microsoft.com.edgekey.net,e10198.b.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "storecatalogrevocation.storequality.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-74d6702eccf4e3e201ab358b", "kind": "dns", "frame_number": 3236, "timestamp_epoch": "1725471829.837424000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 64451, "dst_port": 53, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-7971dde45362370946c9f537", "kind": "dns", "frame_number": 3237, "timestamp_epoch": "1725471829.837424000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 63858, "dst_port": 53, "tcp_stream": null, "udp_stream": 43, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-9fa6ee95046a0645198587d8", "kind": "dns", "frame_number": 3238, "timestamp_epoch": "1725471829.837499000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 64451, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-5b35d8704ee8e0ad2bbe3741", "kind": "dns", "frame_number": 3239, "timestamp_epoch": "1725471829.838019000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 63858, "tcp_stream": null, "udp_stream": 43, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-1b08b8d15245e2bff6a1fcf7", "kind": "dns", "frame_number": 3259, "timestamp_epoch": "1725471852.356759000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 63858, "dst_port": 53, "tcp_stream": null, "udp_stream": 43, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-40a61dfe05b3036c83340266", "kind": "dns", "frame_number": 3260, "timestamp_epoch": "1725471852.361183000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 63858, "tcp_stream": null, "udp_stream": 43, "fields": { "dns.a": "20.189.173.26", "dns.cname": "win-global-asimov-leafs-events-data.trafficmanager.net,onedscolprdwus19.westus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-06f334117ef27b01e2decc67", "kind": "dns", "frame_number": 3304, "timestamp_epoch": "1725471878.252723000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 53122, "dst_port": 53, "tcp_stream": null, "udp_stream": 44, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.bepositive.com", "dns.qry.type": "33" } }, { "event_id": "evt-2ad492bd0d69fb365fb7af2d", "kind": "dns", "frame_number": 3305, "timestamp_epoch": "1725471878.253126000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 53122, "tcp_stream": null, "udp_stream": 44, "fields": { "dns.a": "172.17.0.17", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.bepositive.com", "dns.qry.type": "33" } }, { "event_id": "evt-f1671eaf3bf3d5b7fa441275", "kind": "dns", "frame_number": 3317, "timestamp_epoch": "1725471878.366416000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 53122, "dst_port": 53, "tcp_stream": null, "udp_stream": 44, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.bepositive.com", "dns.qry.type": "33" } }, { "event_id": "evt-6699bd0c19298e6dec259637", "kind": "dns", "frame_number": 3318, "timestamp_epoch": "1725471878.366739000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 53122, "tcp_stream": null, "udp_stream": 44, "fields": { "dns.a": "172.17.0.17", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.bepositive.com", "dns.qry.type": "33" } }, { "event_id": "evt-cf974bb3ec9542632c18bcdf", "kind": "dns", "frame_number": 3352, "timestamp_epoch": "1725471878.550055000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 53122, "dst_port": 53, "tcp_stream": null, "udp_stream": 44, "fields": { "dns.flags.response": "False", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-e9efc453f4e4a4f9a58e0e64", "kind": "dns", "frame_number": 3353, "timestamp_epoch": "1725471878.561381000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 53122, "tcp_stream": null, "udp_stream": 44, "fields": { "dns.a": "23.45.119.144,23.45.119.143", "dns.cname": "assets.msn.com.edgekey.net,e28578.d.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-5e588f8372a60bcb1cfe702a", "kind": "dns", "frame_number": 3389, "timestamp_epoch": "1725471938.548601000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 62045, "dst_port": 53, "tcp_stream": null, "udp_stream": 47, "fields": { "dns.flags.response": "False", "dns.qry.name": "weathermapdata.blob.core.windows.net", "dns.qry.type": "1" } }, { "event_id": "evt-80708d833780c3eda1db245a", "kind": "dns", "frame_number": 3390, "timestamp_epoch": "1725471938.579425000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 62045, "tcp_stream": null, "udp_stream": 47, "fields": { "dns.a": "20.60.228.1", "dns.cname": "blob.mwh03prdstf02a.store.core.windows.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "weathermapdata.blob.core.windows.net", "dns.qry.type": "1" } }, { "event_id": "evt-88b1864bf7e74d2c92d90524", "kind": "dns", "frame_number": 3435, "timestamp_epoch": "1725471995.444071000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 53686, "dst_port": 53, "tcp_stream": null, "udp_stream": 48, "fields": { "dns.flags.response": "False", "dns.qry.name": "acroipm2.adobe.com", "dns.qry.type": "1" } }, { "event_id": "evt-19b8015b5da54f30f81ff2d2", "kind": "dns", "frame_number": 3436, "timestamp_epoch": "1725471995.498031000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 53686, "tcp_stream": null, "udp_stream": 48, "fields": { "dns.a": "23.220.251.47,23.220.251.48", "dns.cname": "acroipm2.adobe.com.edgesuite.net,a122.dscd.akamai.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "acroipm2.adobe.com", "dns.qry.type": "1" } }, { "event_id": "evt-ba91faec99fe2518f453e0b4", "kind": "dns", "frame_number": 3445, "timestamp_epoch": "1725471996.162951000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 60417, "dst_port": 53, "tcp_stream": null, "udp_stream": 49, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-9f094b625d014b5d21ba3a99", "kind": "dns", "frame_number": 3446, "timestamp_epoch": "1725471996.162993000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 60417, "tcp_stream": null, "udp_stream": 49, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-0be28e12bba2189c8382a913", "kind": "dns", "frame_number": 3453, "timestamp_epoch": "1725472004.172794000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 60417, "dst_port": 53, "tcp_stream": null, "udp_stream": 49, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-755c6a470d0861c5d414b2e0", "kind": "dns", "frame_number": 3454, "timestamp_epoch": "1725472004.172794000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 60417, "tcp_stream": null, "udp_stream": 49, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-ffaa5e160fd56c7014e5e0fe", "kind": "dns", "frame_number": 3503, "timestamp_epoch": "1725472090.678222000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 60417, "dst_port": 53, "tcp_stream": null, "udp_stream": 49, "fields": { "dns.flags.response": "False", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-a9f63197222b3b8a396fd59c", "kind": "dns", "frame_number": 3504, "timestamp_epoch": "1725472090.716600000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 60417, "tcp_stream": null, "udp_stream": 49, "fields": { "dns.a": "23.45.119.143,23.45.119.144", "dns.cname": "assets.msn.com.edgekey.net,e28578.d.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-bab7ef5199018b90828e1e9c", "kind": "dns", "frame_number": 3620, "timestamp_epoch": "1725472175.849105000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 58869, "dst_port": 53, "tcp_stream": null, "udp_stream": 50, "fields": { "dns.flags.response": "False", "dns.qry.name": "login.microsoftonline.com", "dns.qry.type": "1" } }, { "event_id": "evt-163411ab92dfedebad626b41", "kind": "dns", "frame_number": 3621, "timestamp_epoch": "1725472175.894362000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 58869, "tcp_stream": null, "udp_stream": 50, "fields": { "dns.a": "40.126.28.22,40.126.28.20,20.190.135.2,40.126.28.21,40.126.28.23,40.126.28.11,40.126.28.19,40.126.7.32", "dns.cname": "login.mso.msidentity.com,ak.privatelink.msidentity.com,www.tm.ak.prd.aadg.trafficmanager.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "login.microsoftonline.com", "dns.qry.type": "1" } }, { "event_id": "evt-d916219608101b9236aebfe2", "kind": "dns", "frame_number": 3645, "timestamp_epoch": "1725472176.363115000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 55334, "dst_port": 53, "tcp_stream": null, "udp_stream": 51, "fields": { "dns.flags.response": "False", "dns.qry.name": "sso.godaddy.com", "dns.qry.type": "1" } }, { "event_id": "evt-279ef42ec57db04af16da7ed", "kind": "dns", "frame_number": 3647, "timestamp_epoch": "1725472176.384136000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 55334, "tcp_stream": null, "udp_stream": 51, "fields": { "dns.a": "23.195.212.189", "dns.cname": "sso.godaddy.com-v1.edgekey.net,e6225.x.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "sso.godaddy.com", "dns.qry.type": "1" } }, { "event_id": "evt-7992a6684431cc97f601d605", "kind": "dns", "frame_number": 3666, "timestamp_epoch": "1725472176.534461000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 56840, "dst_port": 53, "tcp_stream": null, "udp_stream": 52, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-80e79b72f14cb584a01a7c3f", "kind": "dns", "frame_number": 3667, "timestamp_epoch": "1725472176.569111000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 56840, "tcp_stream": null, "udp_stream": 52, "fields": { "dns.a": "20.189.173.1", "dns.cname": "win-global-asimov-leafs-events-data.trafficmanager.net,onedscolprdwus00.westus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-a4355627c3386288e8df1d97", "kind": "dns", "frame_number": 3683, "timestamp_epoch": "1725472176.753545000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 57455, "dst_port": 53, "tcp_stream": null, "udp_stream": 53, "fields": { "dns.flags.response": "False", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-6b24fdfaaf64523b4d73e528", "kind": "dns", "frame_number": 3691, "timestamp_epoch": "1725472176.784640000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 57455, "tcp_stream": null, "udp_stream": 53, "fields": { "dns.a": "40.119.249.228", "dns.cname": "atm-settingsfe-prod-geo2.trafficmanager.net,settings-prod-sea-2.southeastasia.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "settings-win.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-0e4d1c05ff0d11455e388272", "kind": "dns", "frame_number": 3803, "timestamp_epoch": "1725472296.389804000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 61207, "dst_port": 53, "tcp_stream": null, "udp_stream": 54, "fields": { "dns.flags.response": "False", "dns.qry.name": "windows.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-2ec6984af99173eff6f2f32d", "kind": "dns", "frame_number": 3804, "timestamp_epoch": "1725472296.427304000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 61207, "tcp_stream": null, "udp_stream": 54, "fields": { "dns.a": "204.79.197.203", "dns.cname": "www-msn-com.a-0003.a-msedge.net,a-0003.a-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "windows.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-5872828d284cb5fae40b071f", "kind": "dns", "frame_number": 3885, "timestamp_epoch": "1725472429.829170000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 64451, "dst_port": 53, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-b050556ea775b4409cc420cb", "kind": "dns", "frame_number": 3886, "timestamp_epoch": "1725472429.829170000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 49396, "dst_port": 53, "tcp_stream": null, "udp_stream": 55, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-b2e65780a306d09934abf98d", "kind": "dns", "frame_number": 3887, "timestamp_epoch": "1725472429.829740000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 64451, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-183d611237df6d4f90b2ea7b", "kind": "dns", "frame_number": 3888, "timestamp_epoch": "1725472429.829740000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 49396, "tcp_stream": null, "udp_stream": 55, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-0640b42981e3d410a108a826", "kind": "dns", "frame_number": 4034, "timestamp_epoch": "1725472805.175604000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 49396, "dst_port": 53, "tcp_stream": null, "udp_stream": 55, "fields": { "dns.flags.response": "False", "dns.qry.name": "mobile.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-270749a249412fefa9f1a5c9", "kind": "dns", "frame_number": 4035, "timestamp_epoch": "1725472805.204482000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 49396, "tcp_stream": null, "udp_stream": 55, "fields": { "dns.a": "20.189.173.18", "dns.cname": "mobile.events.data.trafficmanager.net,onedscolprdwus15.westus.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "mobile.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-4239e33856879861eb0a1bb2", "kind": "dns", "frame_number": 4077, "timestamp_epoch": "1725472852.139802000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 52096, "dst_port": 53, "tcp_stream": null, "udp_stream": 56, "fields": { "dns.flags.response": "False", "dns.qry.name": "ecs.office.com", "dns.qry.type": "1" } }, { "event_id": "evt-9a54146b2dd2bf53026ddc32", "kind": "dns", "frame_number": 4078, "timestamp_epoch": "1725472852.165472000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 52096, "tcp_stream": null, "udp_stream": 56, "fields": { "dns.a": "52.113.194.132", "dns.cname": "ecs.office.trafficmanager.net,s-0005-office.config.skype.com,ecs-office.s-0005.s-msedge.net,s-0005.s-msedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ecs.office.com", "dns.qry.type": "1" } }, { "event_id": "evt-c911c359010531d1f2c2c4d4", "kind": "dns", "frame_number": 4115, "timestamp_epoch": "1725472865.537171000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 53858, "dst_port": 53, "tcp_stream": null, "udp_stream": 57, "fields": { "dns.flags.response": "False", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-e038bc4319044df32f542f85", "kind": "dns", "frame_number": 4116, "timestamp_epoch": "1725472865.560513000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 53858, "tcp_stream": null, "udp_stream": 57, "fields": { "dns.a": "199.232.210.172,199.232.214.172", "dns.cname": "ctldl.windowsupdate.com.delivery.microsoft.com,wu-b-net.trafficmanager.net,bg.microsoft.map.fastly.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-1891d1454f228496264ae52b", "kind": "dns", "frame_number": 4226, "timestamp_epoch": "1725473029.804509000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 64451, "dst_port": 53, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-24b5d6c6c25741501cb53fea", "kind": "dns", "frame_number": 4227, "timestamp_epoch": "1725473029.804509000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 61567, "dst_port": 53, "tcp_stream": null, "udp_stream": 58, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-fdf0865d65da0325211bb5be", "kind": "dns", "frame_number": 4228, "timestamp_epoch": "1725473029.805065000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 61567, "tcp_stream": null, "udp_stream": 58, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-574b8509fbc9ba2c9a09404b", "kind": "dns", "frame_number": 4229, "timestamp_epoch": "1725473029.805065000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 64451, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-2cd3cefdc5f263ff9db24ca2", "kind": "dns", "frame_number": 4255, "timestamp_epoch": "1725473078.753638000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 61567, "dst_port": 53, "tcp_stream": null, "udp_stream": 58, "fields": { "dns.flags.response": "False", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-8da59ba5dc75618994d197f8", "kind": "dns", "frame_number": 4256, "timestamp_epoch": "1725473078.775806000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 61567, "tcp_stream": null, "udp_stream": 58, "fields": { "dns.a": "13.70.79.200", "dns.cname": "win-global-asimov-leafs-events-data.trafficmanager.net,onedscolprdaue01.australiaeast.cloudapp.azure.com", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "v10.events.data.microsoft.com", "dns.qry.type": "1" } }, { "event_id": "evt-b096430c3e31e0326872eea8", "kind": "dns", "frame_number": 4303, "timestamp_epoch": "1725473139.491801000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 50983, "dst_port": 53, "tcp_stream": null, "udp_stream": 59, "fields": { "dns.flags.response": "False", "dns.qry.name": "x1.c.lencr.org", "dns.qry.type": "1" } }, { "event_id": "evt-d6fc7994d1e2bf67a1ec3bd6", "kind": "dns", "frame_number": 4304, "timestamp_epoch": "1725473139.509498000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 50983, "tcp_stream": null, "udp_stream": 59, "fields": { "dns.a": "184.29.137.96", "dns.cname": "crl.root-x1.letsencrypt.org.edgekey.net,e8652.dscx.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "x1.c.lencr.org", "dns.qry.type": "1" } }, { "event_id": "evt-e4d33baaa7a8fef439a7e643", "kind": "dns", "frame_number": 4311, "timestamp_epoch": "1725473139.609153000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 53709, "dst_port": 53, "tcp_stream": null, "udp_stream": 60, "fields": { "dns.flags.response": "False", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-7076e7e66fad97d8e36f6bdb", "kind": "dns", "frame_number": 4312, "timestamp_epoch": "1725473139.609265000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 53709, "tcp_stream": null, "udp_stream": 60, "fields": { "dns.a": "199.232.214.172,199.232.210.172", "dns.cname": "ctldl.windowsupdate.com.delivery.microsoft.com,wu-b-net.trafficmanager.net,bg.microsoft.map.fastly.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "ctldl.windowsupdate.com", "dns.qry.type": "1" } }, { "event_id": "evt-c51729abde5b2d44e629a1cc", "kind": "dns", "frame_number": 4419, "timestamp_epoch": "1725473271.436327000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 64451, "dst_port": 53, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.flags.response": "False", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-d7aa6e6c9f67d6b9deaab899", "kind": "dns", "frame_number": 4420, "timestamp_epoch": "1725473271.491784000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 64451, "tcp_stream": null, "udp_stream": 12, "fields": { "dns.a": "131.107.255.255", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-2e5c0cb9244665cebc3bee9b", "kind": "dns", "frame_number": 4452, "timestamp_epoch": "1725473361.436836000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 55963, "dst_port": 53, "tcp_stream": null, "udp_stream": 61, "fields": { "dns.flags.response": "False", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-788725f2c3395621b6c3a2a6", "kind": "dns", "frame_number": 4453, "timestamp_epoch": "1725473361.448204000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 55963, "tcp_stream": null, "udp_stream": 61, "fields": { "dns.a": "131.107.255.255", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1" } }, { "event_id": "evt-bd58d031a7c03f92c01cd3df", "kind": "dns", "frame_number": 4549, "timestamp_epoch": "1725473582.020556000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 53709, "dst_port": 53, "tcp_stream": null, "udp_stream": 60, "fields": { "dns.flags.response": "False", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.bepositive.com", "dns.qry.type": "33" } }, { "event_id": "evt-00f4ed217766f7555060e371", "kind": "dns", "frame_number": 4550, "timestamp_epoch": "1725473582.020674000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 53709, "tcp_stream": null, "udp_stream": 60, "fields": { "dns.a": "172.17.0.17", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.bepositive.com", "dns.qry.type": "33" } }, { "event_id": "evt-2772900fff182372f65bfa74", "kind": "dns", "frame_number": 4631, "timestamp_epoch": "1725473629.795107000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 53709, "dst_port": 53, "tcp_stream": null, "udp_stream": 60, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-76a59d32b08149bef0529812", "kind": "dns", "frame_number": 4632, "timestamp_epoch": "1725473629.795107000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 56520, "dst_port": 53, "tcp_stream": null, "udp_stream": 64, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-7e10e6f85305c5b0d8ce9b62", "kind": "dns", "frame_number": 4633, "timestamp_epoch": "1725473629.795240000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 56520, "tcp_stream": null, "udp_stream": 64, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-e06cef453d487d337ab831c1", "kind": "dns", "frame_number": 4634, "timestamp_epoch": "1725473629.795240000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 53709, "tcp_stream": null, "udp_stream": 60, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-9703a1ec939191ca8ba33e34", "kind": "dns", "frame_number": 4695, "timestamp_epoch": "1725473809.467761000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 53709, "dst_port": 53, "tcp_stream": null, "udp_stream": 60, "fields": { "dns.flags.response": "False", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-58c44cd06b89e7f159024cf7", "kind": "dns", "frame_number": 4696, "timestamp_epoch": "1725473809.500722000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 53709, "tcp_stream": null, "udp_stream": 60, "fields": { "dns.a": "23.45.119.147,23.45.119.142,23.45.119.140,23.45.119.134,23.45.119.146,23.45.119.144", "dns.cname": "assets.msn.com.edgekey.net,e28578.d.akamaiedge.net", "dns.flags.rcode": "0", "dns.flags.response": "True", "dns.qry.name": "assets.msn.com", "dns.qry.type": "1" } }, { "event_id": "evt-207b0687d8d16a5ed7758fcf", "kind": "dns", "frame_number": 4880, "timestamp_epoch": "1725474229.786291000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 56520, "dst_port": 53, "tcp_stream": null, "udp_stream": 64, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-9c85a400303751437625cde7", "kind": "dns", "frame_number": 4881, "timestamp_epoch": "1725474229.786291000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 51415, "dst_port": 53, "tcp_stream": null, "udp_stream": 65, "fields": { "dns.flags.response": "False", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-00fd4f24ba2c48acf950e818", "kind": "dns", "frame_number": 4882, "timestamp_epoch": "1725474229.786354000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 56520, "tcp_stream": null, "udp_stream": 64, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } }, { "event_id": "evt-701561243e2c5f47ed5f9d3f", "kind": "dns", "frame_number": 4883, "timestamp_epoch": "1725474229.786887000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 53, "dst_port": 51415, "tcp_stream": null, "udp_stream": 65, "fields": { "dns.flags.rcode": "3", "dns.flags.response": "True", "dns.qry.name": "wpad.bepositive.com", "dns.qry.type": "1" } } ], "http_request": [ { "event_id": "evt-45fe6e7db5fb220a718b130d", "kind": "http_request", "frame_number": 52, "timestamp_epoch": "1725471151.936110000", "src_ip": "172.17.0.99", "dst_ip": "23.220.251.149", "src_port": 49766, "dst_port": 80, "tcp_stream": 1, "udp_stream": null, "fields": { "http.host": "www.msftconnecttest.com", "http.request.full_uri": "http://www.msftconnecttest.com/connecttest.txt", "http.request.method": "GET", "http.request.uri": "/connecttest.txt", "http.response_in": "54", "http.user_agent": "Microsoft NCSI" } }, { "event_id": "evt-a4d6bbcc10abd1a3e3161038", "kind": "http_request", "frame_number": 72, "timestamp_epoch": "1725471153.035136000", "src_ip": "172.17.0.99", "dst_ip": "23.220.251.158", "src_port": 49767, "dst_port": 80, "tcp_stream": 2, "udp_stream": null, "fields": { "http.host": "www.msftconnecttest.com", "http.request.full_uri": "http://www.msftconnecttest.com/connecttest.txt", "http.request.method": "GET", "http.request.uri": "/connecttest.txt", "http.response_in": "74", "http.user_agent": "Microsoft NCSI" } }, { "event_id": "evt-3abd13cdc9dea9d27b502ed1", "kind": "http_request", "frame_number": 1668, "timestamp_epoch": "1725471307.211814000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49813, "dst_port": 80, "tcp_stream": 48, "udp_stream": null, "fields": { "http.content_length": "94", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "1670", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-cb4738c8a8351fd51092f6e5", "kind": "http_request", "frame_number": 1672, "timestamp_epoch": "1725471307.858400000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49813, "dst_port": 80, "tcp_stream": 48, "udp_stream": null, "fields": { "http.content_length": "112", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "1695", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-7892ed6b5a0baa7d43d38c23", "kind": "http_request", "frame_number": 1697, "timestamp_epoch": "1725471308.684142000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49813, "dst_port": 80, "tcp_stream": 48, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "1700", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-864f23b8f03c198e26404553", "kind": "http_request", "frame_number": 2227, "timestamp_epoch": "1725471311.316859000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49816, "dst_port": 80, "tcp_stream": 51, "udp_stream": null, "fields": { "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/index.php?id=&subid=qIOuKk7U", "http.request.method": "GET", "http.request.uri": "/index.php?id=&subid=qIOuKk7U", "http.response_in": "2232" } }, { "event_id": "evt-2d7929a5047435d08023df6c", "kind": "http_request", "frame_number": 2236, "timestamp_epoch": "1725471312.546458000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49816, "dst_port": 80, "tcp_stream": 51, "udp_stream": null, "fields": { "http.content_length": "105", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/index.php", "http.request.method": "POST", "http.request.uri": "/index.php", "http.response_in": "2238" } }, { "event_id": "evt-0e58ad3242ed203cc307e0ca", "kind": "http_request", "frame_number": 2347, "timestamp_epoch": "1725471377.781476000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49821, "dst_port": 80, "tcp_stream": 56, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "2349", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-4949940156e890622fdbc4ce", "kind": "http_request", "frame_number": 2985, "timestamp_epoch": "1725471446.911862000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49828, "dst_port": 80, "tcp_stream": 63, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "2987", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-9f4eb8bc672dfa28a4db84a2", "kind": "http_request", "frame_number": 3077, "timestamp_epoch": "1725471516.062291000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49833, "dst_port": 80, "tcp_stream": 68, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "3079", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-28816f65e50d6f33dbf7fd32", "kind": "http_request", "frame_number": 3129, "timestamp_epoch": "1725471585.206401000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49836, "dst_port": 80, "tcp_stream": 71, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "3131", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-205e367562ec653b66f66cfb", "kind": "http_request", "frame_number": 3181, "timestamp_epoch": "1725471654.324762000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49840, "dst_port": 80, "tcp_stream": 73, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "3183", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-ccdcca50ebb1d5c925c069d9", "kind": "http_request", "frame_number": 3191, "timestamp_epoch": "1725471714.999064000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49840, "dst_port": 80, "tcp_stream": 73, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "3193", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-d4b40c71e2dc005f7dcd2c97", "kind": "http_request", "frame_number": 3232, "timestamp_epoch": "1725471775.696228000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49840, "dst_port": 80, "tcp_stream": 73, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "3234", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-80b89d4a55735313f50341e0", "kind": "http_request", "frame_number": 3251, "timestamp_epoch": "1725471836.836309000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49842, "dst_port": 80, "tcp_stream": 75, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "3253", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-67faacb2a1a8573e0047a912", "kind": "http_request", "frame_number": 3385, "timestamp_epoch": "1725471897.919897000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49850, "dst_port": 80, "tcp_stream": 83, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "3387", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-4f196b7b9007fff48961e781", "kind": "http_request", "frame_number": 3429, "timestamp_epoch": "1725471958.615189000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49850, "dst_port": 80, "tcp_stream": 83, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "3433", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-edfd60b47d883a2c8974a234", "kind": "http_request", "frame_number": 3440, "timestamp_epoch": "1725471995.543188000", "src_ip": "172.17.0.99", "dst_ip": "23.220.251.47", "src_port": 49852, "dst_port": 80, "tcp_stream": 85, "udp_stream": null, "fields": { "http.host": "acroipm2.adobe.com", "http.request.full_uri": "http://acroipm2.adobe.com/assets/Owner/arm/ProcessMAU.txt", "http.request.method": "GET", "http.request.uri": "/assets/Owner/arm/ProcessMAU.txt", "http.response_in": "3442", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-4100960bd2e42a6036354952", "kind": "http_request", "frame_number": 3464, "timestamp_epoch": "1725472019.697304000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49853, "dst_port": 80, "tcp_stream": 86, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "3466", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-fb3797483bf36074fcb0ff2b", "kind": "http_request", "frame_number": 3531, "timestamp_epoch": "1725472104.750554000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49856, "dst_port": 80, "tcp_stream": 89, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "3533", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-fbcd3fbf98f0b5b0300d2190", "kind": "http_request", "frame_number": 3772, "timestamp_epoch": "1725472189.873627000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49866, "dst_port": 80, "tcp_stream": 99, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "3774", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-794dfb3bfd90d12c0013b90d", "kind": "http_request", "frame_number": 3799, "timestamp_epoch": "1725472275.032276000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49867, "dst_port": 80, "tcp_stream": 100, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "3801", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-1e8175133e7ee707d61c8c60", "kind": "http_request", "frame_number": 3873, "timestamp_epoch": "1725472360.171010000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49870, "dst_port": 80, "tcp_stream": 103, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "3875", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-657c020f1a9346e47fee80b2", "kind": "http_request", "frame_number": 3908, "timestamp_epoch": "1725472450.320388000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49871, "dst_port": 80, "tcp_stream": 104, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "3911", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-663e4a34feb3a3ce1c0de93e", "kind": "http_request", "frame_number": 3962, "timestamp_epoch": "1725472540.401561000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49873, "dst_port": 80, "tcp_stream": 106, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "3964", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-e7ef56884802397423db8b55", "kind": "http_request", "frame_number": 3984, "timestamp_epoch": "1725472630.504776000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49874, "dst_port": 80, "tcp_stream": 107, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "3986", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-101cd2d56c1c4a856365f790", "kind": "http_request", "frame_number": 4011, "timestamp_epoch": "1725472720.632883000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49875, "dst_port": 80, "tcp_stream": 108, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "4014", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-fdbc91201d74898cf7c3f8d2", "kind": "http_request", "frame_number": 4064, "timestamp_epoch": "1725472806.765839000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49877, "dst_port": 80, "tcp_stream": 110, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "4067", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-46f505f4519f6626f8f8a113", "kind": "http_request", "frame_number": 4120, "timestamp_epoch": "1725472865.606024000", "src_ip": "172.17.0.99", "dst_ip": "199.232.210.172", "src_port": 49879, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "http.host": "ctldl.windowsupdate.com", "http.request.full_uri": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?d7a8a57aa5acd39b", "http.request.method": "GET", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab?d7a8a57aa5acd39b", "http.response_in": "4122", "http.user_agent": "Microsoft-CryptoAPI/10.0" } }, { "event_id": "evt-1edb6b8e77873c3bc30d927b", "kind": "http_request", "frame_number": 4123, "timestamp_epoch": "1725472865.665480000", "src_ip": "172.17.0.99", "dst_ip": "199.232.210.172", "src_port": 49879, "dst_port": 80, "tcp_stream": 112, "udp_stream": null, "fields": { "http.host": "ctldl.windowsupdate.com", "http.request.full_uri": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?91717f420e6dda94", "http.request.method": "GET", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?91717f420e6dda94", "http.response_in": "4125", "http.user_agent": "Microsoft-CryptoAPI/10.0" } }, { "event_id": "evt-d01ddbe87be518729abff78a", "kind": "http_request", "frame_number": 4135, "timestamp_epoch": "1725472892.834551000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49880, "dst_port": 80, "tcp_stream": 113, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "4137", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-78656c65182f5ba958efc144", "kind": "http_request", "frame_number": 4214, "timestamp_epoch": "1725472978.902877000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49883, "dst_port": 80, "tcp_stream": 116, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "4216", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-c5e6d11fae90d4a8c38b05d5", "kind": "http_request", "frame_number": 4247, "timestamp_epoch": "1725473065.026600000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49884, "dst_port": 80, "tcp_stream": 117, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "4250", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-151ecca3a10baa4c0b05f108", "kind": "http_request", "frame_number": 4308, "timestamp_epoch": "1725473139.549530000", "src_ip": "172.17.0.99", "dst_ip": "184.29.137.96", "src_port": 49886, "dst_port": 80, "tcp_stream": 119, "udp_stream": null, "fields": { "http.host": "x1.c.lencr.org", "http.request.full_uri": "http://x1.c.lencr.org/", "http.request.method": "GET", "http.request.uri": "/", "http.response_in": "4310", "http.user_agent": "Microsoft-CryptoAPI/10.0" } }, { "event_id": "evt-547b0b49f12618fb0e6e46c7", "kind": "http_request", "frame_number": 4317, "timestamp_epoch": "1725473139.654458000", "src_ip": "172.17.0.99", "dst_ip": "199.232.214.172", "src_port": 49887, "dst_port": 80, "tcp_stream": 120, "udp_stream": null, "fields": { "http.host": "ctldl.windowsupdate.com", "http.request.full_uri": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?a5fef2ac8502b132", "http.request.method": "GET", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?a5fef2ac8502b132", "http.response_in": "4319", "http.user_agent": "Microsoft-CryptoAPI/10.0" } }, { "event_id": "evt-295fd3c26ed5379120cd7c3e", "kind": "http_request", "frame_number": 4330, "timestamp_epoch": "1725473153.133865000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49888, "dst_port": 80, "tcp_stream": 121, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "4336", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-459434ce8bea4bbe8c62207a", "kind": "http_request", "frame_number": 4402, "timestamp_epoch": "1725473242.405323000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49890, "dst_port": 80, "tcp_stream": 123, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "4405", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-44b19ee011868ffac16a5097", "kind": "http_request", "frame_number": 4440, "timestamp_epoch": "1725473330.470020000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49891, "dst_port": 80, "tcp_stream": 124, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "4443", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-8f7d086b4053bd8e6b1dfd44", "kind": "http_request", "frame_number": 4477, "timestamp_epoch": "1725473418.609257000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49892, "dst_port": 80, "tcp_stream": 125, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "4479", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-9957bf9372be60a87b00f605", "kind": "http_request", "frame_number": 4499, "timestamp_epoch": "1725473496.778262000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49893, "dst_port": 80, "tcp_stream": 126, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "4501", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-0df5c85027c9a7bdcf4dbe8e", "kind": "http_request", "frame_number": 4545, "timestamp_epoch": "1725473574.825234000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49895, "dst_port": 80, "tcp_stream": 128, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "4547", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-08243a5162f14c4074be116d", "kind": "http_request", "frame_number": 4653, "timestamp_epoch": "1725473653.888797000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49900, "dst_port": 80, "tcp_stream": 133, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "4655", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-ae293f320dbfdec84885fdcb", "kind": "http_request", "frame_number": 4671, "timestamp_epoch": "1725473731.986370000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49901, "dst_port": 80, "tcp_stream": 134, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "4673", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-a806848538c479e63e5671b8", "kind": "http_request", "frame_number": 4691, "timestamp_epoch": "1725473807.300640000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49902, "dst_port": 80, "tcp_stream": 135, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "4693", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-ebea4a85a3f8c5e68a6c7ba0", "kind": "http_request", "frame_number": 4786, "timestamp_epoch": "1725473881.418761000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49906, "dst_port": 80, "tcp_stream": 139, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "4788", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-d389284c01baecb1fb631754", "kind": "http_request", "frame_number": 4811, "timestamp_epoch": "1725473955.568280000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49907, "dst_port": 80, "tcp_stream": 140, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "4813", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-9847ae61ed069c6b13a29ac1", "kind": "http_request", "frame_number": 4832, "timestamp_epoch": "1725474029.695712000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49908, "dst_port": 80, "tcp_stream": 141, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "4836", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-0c93818ebe35c079233bf5e9", "kind": "http_request", "frame_number": 4854, "timestamp_epoch": "1725474103.799656000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49909, "dst_port": 80, "tcp_stream": 142, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "4856", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-5358bcb995e42dbb4dd4b212", "kind": "http_request", "frame_number": 4876, "timestamp_epoch": "1725474175.903686000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49910, "dst_port": 80, "tcp_stream": 143, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "4878", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-a99919ecb8d387a45cacaa53", "kind": "http_request", "frame_number": 4904, "timestamp_epoch": "1725474248.045044000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49911, "dst_port": 80, "tcp_stream": 144, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "4906", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-ef4d0cd8236b6daedceb5488", "kind": "http_request", "frame_number": 4921, "timestamp_epoch": "1725474320.202713000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49912, "dst_port": 80, "tcp_stream": 145, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "4923", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-d37c5167c2015e56955a60a5", "kind": "http_request", "frame_number": 4943, "timestamp_epoch": "1725474392.348254000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49913, "dst_port": 80, "tcp_stream": 146, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "4945", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-bef5f1bf8e0af9df2dbaf24b", "kind": "http_request", "frame_number": 4959, "timestamp_epoch": "1725474464.546934000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49914, "dst_port": 80, "tcp_stream": 147, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "4961", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-f874355bec950f2ae413f141", "kind": "http_request", "frame_number": 4974, "timestamp_epoch": "1725474526.700596000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49915, "dst_port": 80, "tcp_stream": 148, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "4976", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-0303a7703836db79cbc22f13", "kind": "http_request", "frame_number": 4987, "timestamp_epoch": "1725474588.843962000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49916, "dst_port": 80, "tcp_stream": 149, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "4989", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-c8fc7fe43fb4302b33fb51c2", "kind": "http_request", "frame_number": 5032, "timestamp_epoch": "1725474650.997683000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49918, "dst_port": 80, "tcp_stream": 151, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "5034", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } }, { "event_id": "evt-dc1062701fb4aed34e9cf5f6", "kind": "http_request", "frame_number": 5077, "timestamp_epoch": "1725474713.072428000", "src_ip": "172.17.0.99", "dst_ip": "79.124.78.197", "src_port": 49921, "dst_port": 80, "tcp_stream": 154, "udp_stream": null, "fields": { "http.content_length": "40", "http.host": "79.124.78.197", "http.request.full_uri": "http://79.124.78.197/foots.php", "http.request.method": "POST", "http.request.uri": "/foots.php", "http.response_in": "5082", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)" } } ], "http_response": [ { "event_id": "evt-abb32f29c2304c394fe02853", "kind": "http_response", "frame_number": 54, "timestamp_epoch": "1725471151.990076000", "src_ip": "23.220.251.149", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49766, "tcp_stream": 1, "udp_stream": null, "fields": { "http.content_length": "22", "http.content_type": "text/plain", "http.request_in": "52", "http.response.code": "200" } }, { "event_id": "evt-95dd87aaadcaa3f25290b4e9", "kind": "http_response", "frame_number": 74, "timestamp_epoch": "1725471153.085891000", "src_ip": "23.220.251.158", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49767, "tcp_stream": 2, "udp_stream": null, "fields": { "http.content_length": "22", "http.content_type": "text/plain", "http.request_in": "72", "http.response.code": "200" } }, { "event_id": "evt-34c3180e8f7fe91bee0c7b9e", "kind": "http_response", "frame_number": 1670, "timestamp_epoch": "1725471307.856792000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49813, "tcp_stream": 48, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "1668", "http.response.code": "200" } }, { "event_id": "evt-19d39e0ecede0db65d738505", "kind": "http_response", "frame_number": 1695, "timestamp_epoch": "1725471308.592324000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49813, "tcp_stream": 48, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "1672", "http.response.code": "200" } }, { "event_id": "evt-d89c3e6f19c2cc0d6abf0b1f", "kind": "http_response", "frame_number": 1700, "timestamp_epoch": "1725471309.342839000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49813, "tcp_stream": 48, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "1697", "http.response.code": "200" } }, { "event_id": "evt-46cf286cc35f761deb0887d9", "kind": "http_response", "frame_number": 2232, "timestamp_epoch": "1725471311.971711000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49816, "tcp_stream": 51, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "2227", "http.response.code": "200" } }, { "event_id": "evt-fcff7a01e559ac13fd3232e4", "kind": "http_response", "frame_number": 2238, "timestamp_epoch": "1725471313.222746000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49816, "tcp_stream": 51, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "2236", "http.response.code": "200" } }, { "event_id": "evt-4937c61daa7c218c37d53e77", "kind": "http_response", "frame_number": 2349, "timestamp_epoch": "1725471378.480466000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49821, "tcp_stream": 56, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "2347", "http.response.code": "200" } }, { "event_id": "evt-a8d3f4b247fa658227bf91c8", "kind": "http_response", "frame_number": 2987, "timestamp_epoch": "1725471447.616271000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49828, "tcp_stream": 63, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "2985", "http.response.code": "200" } }, { "event_id": "evt-a8639387447027097d33735a", "kind": "http_response", "frame_number": 3079, "timestamp_epoch": "1725471516.767874000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49833, "tcp_stream": 68, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "3077", "http.response.code": "200" } }, { "event_id": "evt-234b808cfb84af60e761f40a", "kind": "http_response", "frame_number": 3131, "timestamp_epoch": "1725471585.916311000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49836, "tcp_stream": 71, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "3129", "http.response.code": "200" } }, { "event_id": "evt-5c69ed607da5bd1188a464d1", "kind": "http_response", "frame_number": 3183, "timestamp_epoch": "1725471654.999752000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49840, "tcp_stream": 73, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "3181", "http.response.code": "200" } }, { "event_id": "evt-fe336a869bf2749cf3f0d27c", "kind": "http_response", "frame_number": 3193, "timestamp_epoch": "1725471715.694526000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49840, "tcp_stream": 73, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "3191", "http.response.code": "200" } }, { "event_id": "evt-a6285706d72484e8df6d9126", "kind": "http_response", "frame_number": 3234, "timestamp_epoch": "1725471776.392401000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49840, "tcp_stream": 73, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "3232", "http.response.code": "200" } }, { "event_id": "evt-befc783f43091e3a79720d3c", "kind": "http_response", "frame_number": 3253, "timestamp_epoch": "1725471837.527052000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49842, "tcp_stream": 75, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "3251", "http.response.code": "200" } }, { "event_id": "evt-7d2d5af3c6dff47ba847ed93", "kind": "http_response", "frame_number": 3387, "timestamp_epoch": "1725471898.615588000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49850, "tcp_stream": 83, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "3385", "http.response.code": "200" } }, { "event_id": "evt-0611eaab9b184608a6136070", "kind": "http_response", "frame_number": 3433, "timestamp_epoch": "1725471959.303389000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49850, "tcp_stream": 83, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "3429", "http.response.code": "200" } }, { "event_id": "evt-b054c4d9475420f2f50a7098", "kind": "http_response", "frame_number": 3442, "timestamp_epoch": "1725471995.587848000", "src_ip": "23.220.251.47", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49852, "tcp_stream": 85, "udp_stream": null, "fields": { "http.content_length": "4", "http.content_type": "text/plain; charset=UTF-8", "http.request_in": "3440", "http.response.code": "200" } }, { "event_id": "evt-33a16eb0418611fada5ecc46", "kind": "http_response", "frame_number": 3466, "timestamp_epoch": "1725472020.355059000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49853, "tcp_stream": 86, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "3464", "http.response.code": "200" } }, { "event_id": "evt-1d439df281c9294c5632dc18", "kind": "http_response", "frame_number": 3533, "timestamp_epoch": "1725472105.420305000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49856, "tcp_stream": 89, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "3531", "http.response.code": "200" } }, { "event_id": "evt-b78819f8b87d1abe56076ac2", "kind": "http_response", "frame_number": 3774, "timestamp_epoch": "1725472190.573922000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49866, "tcp_stream": 99, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "3772", "http.response.code": "200" } }, { "event_id": "evt-b5f22caee6c25bab4376e908", "kind": "http_response", "frame_number": 3801, "timestamp_epoch": "1725472275.731881000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49867, "tcp_stream": 100, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "3799", "http.response.code": "200" } }, { "event_id": "evt-95d04b1aab80b9c4bbc3f14a", "kind": "http_response", "frame_number": 3875, "timestamp_epoch": "1725472360.875296000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49870, "tcp_stream": 103, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "3873", "http.response.code": "200" } }, { "event_id": "evt-43b084ab755c5226fea98688", "kind": "http_response", "frame_number": 3911, "timestamp_epoch": "1725472450.988295000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49871, "tcp_stream": 104, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "3908", "http.response.code": "200" } }, { "event_id": "evt-653992ed0ba94a53f479e0ae", "kind": "http_response", "frame_number": 3964, "timestamp_epoch": "1725472541.067604000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49873, "tcp_stream": 106, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "3962", "http.response.code": "200" } }, { "event_id": "evt-aad81308567d1785a13125f0", "kind": "http_response", "frame_number": 3986, "timestamp_epoch": "1725472631.209733000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49874, "tcp_stream": 107, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "3984", "http.response.code": "200" } }, { "event_id": "evt-afb9526784c42b5053140cc8", "kind": "http_response", "frame_number": 4014, "timestamp_epoch": "1725472721.303585000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49875, "tcp_stream": 108, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "4011", "http.response.code": "200" } }, { "event_id": "evt-42cd64e4c62dcea8bfb6074c", "kind": "http_response", "frame_number": 4067, "timestamp_epoch": "1725472807.436548000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49877, "tcp_stream": 110, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "4064", "http.response.code": "200" } }, { "event_id": "evt-d9e520c92d554318855fddfd", "kind": "http_response", "frame_number": 4122, "timestamp_epoch": "1725472865.654122000", "src_ip": "199.232.210.172", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49879, "tcp_stream": 112, "udp_stream": null, "fields": { "http.request_in": "4120", "http.response.code": "304" } }, { "event_id": "evt-28ee1c8629a3723209fa0191", "kind": "http_response", "frame_number": 4125, "timestamp_epoch": "1725472865.710753000", "src_ip": "199.232.210.172", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49879, "tcp_stream": 112, "udp_stream": null, "fields": { "http.request_in": "4123", "http.response.code": "304" } }, { "event_id": "evt-9f6d912bd53a101af2d61df6", "kind": "http_response", "frame_number": 4137, "timestamp_epoch": "1725472893.524328000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49880, "tcp_stream": 113, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "4135", "http.response.code": "200" } }, { "event_id": "evt-d6b61d23094cbbc56436a531", "kind": "http_response", "frame_number": 4216, "timestamp_epoch": "1725472979.597285000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49883, "tcp_stream": 116, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "4214", "http.response.code": "200" } }, { "event_id": "evt-cb4369d43cffac66da5fe832", "kind": "http_response", "frame_number": 4250, "timestamp_epoch": "1725473065.715570000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49884, "tcp_stream": 117, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "4247", "http.response.code": "200" } }, { "event_id": "evt-d42ad12d8cd5b8c276fba180", "kind": "http_response", "frame_number": 4310, "timestamp_epoch": "1725473139.595271000", "src_ip": "184.29.137.96", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49886, "tcp_stream": 119, "udp_stream": null, "fields": { "http.content_type": "application/pkix-crl", "http.request_in": "4308", "http.response.code": "304" } }, { "event_id": "evt-4fad5cf322aaac14b212aabb", "kind": "http_response", "frame_number": 4319, "timestamp_epoch": "1725473139.691782000", "src_ip": "199.232.214.172", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49887, "tcp_stream": 120, "udp_stream": null, "fields": { "http.request_in": "4317", "http.response.code": "304" } }, { "event_id": "evt-ac89bd1b3cd1ee3de1dd9c47", "kind": "http_response", "frame_number": 4336, "timestamp_epoch": "1725473155.033842000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49888, "tcp_stream": 121, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "4330", "http.response.code": "200" } }, { "event_id": "evt-849fb83954decd880cd6950c", "kind": "http_response", "frame_number": 4405, "timestamp_epoch": "1725473243.035058000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49890, "tcp_stream": 123, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "4402", "http.response.code": "200" } }, { "event_id": "evt-c2dced7a75d63457272c6ae2", "kind": "http_response", "frame_number": 4443, "timestamp_epoch": "1725473331.178158000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49891, "tcp_stream": 124, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "4440", "http.response.code": "200" } }, { "event_id": "evt-05964b89a769bd6c644773f8", "kind": "http_response", "frame_number": 4479, "timestamp_epoch": "1725473419.328267000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49892, "tcp_stream": 125, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "4477", "http.response.code": "200" } }, { "event_id": "evt-bd611903154eabfe40c50b8c", "kind": "http_response", "frame_number": 4501, "timestamp_epoch": "1725473497.426562000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49893, "tcp_stream": 126, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "4499", "http.response.code": "200" } }, { "event_id": "evt-87f7bacb1384b45b4be13c6e", "kind": "http_response", "frame_number": 4547, "timestamp_epoch": "1725473576.509970000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49895, "tcp_stream": 128, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "4545", "http.response.code": "200" } }, { "event_id": "evt-3bffe3ca6013769ed0f6d90b", "kind": "http_response", "frame_number": 4655, "timestamp_epoch": "1725473654.551329000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49900, "tcp_stream": 133, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "4653", "http.response.code": "200" } }, { "event_id": "evt-ad4fcfc8809a90cdf9791748", "kind": "http_response", "frame_number": 4673, "timestamp_epoch": "1725473733.857283000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49901, "tcp_stream": 134, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "4671", "http.response.code": "200" } }, { "event_id": "evt-a99ac4bbc42abf4eb7fb39ee", "kind": "http_response", "frame_number": 4693, "timestamp_epoch": "1725473807.950414000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49902, "tcp_stream": 135, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "4691", "http.response.code": "200" } }, { "event_id": "evt-9e8c11442326dd29e5b869d8", "kind": "http_response", "frame_number": 4788, "timestamp_epoch": "1725473882.118900000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49906, "tcp_stream": 139, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "4786", "http.response.code": "200" } }, { "event_id": "evt-5104784838ee3163666b8513", "kind": "http_response", "frame_number": 4813, "timestamp_epoch": "1725473956.242360000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49907, "tcp_stream": 140, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "4811", "http.response.code": "200" } }, { "event_id": "evt-c4fe63bdf4092bc04671ff99", "kind": "http_response", "frame_number": 4836, "timestamp_epoch": "1725474030.406811000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49908, "tcp_stream": 141, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "4832", "http.response.code": "200" } }, { "event_id": "evt-c2ae5fab71833c19f1978607", "kind": "http_response", "frame_number": 4856, "timestamp_epoch": "1725474104.472147000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49909, "tcp_stream": 142, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "4854", "http.response.code": "200" } }, { "event_id": "evt-28da7be452ef54376ca36037", "kind": "http_response", "frame_number": 4878, "timestamp_epoch": "1725474176.612762000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49910, "tcp_stream": 143, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "4876", "http.response.code": "200" } }, { "event_id": "evt-37fceea7366c8f035a1f3006", "kind": "http_response", "frame_number": 4906, "timestamp_epoch": "1725474248.751404000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49911, "tcp_stream": 144, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "4904", "http.response.code": "200" } }, { "event_id": "evt-d86a74b32f90aa51d88bf8e9", "kind": "http_response", "frame_number": 4923, "timestamp_epoch": "1725474320.909635000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49912, "tcp_stream": 145, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "4921", "http.response.code": "200" } }, { "event_id": "evt-f68f02aff088404ab1f1b7ae", "kind": "http_response", "frame_number": 4945, "timestamp_epoch": "1725474393.073245000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49913, "tcp_stream": 146, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "4943", "http.response.code": "200" } }, { "event_id": "evt-78ac739da57c48a8e1fd402f", "kind": "http_response", "frame_number": 4961, "timestamp_epoch": "1725474465.251649000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49914, "tcp_stream": 147, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "4959", "http.response.code": "200" } }, { "event_id": "evt-d37fa84cd1d886ae5dea51f4", "kind": "http_response", "frame_number": 4976, "timestamp_epoch": "1725474527.400491000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49915, "tcp_stream": 148, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "4974", "http.response.code": "200" } }, { "event_id": "evt-47270d956bb2d979302e44a5", "kind": "http_response", "frame_number": 4989, "timestamp_epoch": "1725474589.559311000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49916, "tcp_stream": 149, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "4987", "http.response.code": "200" } }, { "event_id": "evt-db847eaac755439a28cc16e7", "kind": "http_response", "frame_number": 5034, "timestamp_epoch": "1725474651.688579000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49918, "tcp_stream": 151, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "5032", "http.response.code": "200" } }, { "event_id": "evt-b539f52ecced2f3ad965d35f", "kind": "http_response", "frame_number": 5082, "timestamp_epoch": "1725474715.927104000", "src_ip": "79.124.78.197", "dst_ip": "172.17.0.99", "src_port": 80, "dst_port": 49921, "tcp_stream": 154, "udp_stream": null, "fields": { "http.content_type": "text/html; charset=UTF-8", "http.request_in": "5077", "http.response.code": "200" } } ], "tls_client_hello": [ { "event_id": "evt-b08a5b687dc5407a0c907158", "kind": "tls_client_hello", "frame_number": 188, "timestamp_epoch": "1725471223.016189000", "src_ip": "172.17.0.99", "dst_ip": "20.10.31.115", "src_port": 49771, "dst_port": 443, "tcp_stream": 6, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "client.wns.windows.com", "tls.handshake.ja3": "6a5d235ee78c6aede6a61448b4e9ff1e" } }, { "event_id": "evt-0874948b86490e14a8efc953", "kind": "tls_client_hello", "frame_number": 248, "timestamp_epoch": "1725471255.785470000", "src_ip": "172.17.0.99", "dst_ip": "20.42.73.28", "src_port": 49773, "dst_port": 443, "tcp_stream": 8, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-cb6f78d5c6e6daed3397701d", "kind": "tls_client_hello", "frame_number": 504, "timestamp_epoch": "1725471275.925719000", "src_ip": "172.17.0.99", "dst_ip": "23.221.24.58", "src_port": 49787, "dst_port": 443, "tcp_stream": 22, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-5fc036815872faf78ffb2d5a", "kind": "tls_client_hello", "frame_number": 538, "timestamp_epoch": "1725471276.135988000", "src_ip": "172.17.0.99", "dst_ip": "23.45.119.144", "src_port": 49789, "dst_port": 443, "tcp_stream": 24, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-7258f08420e11d064e8a6af2", "kind": "tls_client_hello", "frame_number": 539, "timestamp_epoch": "1725471276.136172000", "src_ip": "172.17.0.99", "dst_ip": "23.45.119.144", "src_port": 49788, "dst_port": 443, "tcp_stream": 23, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-cc7489a42ea74b6ed2cc1787", "kind": "tls_client_hello", "frame_number": 579, "timestamp_epoch": "1725471276.414787000", "src_ip": "172.17.0.99", "dst_ip": "20.96.153.111", "src_port": 49790, "dst_port": 443, "tcp_stream": 25, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "arc.msn.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-7c331d231d799a92e5ef18d4", "kind": "tls_client_hello", "frame_number": 614, "timestamp_epoch": "1725471276.750506000", "src_ip": "172.17.0.99", "dst_ip": "204.79.197.203", "src_port": 49791, "dst_port": 443, "tcp_stream": 26, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.msn.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-043a6c46d1e6113632fbd58b", "kind": "tls_client_hello", "frame_number": 619, "timestamp_epoch": "1725471276.816165000", "src_ip": "172.17.0.99", "dst_ip": "204.79.197.203", "src_port": 49791, "dst_port": 443, "tcp_stream": 26, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.msn.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-87d7a4671c271dfee1299326", "kind": "tls_client_hello", "frame_number": 623, "timestamp_epoch": "1725471276.854367000", "src_ip": "172.17.0.99", "dst_ip": "23.221.24.58", "src_port": 49792, "dst_port": 443, "tcp_stream": 27, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bing.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-61e52ad2ac99b0387dd6ece2", "kind": "tls_client_hello", "frame_number": 811, "timestamp_epoch": "1725471277.238241000", "src_ip": "172.17.0.99", "dst_ip": "23.45.119.144", "src_port": 49793, "dst_port": 443, "tcp_stream": 28, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-63c16d3dceafda7e2910d462", "kind": "tls_client_hello", "frame_number": 830, "timestamp_epoch": "1725471277.289574000", "src_ip": "172.17.0.99", "dst_ip": "52.109.0.91", "src_port": 49794, "dst_port": 443, "tcp_stream": 29, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "officeclient.microsoft.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-cdb6be5e2b921f77950d76b7", "kind": "tls_client_hello", "frame_number": 890, "timestamp_epoch": "1725471277.953848000", "src_ip": "172.17.0.99", "dst_ip": "52.109.0.142", "src_port": 49795, "dst_port": 443, "tcp_stream": 30, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "odc.officeapps.live.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-48aa2d660cd332267de75d1d", "kind": "tls_client_hello", "frame_number": 1056, "timestamp_epoch": "1725471280.054518000", "src_ip": "172.17.0.99", "dst_ip": "20.241.44.114", "src_port": 49797, "dst_port": 443, "tcp_stream": 32, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "g.live.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-f3fdeca11989a0ac12eced52", "kind": "tls_client_hello", "frame_number": 1147, "timestamp_epoch": "1725471280.228480000", "src_ip": "172.17.0.99", "dst_ip": "40.126.28.12", "src_port": 49802, "dst_port": 443, "tcp_stream": 37, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.microsoftonline.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-74ca0c116b48543688fb6192", "kind": "tls_client_hello", "frame_number": 1153, "timestamp_epoch": "1725471280.314863000", "src_ip": "172.17.0.99", "dst_ip": "40.126.28.12", "src_port": 49802, "dst_port": 443, "tcp_stream": 37, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.microsoftonline.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-e05ddaec4ad90dcc68e28746", "kind": "tls_client_hello", "frame_number": 1158, "timestamp_epoch": "1725471280.373568000", "src_ip": "172.17.0.99", "dst_ip": "23.40.145.142", "src_port": 49803, "dst_port": 443, "tcp_stream": 38, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "oneclient.sfx.ms", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-65c3ad33f5dd2175afe99777", "kind": "tls_client_hello", "frame_number": 1203, "timestamp_epoch": "1725471280.627094000", "src_ip": "172.17.0.99", "dst_ip": "23.195.212.189", "src_port": 49804, "dst_port": 443, "tcp_stream": 39, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "sso.godaddy.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-89e1e560e0eba5b573a4052b", "kind": "tls_client_hello", "frame_number": 1249, "timestamp_epoch": "1725471296.753410000", "src_ip": "172.17.0.99", "dst_ip": "13.107.246.57", "src_port": 49805, "dst_port": 443, "tcp_stream": 40, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "inputsuggestions.msdxcdn.microsoft.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-510410e0157c8ec16537a857", "kind": "tls_client_hello", "frame_number": 1253, "timestamp_epoch": "1725471296.788447000", "src_ip": "172.17.0.99", "dst_ip": "13.107.246.57", "src_port": 49805, "dst_port": 443, "tcp_stream": 40, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "inputsuggestions.msdxcdn.microsoft.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-55d214162e9b009841518297", "kind": "tls_client_hello", "frame_number": 1279, "timestamp_epoch": "1725471304.852343000", "src_ip": "172.17.0.99", "dst_ip": "46.254.34.201", "src_port": 49806, "dst_port": 443, "tcp_stream": 41, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bellantonicioccolato.it", "tls.handshake.ja3": "3c4eb72b882d4d1442c67ce73f1292a9" } }, { "event_id": "evt-4b2aa4f3b7667aed9cae8b33", "kind": "tls_client_hello", "frame_number": 1533, "timestamp_epoch": "1725471306.398391000", "src_ip": "172.17.0.99", "dst_ip": "40.126.28.12", "src_port": 49811, "dst_port": 443, "tcp_stream": 46, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.microsoftonline.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-cd229f5a71cac9dcd89e291f", "kind": "tls_client_hello", "frame_number": 1549, "timestamp_epoch": "1725471306.485925000", "src_ip": "172.17.0.99", "dst_ip": "40.126.28.12", "src_port": 49811, "dst_port": 443, "tcp_stream": 46, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.microsoftonline.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-c2d41f612fd1f0f37d8a54d8", "kind": "tls_client_hello", "frame_number": 1635, "timestamp_epoch": "1725471306.787464000", "src_ip": "172.17.0.99", "dst_ip": "23.195.212.189", "src_port": 49812, "dst_port": 443, "tcp_stream": 47, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "sso.godaddy.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-043466ab4144d84f9f0ff95c", "kind": "tls_client_hello", "frame_number": 1704, "timestamp_epoch": "1725471309.448825000", "src_ip": "172.17.0.99", "dst_ip": "46.254.34.201", "src_port": 49815, "dst_port": 443, "tcp_stream": 50, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.bellantonicioccolato.it", "tls.handshake.ja3": "3c4eb72b882d4d1442c67ce73f1292a9" } }, { "event_id": "evt-0b4d489f44a67e261b45c979", "kind": "tls_client_hello", "frame_number": 2400, "timestamp_epoch": "1725471397.393741000", "src_ip": "172.17.0.99", "dst_ip": "204.79.197.203", "src_port": 49823, "dst_port": 443, "tcp_stream": 58, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "windows.msn.com", "tls.handshake.ja3": "350c9b4a3f847974933dd25e9f9dc620" } }, { "event_id": "evt-83ece106a3a2cfe94c0f83ac", "kind": "tls_client_hello", "frame_number": 2402, "timestamp_epoch": "1725471397.394047000", "src_ip": "172.17.0.99", "dst_ip": "204.79.197.203", "src_port": 49822, "dst_port": 443, "tcp_stream": 57, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "windows.msn.com", "tls.handshake.ja3": "1a0fcf72de58b80a8499dea99e961714" } }, { "event_id": "evt-ce12a411f5f8ce1dc4d15f12", "kind": "tls_client_hello", "frame_number": 2406, "timestamp_epoch": "1725471397.466055000", "src_ip": "172.17.0.99", "dst_ip": "204.79.197.203", "src_port": 49823, "dst_port": 443, "tcp_stream": 58, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "windows.msn.com", "tls.handshake.ja3": "350c9b4a3f847974933dd25e9f9dc620" } }, { "event_id": "evt-fe3d1166da1a2f75063f1167", "kind": "tls_client_hello", "frame_number": 2410, "timestamp_epoch": "1725471397.476052000", "src_ip": "172.17.0.99", "dst_ip": "204.79.197.203", "src_port": 49822, "dst_port": 443, "tcp_stream": 57, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "windows.msn.com", "tls.handshake.ja3": "1a0fcf72de58b80a8499dea99e961714" } }, { "event_id": "evt-f1c9a3214846f3f26ada7e72", "kind": "tls_client_hello", "frame_number": 2445, "timestamp_epoch": "1725471397.836563000", "src_ip": "172.17.0.99", "dst_ip": "204.79.197.203", "src_port": 49824, "dst_port": 443, "tcp_stream": 59, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.msn.com", "tls.handshake.ja3": "4c6de70d03b552090a8d77fcb0e10629" } }, { "event_id": "evt-3de0a0034b5b7825e5e87eff", "kind": "tls_client_hello", "frame_number": 2448, "timestamp_epoch": "1725471397.913797000", "src_ip": "172.17.0.99", "dst_ip": "204.79.197.203", "src_port": 49824, "dst_port": 443, "tcp_stream": 59, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "www.msn.com", "tls.handshake.ja3": "4c6de70d03b552090a8d77fcb0e10629" } }, { "event_id": "evt-b61a2aef369485022e08cd06", "kind": "tls_client_hello", "frame_number": 2494, "timestamp_epoch": "1725471398.231353000", "src_ip": "172.17.0.99", "dst_ip": "23.45.119.144", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "a25c14084d58bfea7bb5de112124edb3" } }, { "event_id": "evt-64c50bfaa19f9f01edaccbda", "kind": "tls_client_hello", "frame_number": 2499, "timestamp_epoch": "1725471398.255794000", "src_ip": "172.17.0.99", "dst_ip": "204.79.197.203", "src_port": 49825, "dst_port": 443, "tcp_stream": 60, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "api.msn.com", "tls.handshake.ja3": "a35e0e26a8a46900d0f8297769d1112c" } }, { "event_id": "evt-35d3dd311b8276ea8789d5f5", "kind": "tls_client_hello", "frame_number": 2521, "timestamp_epoch": "1725471398.316055000", "src_ip": "172.17.0.99", "dst_ip": "204.79.197.203", "src_port": 49825, "dst_port": 443, "tcp_stream": 60, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "api.msn.com", "tls.handshake.ja3": "a35e0e26a8a46900d0f8297769d1112c" } }, { "event_id": "evt-e837fa6f23e6f08162ea070a", "kind": "tls_client_hello", "frame_number": 2549, "timestamp_epoch": "1725471398.456051000", "src_ip": "172.17.0.99", "dst_ip": "204.79.197.203", "src_port": 49826, "dst_port": 443, "tcp_stream": 61, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "srtb.msn.com", "tls.handshake.ja3": "81e0f23545c783a55096f99f7c4755d7" } }, { "event_id": "evt-f8029460078814084eaf6db7", "kind": "tls_client_hello", "frame_number": 2557, "timestamp_epoch": "1725471398.483914000", "src_ip": "172.17.0.99", "dst_ip": "23.45.119.144", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "5291cc6eebf72ef2ca72d48a1dd0d72f" } }, { "event_id": "evt-766c72385b4b80d52dfe8b29", "kind": "tls_client_hello", "frame_number": 2576, "timestamp_epoch": "1725471398.530743000", "src_ip": "172.17.0.99", "dst_ip": "204.79.197.203", "src_port": 49826, "dst_port": 443, "tcp_stream": 61, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "srtb.msn.com", "tls.handshake.ja3": "81e0f23545c783a55096f99f7c4755d7" } }, { "event_id": "evt-2a44ce46aba3412ebbf6d3a6", "kind": "tls_client_hello", "frame_number": 2594, "timestamp_epoch": "1725471398.560998000", "src_ip": "172.17.0.99", "dst_ip": "23.221.24.69", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "th.bing.com", "tls.handshake.ja3": "f06a64ec6ecba24167cfe2612badcd91" } }, { "event_id": "evt-85be04261c2ae80a8a0997f6", "kind": "tls_client_hello", "frame_number": 2656, "timestamp_epoch": "1725471398.650380000", "src_ip": "172.17.0.99", "dst_ip": "23.220.251.153", "src_port": 49827, "dst_port": 443, "tcp_stream": 62, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "img-s-msn-com.akamaized.net", "tls.handshake.ja3": "cad306d4b414c5fcf993c03e0d596109" } }, { "event_id": "evt-1063c48489d67f9a744ce505", "kind": "tls_client_hello", "frame_number": 3042, "timestamp_epoch": "1725471471.590000000", "src_ip": "172.17.0.99", "dst_ip": "20.96.153.111", "src_port": 49832, "dst_port": 443, "tcp_stream": 67, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "fd.api.iris.microsoft.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-864dee2f030df6f6baa746be", "kind": "tls_client_hello", "frame_number": 3145, "timestamp_epoch": "1725471611.405592000", "src_ip": "172.17.0.99", "dst_ip": "13.89.179.9", "src_port": 49839, "dst_port": 443, "tcp_stream": 72, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-05718cf6d27d9f8414cc6a39", "kind": "tls_client_hello", "frame_number": 3208, "timestamp_epoch": "1725471761.569885000", "src_ip": "172.17.0.99", "dst_ip": "23.194.68.140", "src_port": 49841, "dst_port": 443, "tcp_stream": 74, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "storecatalogrevocation.storequality.microsoft.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-a9487602c6e9b354231ffc33", "kind": "tls_client_hello", "frame_number": 3264, "timestamp_epoch": "1725471852.446145000", "src_ip": "172.17.0.99", "dst_ip": "20.189.173.26", "src_port": 49843, "dst_port": 443, "tcp_stream": 76, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-b0addde50cf71535ca2b89bc", "kind": "tls_client_hello", "frame_number": 3357, "timestamp_epoch": "1725471878.598572000", "src_ip": "172.17.0.99", "dst_ip": "23.45.119.144", "src_port": 49849, "dst_port": 443, "tcp_stream": 82, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-f8aba5b42d7f6eff59df79ad", "kind": "tls_client_hello", "frame_number": 3394, "timestamp_epoch": "1725471938.677480000", "src_ip": "172.17.0.99", "dst_ip": "20.60.228.1", "src_port": 49851, "dst_port": 443, "tcp_stream": 84, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "weathermapdata.blob.core.windows.net", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-627e82980de7141c130ba551", "kind": "tls_client_hello", "frame_number": 3397, "timestamp_epoch": "1725471938.764100000", "src_ip": "172.17.0.99", "dst_ip": "20.60.228.1", "src_port": 49851, "dst_port": 443, "tcp_stream": 84, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "weathermapdata.blob.core.windows.net", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-68b686608c61b8ba8ee51d49", "kind": "tls_client_hello", "frame_number": 3508, "timestamp_epoch": "1725472090.745636000", "src_ip": "172.17.0.99", "dst_ip": "23.45.119.143", "src_port": 49855, "dst_port": 443, "tcp_stream": 88, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-d3bc73c31332089ee168b62f", "kind": "tls_client_hello", "frame_number": 3625, "timestamp_epoch": "1725472175.979960000", "src_ip": "172.17.0.99", "dst_ip": "40.126.28.22", "src_port": 49861, "dst_port": 443, "tcp_stream": 94, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.microsoftonline.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-45fcb8a62c551ed65d4d646c", "kind": "tls_client_hello", "frame_number": 3628, "timestamp_epoch": "1725472176.070698000", "src_ip": "172.17.0.99", "dst_ip": "40.126.28.22", "src_port": 49861, "dst_port": 443, "tcp_stream": 94, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "login.microsoftonline.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-64b1806e425dbf9f38484cdd", "kind": "tls_client_hello", "frame_number": 3651, "timestamp_epoch": "1725472176.429820000", "src_ip": "172.17.0.99", "dst_ip": "23.195.212.189", "src_port": 49862, "dst_port": 443, "tcp_stream": 95, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "sso.godaddy.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-ed93e8219d9745def709fbb3", "kind": "tls_client_hello", "frame_number": 3673, "timestamp_epoch": "1725472176.675953000", "src_ip": "172.17.0.99", "dst_ip": "20.189.173.1", "src_port": 49863, "dst_port": 443, "tcp_stream": 96, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-1b1782cfa59c7eef61e41d46", "kind": "tls_client_hello", "frame_number": 3707, "timestamp_epoch": "1725472177.022281000", "src_ip": "172.17.0.99", "dst_ip": "40.119.249.228", "src_port": 49864, "dst_port": 443, "tcp_stream": 97, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-662c4dce11a15dd13aa2c349", "kind": "tls_client_hello", "frame_number": 3741, "timestamp_epoch": "1725472178.641921000", "src_ip": "172.17.0.99", "dst_ip": "40.119.249.228", "src_port": 49865, "dst_port": 443, "tcp_stream": 98, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "settings-win.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-f9ab7c1f50c0b0c362e72bab", "kind": "tls_client_hello", "frame_number": 3808, "timestamp_epoch": "1725472296.497990000", "src_ip": "172.17.0.99", "dst_ip": "204.79.197.203", "src_port": 49868, "dst_port": 443, "tcp_stream": 101, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "windows.msn.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-eeffa634032a4d639093a864", "kind": "tls_client_hello", "frame_number": 3812, "timestamp_epoch": "1725472296.563763000", "src_ip": "172.17.0.99", "dst_ip": "204.79.197.203", "src_port": 49868, "dst_port": 443, "tcp_stream": 101, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "windows.msn.com", "tls.handshake.ja3": "65005c9d9ae0f0ebeaf22c210571d482" } }, { "event_id": "evt-253392e083732efe47b5792d", "kind": "tls_client_hello", "frame_number": 3841, "timestamp_epoch": "1725472298.572478000", "src_ip": "172.17.0.99", "dst_ip": "23.45.119.144", "src_port": 49869, "dst_port": 443, "tcp_stream": 102, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "5919f6108f098e14c2f37619021ebd4d" } }, { "event_id": "evt-fc351c1a263d16c40e7ca206", "kind": "tls_client_hello", "frame_number": 3922, "timestamp_epoch": "1725472478.585142000", "src_ip": "172.17.0.99", "dst_ip": "23.45.119.144", "src_port": 49872, "dst_port": 443, "tcp_stream": 105, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "5919f6108f098e14c2f37619021ebd4d" } }, { "event_id": "evt-450eac083f5b373b8f5d04bd", "kind": "tls_client_hello", "frame_number": 4039, "timestamp_epoch": "1725472805.290742000", "src_ip": "172.17.0.99", "dst_ip": "20.189.173.18", "src_port": 49876, "dst_port": 443, "tcp_stream": 109, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "mobile.events.data.microsoft.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-18451c6f1311be138990fc26", "kind": "tls_client_hello", "frame_number": 4042, "timestamp_epoch": "1725472805.387393000", "src_ip": "172.17.0.99", "dst_ip": "20.189.173.18", "src_port": 49876, "dst_port": 443, "tcp_stream": 109, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "mobile.events.data.microsoft.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-998bf5c11bc8d04b1e4e69c5", "kind": "tls_client_hello", "frame_number": 4082, "timestamp_epoch": "1725472852.228611000", "src_ip": "172.17.0.99", "dst_ip": "52.113.194.132", "src_port": 49878, "dst_port": 443, "tcp_stream": 111, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-d806faecaf12d6002711418f", "kind": "tls_client_hello", "frame_number": 4086, "timestamp_epoch": "1725472852.296590000", "src_ip": "172.17.0.99", "dst_ip": "52.113.194.132", "src_port": 49878, "dst_port": 443, "tcp_stream": 111, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-39bd888a15b0a727f3686493", "kind": "tls_client_hello", "frame_number": 4157, "timestamp_epoch": "1725472924.632500000", "src_ip": "172.17.0.99", "dst_ip": "52.113.194.132", "src_port": 49881, "dst_port": 443, "tcp_stream": 114, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "5919f6108f098e14c2f37619021ebd4d" } }, { "event_id": "evt-a5f4fbc84eb5984fb36f671b", "kind": "tls_client_hello", "frame_number": 4161, "timestamp_epoch": "1725472924.707889000", "src_ip": "172.17.0.99", "dst_ip": "52.113.194.132", "src_port": 49881, "dst_port": 443, "tcp_stream": 114, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "5919f6108f098e14c2f37619021ebd4d" } }, { "event_id": "evt-137e0262c2f1379f7c1497de", "kind": "tls_client_hello", "frame_number": 4260, "timestamp_epoch": "1725473078.983435000", "src_ip": "172.17.0.99", "dst_ip": "13.70.79.200", "src_port": 49885, "dst_port": 443, "tcp_stream": 118, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "v10.events.data.microsoft.com", "tls.handshake.ja3": "091f51a7a1c3a4504a224cc081ce9cee" } }, { "event_id": "evt-1fcf3fe7ce74b569c48c5ca6", "kind": "tls_client_hello", "frame_number": 4374, "timestamp_epoch": "1725473224.920740000", "src_ip": "172.17.0.99", "dst_ip": "52.113.194.132", "src_port": 49889, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "5919f6108f098e14c2f37619021ebd4d" } }, { "event_id": "evt-3a7725f1613eee32688d380e", "kind": "tls_client_hello", "frame_number": 4378, "timestamp_epoch": "1725473224.999746000", "src_ip": "172.17.0.99", "dst_ip": "52.113.194.132", "src_port": 49889, "dst_port": 443, "tcp_stream": 122, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "5919f6108f098e14c2f37619021ebd4d" } }, { "event_id": "evt-585dc1a198b17c93920f283b", "kind": "tls_client_hello", "frame_number": 4510, "timestamp_epoch": "1725473525.389849000", "src_ip": "172.17.0.99", "dst_ip": "52.113.194.132", "src_port": 49894, "dst_port": 443, "tcp_stream": 127, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "5919f6108f098e14c2f37619021ebd4d" } }, { "event_id": "evt-b066381f619d3109630f1557", "kind": "tls_client_hello", "frame_number": 4514, "timestamp_epoch": "1725473525.468695000", "src_ip": "172.17.0.99", "dst_ip": "52.113.194.132", "src_port": 49894, "dst_port": 443, "tcp_stream": 127, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "5919f6108f098e14c2f37619021ebd4d" } }, { "event_id": "evt-fa1133e2006814afaaf89f00", "kind": "tls_client_hello", "frame_number": 4700, "timestamp_epoch": "1725473809.566359000", "src_ip": "172.17.0.99", "dst_ip": "23.45.119.147", "src_port": 49903, "dst_port": 443, "tcp_stream": 136, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "assets.msn.com", "tls.handshake.ja3": "3c293bdf2a25c07559b560ba86debc77" } }, { "event_id": "evt-1581e826f68e024786efbe89", "kind": "tls_client_hello", "frame_number": 4724, "timestamp_epoch": "1725473825.888774000", "src_ip": "172.17.0.99", "dst_ip": "52.113.194.132", "src_port": 49904, "dst_port": 443, "tcp_stream": 137, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "5919f6108f098e14c2f37619021ebd4d" } }, { "event_id": "evt-de081c1d35bbcc34ec531129", "kind": "tls_client_hello", "frame_number": 4728, "timestamp_epoch": "1725473825.973368000", "src_ip": "172.17.0.99", "dst_ip": "52.113.194.132", "src_port": 49904, "dst_port": 443, "tcp_stream": 137, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "ecs.office.com", "tls.handshake.ja3": "5919f6108f098e14c2f37619021ebd4d" } }, { "event_id": "evt-dd9d9d1c69a405bb6fe4e8fd", "kind": "tls_client_hello", "frame_number": 5003, "timestamp_epoch": "1725474605.172253000", "src_ip": "172.17.0.99", "dst_ip": "20.189.173.18", "src_port": 49917, "dst_port": 443, "tcp_stream": 150, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "mobile.events.data.microsoft.com", "tls.handshake.ja3": "5919f6108f098e14c2f37619021ebd4d" } }, { "event_id": "evt-d604373dfcbf2810518cd05e", "kind": "tls_client_hello", "frame_number": 5006, "timestamp_epoch": "1725474605.276234000", "src_ip": "172.17.0.99", "dst_ip": "20.189.173.18", "src_port": 49917, "dst_port": 443, "tcp_stream": 150, "udp_stream": null, "fields": { "tls.handshake.extensions_server_name": "mobile.events.data.microsoft.com", "tls.handshake.ja3": "5919f6108f098e14c2f37619021ebd4d" } } ], "dhcp": [ { "event_id": "evt-a0a59316e0d3ba93198ce3e6", "kind": "dhcp", "frame_number": 1, "timestamp_epoch": "1725471151.318609000", "src_ip": "0.0.0.0", "dst_ip": "255.255.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "dhcp.hw.mac_addr": "18:3d:a2:b6:8d:c4,18:3d:a2:b6:8d:c4", "dhcp.ip.your": "0.0.0.0", "dhcp.option.dhcp": "1", "dhcp.option.hostname": "DESKTOP-RNVO9AT", "dhcp.option.requested_ip_address": "172.17.0.99", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-0f6f5a5e7f378bc13f6e5a49", "kind": "dhcp", "frame_number": 2, "timestamp_epoch": "1725471151.319395000", "src_ip": "172.17.0.17", "dst_ip": "255.255.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 1, "fields": { "dhcp.hw.mac_addr": "18:3d:a2:b6:8d:c4", "dhcp.ip.your": "172.17.0.99", "dhcp.option.dhcp": "2", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-bdfc7f147f0cf0ce1ffee46e", "kind": "dhcp", "frame_number": 3, "timestamp_epoch": "1725471151.319898000", "src_ip": "0.0.0.0", "dst_ip": "255.255.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 0, "fields": { "dhcp.hw.mac_addr": "18:3d:a2:b6:8d:c4,18:3d:a2:b6:8d:c4", "dhcp.ip.your": "0.0.0.0", "dhcp.option.dhcp": "3", "dhcp.option.hostname": "DESKTOP-RNVO9AT", "dhcp.option.requested_ip_address": "172.17.0.99", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-ce9f17c8ac1a3ce8e758877b", "kind": "dhcp", "frame_number": 4, "timestamp_epoch": "1725471151.320804000", "src_ip": "172.17.0.17", "dst_ip": "255.255.255.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 1, "fields": { "dhcp.hw.mac_addr": "18:3d:a2:b6:8d:c4", "dhcp.ip.your": "172.17.0.99", "dhcp.option.dhcp": "5", "eth.src": "00:23:ae:50:ba:fd" } } ], "identity": [ { "event_id": "evt-f61ff27b6503ea6b88abe1be", "kind": "identity", "frame_number": 8, "timestamp_epoch": "1725471151.328859000", "src_ip": "172.17.0.99", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 3, "fields": { "dns.qry.name": "DESKTOP-RNVO9AT.local", "eth.dst": "01:00:5e:00:00:fb", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-eb773f29c9c77f966ba03d71", "kind": "identity", "frame_number": 10, "timestamp_epoch": "1725471151.328989000", "src_ip": "172.17.0.99", "dst_ip": "224.0.0.251", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 3, "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-6e2ce97c95dacf88b88d63cc", "kind": "identity", "frame_number": 11, "timestamp_epoch": "1725471151.329715000", "src_ip": "172.17.0.99", "dst_ip": "224.0.0.252", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 4, "fields": { "dns.qry.name": "DESKTOP-RNVO9AT", "eth.dst": "01:00:5e:00:00:fc", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-4a94adc6531dd3282cd86a7d", "kind": "identity", "frame_number": 20, "timestamp_epoch": "1725471151.396549000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-RNVO9AT<20>,DESKTOP-RNVO9AT<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-7f7c25678441f3d2aacf6e9f", "kind": "identity", "frame_number": 21, "timestamp_epoch": "1725471151.396549000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BEPOSITIVE<00>,BEPOSITIVE<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-64843718a2d23aae9a29dbc7", "kind": "identity", "frame_number": 22, "timestamp_epoch": "1725471151.396549000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-RNVO9AT<00>,DESKTOP-RNVO9AT<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-238872d8693d1f82ce7fba8c", "kind": "identity", "frame_number": 31, "timestamp_epoch": "1725471151.433000000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-778ecbd11688e4a3f3bb162e", "kind": "identity", "frame_number": 33, "timestamp_epoch": "1725471151.433776000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-a61594eac62ed3d00234b113", "kind": "identity", "frame_number": 60, "timestamp_epoch": "1725471152.150023000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-RNVO9AT<00>,DESKTOP-RNVO9AT<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-c1990861f10ebf08c9ea5315", "kind": "identity", "frame_number": 61, "timestamp_epoch": "1725471152.150023000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BEPOSITIVE<00>,BEPOSITIVE<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-d2d734fef641554a2fddabf6", "kind": "identity", "frame_number": 62, "timestamp_epoch": "1725471152.150023000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-RNVO9AT<20>,DESKTOP-RNVO9AT<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-3be114c597dbb7fc3095fbda", "kind": "identity", "frame_number": 64, "timestamp_epoch": "1725471152.912861000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-RNVO9AT<20>,DESKTOP-RNVO9AT<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-09252d2e0426e3311bae00b5", "kind": "identity", "frame_number": 65, "timestamp_epoch": "1725471152.912861000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BEPOSITIVE<00>,BEPOSITIVE<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-27577a51cb779ba366a8bf42", "kind": "identity", "frame_number": 66, "timestamp_epoch": "1725471152.912861000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-RNVO9AT<00>,DESKTOP-RNVO9AT<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-d811a8e47b72115380092879", "kind": "identity", "frame_number": 81, "timestamp_epoch": "1725471153.663907000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-RNVO9AT<00>,DESKTOP-RNVO9AT<00> (Workstation/Redirector)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-2aff28f97553cc698c7b677b", "kind": "identity", "frame_number": 82, "timestamp_epoch": "1725471153.663907000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BEPOSITIVE<00>,BEPOSITIVE<00> (Workstation/Redirector)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-5c8a356e092b3ce71132ed4c", "kind": "identity", "frame_number": 83, "timestamp_epoch": "1725471153.663907000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "DESKTOP-RNVO9AT<20>,DESKTOP-RNVO9AT<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-d3add713ae2d6621fcba17f3", "kind": "identity", "frame_number": 85, "timestamp_epoch": "1725471154.449002000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BEPOSITIVE<1e>,BEPOSITIVE<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-5b8f7c4e28eb8419164c0628", "kind": "identity", "frame_number": 91, "timestamp_epoch": "1725471155.224995000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BEPOSITIVE<1e>,BEPOSITIVE<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-f19e55cabc792c5789df2c3c", "kind": "identity", "frame_number": 92, "timestamp_epoch": "1725471155.975604000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BEPOSITIVE<1e>,BEPOSITIVE<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-7eff98ec2afe26950b35b836", "kind": "identity", "frame_number": 96, "timestamp_epoch": "1725471156.745729000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.name": "BEPOSITIVE<1e>,BEPOSITIVE<1e> (Browser Election Service)", "nbns.nb_flags.group": "True" } }, { "event_id": "evt-d69c1f54971cfde91252daaf", "kind": "identity", "frame_number": 97, "timestamp_epoch": "1725471157.536757000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.response_computer_name": "DESKTOP-RNVO9AT", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-98e1bc460ae05876c41f34c9", "kind": "identity", "frame_number": 98, "timestamp_epoch": "1725471157.540516000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.server": "DESKTOP-RNVO9AT", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-fd804f9ea2371555efb93cbd", "kind": "identity", "frame_number": 116, "timestamp_epoch": "1725471178.213088000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-ebf655f85681d0fb1ddb2644", "kind": "identity", "frame_number": 117, "timestamp_epoch": "1725471178.213829000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-ffe9bdea9743241b180f29b4", "kind": "identity", "frame_number": 120, "timestamp_epoch": "1725471178.214912000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-1918cd5382d653817d91b3e6", "kind": "identity", "frame_number": 122, "timestamp_epoch": "1725471178.217063000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-1e8fce3f25b1a15cd2980d49", "kind": "identity", "frame_number": 123, "timestamp_epoch": "1725471178.217515000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-1ebd93088d7d03e30ba124d4", "kind": "identity", "frame_number": 124, "timestamp_epoch": "1725471178.217757000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-7220f04e2b1436cb64e8e845", "kind": "identity", "frame_number": 125, "timestamp_epoch": "1725471178.218114000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-459ff3ac7ecc0eb567a4a66e", "kind": "identity", "frame_number": 126, "timestamp_epoch": "1725471178.218216000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-7b99b9baf1564ea33270bd78", "kind": "identity", "frame_number": 127, "timestamp_epoch": "1725471178.218315000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-76687abbf9738246d725239b", "kind": "identity", "frame_number": 128, "timestamp_epoch": "1725471178.218530000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-cb4a2f3f8355e7340d5769f3", "kind": "identity", "frame_number": 130, "timestamp_epoch": "1725471188.148346000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.response_computer_name": "DESKTOP-RNVO9AT", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-fa96996011e6132aeb6ef12a", "kind": "identity", "frame_number": 131, "timestamp_epoch": "1725471188.167295000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 8, "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4", "nbns.flags.opcode": "0", "nbns.flags.response": "False", "nbns.name": "WIN-CTL9XBQ9Y19<20>" } }, { "event_id": "evt-7f150450a03fe9c1b01ba330", "kind": "identity", "frame_number": 132, "timestamp_epoch": "1725471188.167544000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 17, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "nbns.flags.opcode": "0", "nbns.flags.response": "True", "nbns.name": "WIN-CTL9XBQ9Y19<20> (Server service)", "nbns.nb_flags.group": "False" } }, { "event_id": "evt-2414c4473b9b4f4d85d37fbd", "kind": "identity", "frame_number": 139, "timestamp_epoch": "1725471188.170951000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 4, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-4eb30c89998e8b30730a5418", "kind": "identity", "frame_number": 140, "timestamp_epoch": "1725471188.172160000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 4, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-8a4eb43f99cbc914a0ada6a4", "kind": "identity", "frame_number": 141, "timestamp_epoch": "1725471188.172679000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 4, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "ntlmssp.auth.domain": "NULL", "ntlmssp.auth.hostname": "DESKTOP-RNVO9AT", "ntlmssp.auth.username": "NULL" } }, { "event_id": "evt-5de2e83ae5c7543214e890a0", "kind": "identity", "frame_number": 147, "timestamp_epoch": "1725471188.176195000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.response_computer_name": "DESKTOP-RNVO9AT", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-f6fd5bf3bc9ade6a4780bdec", "kind": "identity", "frame_number": 150, "timestamp_epoch": "1725471188.185423000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.response_computer_name": "DESKTOP-RNVO9AT", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-472052d8d09a384d7920ca6b", "kind": "identity", "frame_number": 154, "timestamp_epoch": "1725471193.409254000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-88b188cb417ab2db4c2edcd1", "kind": "identity", "frame_number": 155, "timestamp_epoch": "1725471193.409254000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-fdb2bcc6f16ae7ad1d6f264d", "kind": "identity", "frame_number": 156, "timestamp_epoch": "1725471193.409844000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-0be0a90a2ec2ee3f012fcce6", "kind": "identity", "frame_number": 157, "timestamp_epoch": "1725471193.409844000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 3, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-31bb2486590e4ad867706a87", "kind": "identity", "frame_number": 172, "timestamp_epoch": "1725471218.197534000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 5, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-4d01738d99736c04cdc81a96", "kind": "identity", "frame_number": 173, "timestamp_epoch": "1725471218.198170000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 5, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-392596ccb75bf700e387b83b", "kind": "identity", "frame_number": 174, "timestamp_epoch": "1725471218.199311000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 5, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "ntlmssp.auth.domain": "NULL", "ntlmssp.auth.hostname": "DESKTOP-RNVO9AT", "ntlmssp.auth.username": "NULL" } }, { "event_id": "evt-0861d9523212bfc912dded63", "kind": "identity", "frame_number": 180, "timestamp_epoch": "1725471218.203910000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.response_computer_name": "DESKTOP-RNVO9AT", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-b84d6fb8bfa3b4b336475c7f", "kind": "identity", "frame_number": 183, "timestamp_epoch": "1725471218.222904000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.response_computer_name": "DESKTOP-RNVO9AT", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-d5b4aa3bd16f71e896a9e8d0", "kind": "identity", "frame_number": 230, "timestamp_epoch": "1725471248.255741000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 7, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-e686b456157e178fe5e6d912", "kind": "identity", "frame_number": 231, "timestamp_epoch": "1725471248.256238000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 7, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-29a7b9735e2f007c67c1d0e3", "kind": "identity", "frame_number": 232, "timestamp_epoch": "1725471248.256719000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 7, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "ntlmssp.auth.domain": "NULL", "ntlmssp.auth.hostname": "DESKTOP-RNVO9AT", "ntlmssp.auth.username": "NULL" } }, { "event_id": "evt-bf76d822ad116177612aa3fd", "kind": "identity", "frame_number": 238, "timestamp_epoch": "1725471248.260352000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.response_computer_name": "DESKTOP-RNVO9AT", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-71098274ab624e9f87e772b7", "kind": "identity", "frame_number": 241, "timestamp_epoch": "1725471248.278597000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.response_computer_name": "DESKTOP-RNVO9AT", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-f21d0bec79110a70432dfd08", "kind": "identity", "frame_number": 293, "timestamp_epoch": "1725471275.303608000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 9, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.CNameString": "afletcher", "kerberos.msg_type": "10" } }, { "event_id": "evt-e5e1b983166a38434b86bb9e", "kind": "identity", "frame_number": 294, "timestamp_epoch": "1725471275.304332000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 9, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "30" } }, { "event_id": "evt-ede4453267eda7d9b79e36e6", "kind": "identity", "frame_number": 301, "timestamp_epoch": "1725471275.309704000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.CNameString": "afletcher", "kerberos.msg_type": "10" } }, { "event_id": "evt-bb7726bf415ec1ec058f6ef5", "kind": "identity", "frame_number": 303, "timestamp_epoch": "1725471275.311510000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 10, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.CNameString": "afletcher", "kerberos.msg_type": "11" } }, { "event_id": "evt-0bcaea8ee06732d6a24a7fc4", "kind": "identity", "frame_number": 312, "timestamp_epoch": "1725471275.312820000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-bd7945f68cdd17c0fc0ae797", "kind": "identity", "frame_number": 317, "timestamp_epoch": "1725471275.315483000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 11, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.CNameString": "afletcher", "kerberos.msg_type": "13" } }, { "event_id": "evt-35944b7ca5b45ee59dd13e6d", "kind": "identity", "frame_number": 332, "timestamp_epoch": "1725471275.478711000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-993c2fddef402025292e3a97", "kind": "identity", "frame_number": 336, "timestamp_epoch": "1725471275.479682000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-0b15b793f5288813e71dc312", "kind": "identity", "frame_number": 343, "timestamp_epoch": "1725471275.480838000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-1c27309b6c09ca043b2b133c", "kind": "identity", "frame_number": 346, "timestamp_epoch": "1725471275.481001000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 16, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-63ed6d0c5baa9645c04832e7", "kind": "identity", "frame_number": 350, "timestamp_epoch": "1725471275.484008000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 16, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.CNameString": "afletcher", "kerberos.msg_type": "13" } }, { "event_id": "evt-33c5d979e39540385cedfc31", "kind": "identity", "frame_number": 354, "timestamp_epoch": "1725471275.484265000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 15, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.CNameString": "afletcher", "kerberos.msg_type": "13" } }, { "event_id": "evt-a54b86c0812066c67694a233", "kind": "identity", "frame_number": 358, "timestamp_epoch": "1725471275.484610000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 14, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-304a6aa28233b79384a471d1", "kind": "identity", "frame_number": 368, "timestamp_epoch": "1725471275.485208000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 17, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-379f4fe59fba8498f2bdd9b0", "kind": "identity", "frame_number": 370, "timestamp_epoch": "1725471275.486212000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 14, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-b078c28d256c112edce46ba0", "kind": "identity", "frame_number": 371, "timestamp_epoch": "1725471275.486414000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 14, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "15" } }, { "event_id": "evt-6c7a3abdc52c595ffd489921", "kind": "identity", "frame_number": 373, "timestamp_epoch": "1725471275.486633000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 17, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.CNameString": "afletcher", "kerberos.msg_type": "13" } }, { "event_id": "evt-ed29c2e38039d9b0f6d0d6f1", "kind": "identity", "frame_number": 381, "timestamp_epoch": "1725471275.487322000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-cbe9a2114b9168e763607033", "kind": "identity", "frame_number": 390, "timestamp_epoch": "1725471275.489758000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-d004502877b50ce9be0af506", "kind": "identity", "frame_number": 392, "timestamp_epoch": "1725471275.490034000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-32554e0c69a6b59553969a45", "kind": "identity", "frame_number": 393, "timestamp_epoch": "1725471275.490293000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-9d3395fe940f1f8ff4e7fb41", "kind": "identity", "frame_number": 394, "timestamp_epoch": "1725471275.490409000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-0857a8f4ab4b07c5654e7fd2", "kind": "identity", "frame_number": 395, "timestamp_epoch": "1725471275.490452000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-3ebe4f25831365e30760d3f6", "kind": "identity", "frame_number": 397, "timestamp_epoch": "1725471275.490621000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-4fb87861935daed1b61013c6", "kind": "identity", "frame_number": 398, "timestamp_epoch": "1725471275.490796000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-20c18e3349e8a1b702ebda92", "kind": "identity", "frame_number": 400, "timestamp_epoch": "1725471275.490929000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-89f36a0060c037a4c127e534", "kind": "identity", "frame_number": 401, "timestamp_epoch": "1725471275.491063000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-3c7ac4d86cc1f9f7eddc1e2e", "kind": "identity", "frame_number": 402, "timestamp_epoch": "1725471275.491224000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-b59b2e84ceb540625d1bcd3d", "kind": "identity", "frame_number": 403, "timestamp_epoch": "1725471275.491375000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-37852f06957bd072a475d227", "kind": "identity", "frame_number": 405, "timestamp_epoch": "1725471275.491477000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-63a59dfd455f69c9bf725f32", "kind": "identity", "frame_number": 408, "timestamp_epoch": "1725471275.491677000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-1c1e8a25078d45bee07d71e0", "kind": "identity", "frame_number": 409, "timestamp_epoch": "1725471275.491823000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-6f5cd66c72468e337116145e", "kind": "identity", "frame_number": 410, "timestamp_epoch": "1725471275.492327000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-f47701ec30519c84b1017d7e", "kind": "identity", "frame_number": 412, "timestamp_epoch": "1725471275.492576000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-e347075334080d1a17e8e1a8", "kind": "identity", "frame_number": 413, "timestamp_epoch": "1725471275.492594000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-6b01cd7adefddccc07068c00", "kind": "identity", "frame_number": 415, "timestamp_epoch": "1725471275.493110000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-b8943e6a42ff19340b41b1af", "kind": "identity", "frame_number": 416, "timestamp_epoch": "1725471275.493261000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-eda38d2c8fc01472c35924cd", "kind": "identity", "frame_number": 417, "timestamp_epoch": "1725471275.493798000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-92ce86aefdedbd7aa7b907d4", "kind": "identity", "frame_number": 418, "timestamp_epoch": "1725471275.493938000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-b510676f0630b5c547e38435", "kind": "identity", "frame_number": 419, "timestamp_epoch": "1725471275.494529000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-45fc89c02ffb62cfc7ce4fe8", "kind": "identity", "frame_number": 420, "timestamp_epoch": "1725471275.494592000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-41b58831e3c84b18c9d660ce", "kind": "identity", "frame_number": 421, "timestamp_epoch": "1725471275.494763000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-c062eb20c3cfe1946c966678", "kind": "identity", "frame_number": 422, "timestamp_epoch": "1725471275.495317000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-2bb942fb1a06eb8be06760a2", "kind": "identity", "frame_number": 423, "timestamp_epoch": "1725471275.495492000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-bffe553e5eb9e8debdf00fd1", "kind": "identity", "frame_number": 424, "timestamp_epoch": "1725471275.496085000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-5abb9cd4be38ebb9e2e656e6", "kind": "identity", "frame_number": 425, "timestamp_epoch": "1725471275.496220000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-82115ddbd291a94d014ef992", "kind": "identity", "frame_number": 426, "timestamp_epoch": "1725471275.497023000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-57e02f02d4a7444a566d0b9b", "kind": "identity", "frame_number": 427, "timestamp_epoch": "1725471275.497152000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-5476b4db0878938f2a059e55", "kind": "identity", "frame_number": 428, "timestamp_epoch": "1725471275.498011000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "samr.samr_UserInfo21.account_name": "afletcher", "samr.samr_UserInfo21.full_name": "Andrew Fletcher" } }, { "event_id": "evt-0c052d023f08075ace1ca026", "kind": "identity", "frame_number": 429, "timestamp_epoch": "1725471275.498143000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-d911c22f1b07423ce9429ceb", "kind": "identity", "frame_number": 432, "timestamp_epoch": "1725471275.499053000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-746ecc74e8fadc6cc8764968", "kind": "identity", "frame_number": 433, "timestamp_epoch": "1725471275.499194000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-d2b9d9435e95ede2ae1821e9", "kind": "identity", "frame_number": 434, "timestamp_epoch": "1725471275.499727000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-629a5f541642952e69b684e4", "kind": "identity", "frame_number": 436, "timestamp_epoch": "1725471275.499914000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-a60d63004f3587ea97d39bcc", "kind": "identity", "frame_number": 439, "timestamp_epoch": "1725471275.500351000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-ba6939e18157a215b6025351", "kind": "identity", "frame_number": 440, "timestamp_epoch": "1725471275.500507000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-9c3067e54015f9e0f6e9491d", "kind": "identity", "frame_number": 441, "timestamp_epoch": "1725471275.500908000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-0101b9ddbb95127217248008", "kind": "identity", "frame_number": 443, "timestamp_epoch": "1725471275.501123000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-b3506afe6912bf476a3ca549", "kind": "identity", "frame_number": 444, "timestamp_epoch": "1725471275.501141000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-5dcad3ec65abab5501b06648", "kind": "identity", "frame_number": 446, "timestamp_epoch": "1725471275.501610000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-3442c58733cb2b6a4044f419", "kind": "identity", "frame_number": 447, "timestamp_epoch": "1725471275.501755000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-877194b662cf77d4fb961ed8", "kind": "identity", "frame_number": 448, "timestamp_epoch": "1725471275.502192000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-4bfef9a9897e638c228c1d05", "kind": "identity", "frame_number": 449, "timestamp_epoch": "1725471275.502313000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-533752f0340522ccabaa6d6c", "kind": "identity", "frame_number": 450, "timestamp_epoch": "1725471275.502748000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-5939400e96fa83470ad68796", "kind": "identity", "frame_number": 451, "timestamp_epoch": "1725471275.502847000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-977b0dabadc9cfb9e418afa5", "kind": "identity", "frame_number": 452, "timestamp_epoch": "1725471275.502867000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-be2ef0f16f2d243ddb985285", "kind": "identity", "frame_number": 453, "timestamp_epoch": "1725471275.503096000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-827b532aab84c200b2fc076c", "kind": "identity", "frame_number": 474, "timestamp_epoch": "1725471275.573489000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-33efc5c83a795c39ac6467bd", "kind": "identity", "frame_number": 475, "timestamp_epoch": "1725471275.573931000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-4bea8b7865aba9fba9a2ef47", "kind": "identity", "frame_number": 480, "timestamp_epoch": "1725471275.574778000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-bd45942669e933eef67d860c", "kind": "identity", "frame_number": 483, "timestamp_epoch": "1725471275.576097000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 21, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.CNameString": "afletcher", "kerberos.msg_type": "13" } }, { "event_id": "evt-2abccf7df81d833ea2145e6d", "kind": "identity", "frame_number": 490, "timestamp_epoch": "1725471275.576732000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-1a8480cbac8d04beac370e9b", "kind": "identity", "frame_number": 492, "timestamp_epoch": "1725471275.577463000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-37fa1d72665d779f5032fcf7", "kind": "identity", "frame_number": 493, "timestamp_epoch": "1725471275.577725000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-368380c9c9fa8b13303a1a36", "kind": "identity", "frame_number": 494, "timestamp_epoch": "1725471275.577829000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-293ffb72561e3b5c89b661af", "kind": "identity", "frame_number": 495, "timestamp_epoch": "1725471275.577937000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-8d8e68bee5958b73ae554f2f", "kind": "identity", "frame_number": 496, "timestamp_epoch": "1725471275.578073000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-94c05db5578baccd5c4bc57d", "kind": "identity", "frame_number": 608, "timestamp_epoch": "1725471276.714863000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-c9e257522ed3c8866f8832dc", "kind": "identity", "frame_number": 609, "timestamp_epoch": "1725471276.715416000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-e79254fbeb7a332618c2ee16", "kind": "identity", "frame_number": 610, "timestamp_epoch": "1725471276.716266000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-e6406d8231dd21878d5d9fa1", "kind": "identity", "frame_number": 611, "timestamp_epoch": "1725471276.716781000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-f4709ea03c9e7839bea34140", "kind": "identity", "frame_number": 856, "timestamp_epoch": "1725471277.485791000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-e512cc7abb2649cda21c6819", "kind": "identity", "frame_number": 857, "timestamp_epoch": "1725471277.486365000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-780dbfca905454a383bdfc15", "kind": "identity", "frame_number": 858, "timestamp_epoch": "1725471277.486365000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-c8c157038d5e2f68f2fc5c00", "kind": "identity", "frame_number": 859, "timestamp_epoch": "1725471277.486365000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-9436d119200b5dad3cf57366", "kind": "identity", "frame_number": 860, "timestamp_epoch": "1725471277.486976000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-0d2c26e9ff671f460cb84673", "kind": "identity", "frame_number": 861, "timestamp_epoch": "1725471277.487259000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-78b55a38f2cb2a43868d81db", "kind": "identity", "frame_number": 862, "timestamp_epoch": "1725471277.487479000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-6f49116a6d8d20d38c062138", "kind": "identity", "frame_number": 863, "timestamp_epoch": "1725471277.487713000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-6e97404309a1427c49ee5665", "kind": "identity", "frame_number": 864, "timestamp_epoch": "1725471277.488376000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-6dec7c49061433604d0cf5d9", "kind": "identity", "frame_number": 865, "timestamp_epoch": "1725471277.488807000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-729fee7029fcb0141229f7c6", "kind": "identity", "frame_number": 866, "timestamp_epoch": "1725471277.489005000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-e68cc21734f40f4b5cca6c6b", "kind": "identity", "frame_number": 867, "timestamp_epoch": "1725471277.489210000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-e4751995a493fbc42b3d56e0", "kind": "identity", "frame_number": 868, "timestamp_epoch": "1725471277.489827000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-a99b5e9c2fa083b6bd49083d", "kind": "identity", "frame_number": 869, "timestamp_epoch": "1725471277.490260000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-fbd584ef081b040e4a154bd2", "kind": "identity", "frame_number": 870, "timestamp_epoch": "1725471277.490469000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-2de20498a2248eb16e427486", "kind": "identity", "frame_number": 871, "timestamp_epoch": "1725471277.490728000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-fee63709cc375466d33b80e4", "kind": "identity", "frame_number": 891, "timestamp_epoch": "1725471277.998647000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-300fbf988b2df169ee670dde", "kind": "identity", "frame_number": 892, "timestamp_epoch": "1725471277.998685000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-be5fdcb361435d2c5f206ff5", "kind": "identity", "frame_number": 893, "timestamp_epoch": "1725471277.999200000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-613d788c4eeb367f8084c3a9", "kind": "identity", "frame_number": 894, "timestamp_epoch": "1725471277.999200000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-96dd4634b8ea175ad4f67b34", "kind": "identity", "frame_number": 895, "timestamp_epoch": "1725471277.999912000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-5e099dfcb910bbb0910e823c", "kind": "identity", "frame_number": 896, "timestamp_epoch": "1725471278.000279000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-f13a517ec04cbb171a92219c", "kind": "identity", "frame_number": 897, "timestamp_epoch": "1725471278.000463000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-2e194134f3b80973db94ee15", "kind": "identity", "frame_number": 898, "timestamp_epoch": "1725471278.000495000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-e26ed03040f51b111ce61bb4", "kind": "identity", "frame_number": 899, "timestamp_epoch": "1725471278.001403000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-7690755104995ef095364ce7", "kind": "identity", "frame_number": 900, "timestamp_epoch": "1725471278.001673000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-654d30e269e9c58160c4be4b", "kind": "identity", "frame_number": 901, "timestamp_epoch": "1725471278.001863000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-fe54cdb66d08e2f6338fc605", "kind": "identity", "frame_number": 902, "timestamp_epoch": "1725471278.001981000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-709ea6f7fb4d3e9ab1be1624", "kind": "identity", "frame_number": 903, "timestamp_epoch": "1725471278.002434000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-dda15219afb0b91361c4965c", "kind": "identity", "frame_number": 904, "timestamp_epoch": "1725471278.002717000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-eb70526ccee897b8a4869a2a", "kind": "identity", "frame_number": 905, "timestamp_epoch": "1725471278.002851000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-b8e94862dfa6b4e11ac1db9a", "kind": "identity", "frame_number": 906, "timestamp_epoch": "1725471278.002962000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-9f3775e41b29d28fc6798573", "kind": "identity", "frame_number": 939, "timestamp_epoch": "1725471278.297837000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 31, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-dbfdcc3e52f80edc73f7f8ac", "kind": "identity", "frame_number": 940, "timestamp_epoch": "1725471278.298476000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 31, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-fe86cd089ff99aac8a0ff9e9", "kind": "identity", "frame_number": 941, "timestamp_epoch": "1725471278.298890000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 31, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "ntlmssp.auth.domain": "NULL", "ntlmssp.auth.hostname": "DESKTOP-RNVO9AT", "ntlmssp.auth.username": "NULL" } }, { "event_id": "evt-2e93e4c905fdf8bd6105a277", "kind": "identity", "frame_number": 947, "timestamp_epoch": "1725471278.301824000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.response_computer_name": "DESKTOP-RNVO9AT", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-ee87ff9016e8e09989fbd03d", "kind": "identity", "frame_number": 950, "timestamp_epoch": "1725471278.319856000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.response_computer_name": "DESKTOP-RNVO9AT", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-aedb1ac470c04e35190e0691", "kind": "identity", "frame_number": 1068, "timestamp_epoch": "1725471280.061665000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-99d10bd7cb539b41f611abc5", "kind": "identity", "frame_number": 1070, "timestamp_epoch": "1725471280.063118000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-f73cff4d1565e2ac132785f3", "kind": "identity", "frame_number": 1071, "timestamp_epoch": "1725471280.063388000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "15" } }, { "event_id": "evt-00ca44e760c4fe7905a4621d", "kind": "identity", "frame_number": 1095, "timestamp_epoch": "1725471280.072734000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-4f5b35b4587aa7e95ce42237", "kind": "identity", "frame_number": 1097, "timestamp_epoch": "1725471280.074307000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-3a264f050a2d1a9ee5eb03a4", "kind": "identity", "frame_number": 1108, "timestamp_epoch": "1725471280.078342000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 36, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-21f80a0c0288c52bb1d9771d", "kind": "identity", "frame_number": 1110, "timestamp_epoch": "1725471280.079136000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 36, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-4b86c1bc61d32f171a7c568d", "kind": "identity", "frame_number": 1228, "timestamp_epoch": "1725471289.962054000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-fc49fabd3122bdf0e86ac7ff", "kind": "identity", "frame_number": 1231, "timestamp_epoch": "1725471289.962054000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-4e97d70e22807b9491c9d958", "kind": "identity", "frame_number": 1233, "timestamp_epoch": "1725471289.962642000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-39524a0b1fd06123a8aa99e2", "kind": "identity", "frame_number": 1234, "timestamp_epoch": "1725471289.962642000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-d78b5f9dfdcb102d972d8ddd", "kind": "identity", "frame_number": 1435, "timestamp_epoch": "1725471306.287429000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-2678faf45f7c99bf821c2331", "kind": "identity", "frame_number": 1437, "timestamp_epoch": "1725471306.288839000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-c58b08dfeeb14f2aa3dabc28", "kind": "identity", "frame_number": 1438, "timestamp_epoch": "1725471306.289228000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "15" } }, { "event_id": "evt-0b898013111e6f6bbe6f53d1", "kind": "identity", "frame_number": 1462, "timestamp_epoch": "1725471306.299514000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 44, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-6aaabf38e55d7415be35ad0a", "kind": "identity", "frame_number": 1465, "timestamp_epoch": "1725471306.301060000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 44, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-da7b48713ab83315d9253b5b", "kind": "identity", "frame_number": 1476, "timestamp_epoch": "1725471306.305744000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 45, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-3312d2cc93f5d59d65c16348", "kind": "identity", "frame_number": 1478, "timestamp_epoch": "1725471306.307290000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 45, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-d92e8578fda1d05d898fccb1", "kind": "identity", "frame_number": 1682, "timestamp_epoch": "1725471308.334485000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 49, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-81b5ed730a491419d0eefb5d", "kind": "identity", "frame_number": 1683, "timestamp_epoch": "1725471308.335111000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 49, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-35a375d3312feab4e19358d5", "kind": "identity", "frame_number": 1684, "timestamp_epoch": "1725471308.336321000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 49, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "ntlmssp.auth.domain": "NULL", "ntlmssp.auth.hostname": "DESKTOP-RNVO9AT", "ntlmssp.auth.username": "NULL" } }, { "event_id": "evt-43cfeaa515d551f1b554c88b", "kind": "identity", "frame_number": 1690, "timestamp_epoch": "1725471308.340942000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.response_computer_name": "DESKTOP-RNVO9AT", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-8fd5025d5bc257d9f50bb692", "kind": "identity", "frame_number": 1693, "timestamp_epoch": "1725471308.360340000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.response_computer_name": "DESKTOP-RNVO9AT", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-eeb46d4cf76fd5582ea5ff63", "kind": "identity", "frame_number": 2265, "timestamp_epoch": "1725471336.273610000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-e788ef69c296192a199693b9", "kind": "identity", "frame_number": 2267, "timestamp_epoch": "1725471336.275112000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-89e7a07963a7ef75dbe8c595", "kind": "identity", "frame_number": 2268, "timestamp_epoch": "1725471336.275997000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "15" } }, { "event_id": "evt-e0bb3f87aa930dd1a4a5c134", "kind": "identity", "frame_number": 2292, "timestamp_epoch": "1725471336.298170000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 54, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-4280dcf4c09483e45770cc44", "kind": "identity", "frame_number": 2294, "timestamp_epoch": "1725471336.299715000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 54, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-1913d3d973d15fabff9a95dc", "kind": "identity", "frame_number": 2305, "timestamp_epoch": "1725471336.308259000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 55, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-b4f3d51fe83a09df6ecf2a3a", "kind": "identity", "frame_number": 2307, "timestamp_epoch": "1725471336.309847000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 55, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-8890b8d189aa5a8fcbcb768c", "kind": "identity", "frame_number": 3006, "timestamp_epoch": "1725471470.869850000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 65, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "12,14" } }, { "event_id": "evt-b826bc9978ff8a7d4416afbb", "kind": "identity", "frame_number": 3009, "timestamp_epoch": "1725471470.872547000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 65, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.CNameString": "afletcher", "kerberos.msg_type": "13" } }, { "event_id": "evt-b9678c9357ce5c5e1178a872", "kind": "identity", "frame_number": 3015, "timestamp_epoch": "1725471470.873223000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 64, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-56cf8a3219d82f8d7a3f33dd", "kind": "identity", "frame_number": 3017, "timestamp_epoch": "1725471470.874745000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 64, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-b7eb8d3c7aa20fff5422f0f4", "kind": "identity", "frame_number": 3028, "timestamp_epoch": "1725471470.885465000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 66, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-63bf8d166905071748436b6a", "kind": "identity", "frame_number": 3030, "timestamp_epoch": "1725471470.886990000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 66, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-8e31fcad0e876cfccbe5626e", "kind": "identity", "frame_number": 3101, "timestamp_epoch": "1725471576.757205000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 69, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-213c1b6ed0d7396e2871510f", "kind": "identity", "frame_number": 3103, "timestamp_epoch": "1725471576.759128000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 69, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-b7f76108b1363a0720842a45", "kind": "identity", "frame_number": 3112, "timestamp_epoch": "1725471576.767157000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 70, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-401d9eca8201a251b4c768e8", "kind": "identity", "frame_number": 3114, "timestamp_epoch": "1725471576.768679000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 70, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-7fa27f74a93d6953419fc416", "kind": "identity", "frame_number": 3136, "timestamp_epoch": "1725471598.938238000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-8bcef40083256aff13a9f876", "kind": "identity", "frame_number": 3137, "timestamp_epoch": "1725471598.938238000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-00c1b486311b56848fd1356d", "kind": "identity", "frame_number": 3172, "timestamp_epoch": "1725471638.092121000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.server": "DESKTOP-RNVO9AT", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-334174bbf3b46f5f7b59564a", "kind": "identity", "frame_number": 3297, "timestamp_epoch": "1725471878.247067000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-724f3d54326f6e5802e8b8b9", "kind": "identity", "frame_number": 3299, "timestamp_epoch": "1725471878.248800000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-dd6691b356776b7d954d6f0a", "kind": "identity", "frame_number": 3479, "timestamp_epoch": "1725472078.209477000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-e666d31b042d8b0d21cc4c5b", "kind": "identity", "frame_number": 3480, "timestamp_epoch": "1725472078.209849000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-3b806407d9203f7d4da2f060", "kind": "identity", "frame_number": 3481, "timestamp_epoch": "1725472078.210464000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-794d95fb06b597799af16569", "kind": "identity", "frame_number": 3484, "timestamp_epoch": "1725472078.211569000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-c868cc8f4c8660131c9545ed", "kind": "identity", "frame_number": 3486, "timestamp_epoch": "1725472078.213715000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-27a0597fac16ab621c7f508b", "kind": "identity", "frame_number": 3487, "timestamp_epoch": "1725472078.214168000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-d3520481e31b4cddae5104d4", "kind": "identity", "frame_number": 3488, "timestamp_epoch": "1725472078.214432000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-bef343db8162a633a7432ff9", "kind": "identity", "frame_number": 3489, "timestamp_epoch": "1725472078.214764000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-8147ce1901b2511ec15d5064", "kind": "identity", "frame_number": 3490, "timestamp_epoch": "1725472078.214932000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-6eec24427e956eb3cfeb9ed7", "kind": "identity", "frame_number": 3491, "timestamp_epoch": "1725472078.215019000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-b43c7f1c7f68c0b9ba9768d6", "kind": "identity", "frame_number": 3492, "timestamp_epoch": "1725472078.215233000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-0680004d1197991ff9c991f2", "kind": "identity", "frame_number": 3498, "timestamp_epoch": "1725472088.943230000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-b2e8008bc946747d7f032238", "kind": "identity", "frame_number": 3499, "timestamp_epoch": "1725472088.943230000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-d7077d98aefcf4879fe8eb66", "kind": "identity", "frame_number": 3500, "timestamp_epoch": "1725472088.943625000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-8c24feef8d151e7d8288a7df", "kind": "identity", "frame_number": 3501, "timestamp_epoch": "1725472088.943952000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 87, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-8933fb3b3042f76a90a3f520", "kind": "identity", "frame_number": 3537, "timestamp_epoch": "1725472117.066941000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.server": "DESKTOP-RNVO9AT", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-dc014c26d36513308d1ed881", "kind": "identity", "frame_number": 3560, "timestamp_epoch": "1725472175.781710000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 91, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-9067d6cd629229e90a65b026", "kind": "identity", "frame_number": 3562, "timestamp_epoch": "1725472175.783159000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 91, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-8dc6755def386ff43144836e", "kind": "identity", "frame_number": 3563, "timestamp_epoch": "1725472175.783541000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 91, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "15" } }, { "event_id": "evt-d4c24138a797010cdae282b4", "kind": "identity", "frame_number": 3587, "timestamp_epoch": "1725472175.794146000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 92, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-c4ad6334d3d9753df5ea7977", "kind": "identity", "frame_number": 3589, "timestamp_epoch": "1725472175.795404000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 92, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-721f971493a41835b5ba3523", "kind": "identity", "frame_number": 3600, "timestamp_epoch": "1725472175.799429000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-85cb4670eacb54baa35faacc", "kind": "identity", "frame_number": 3602, "timestamp_epoch": "1725472175.800184000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-7017a02aaaefd9880d0e791a", "kind": "identity", "frame_number": 3778, "timestamp_epoch": "1725472199.286175000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-a4ae261ee968678dbaadb8bd", "kind": "identity", "frame_number": 3779, "timestamp_epoch": "1725472199.286214000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-d26ddaf19f9cd16b71efe68b", "kind": "identity", "frame_number": 4031, "timestamp_epoch": "1725472799.634039000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-ac81d9114d951459d6706c38", "kind": "identity", "frame_number": 4032, "timestamp_epoch": "1725472799.634039000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-1cbdaebe4f58af88b8a9fa8c", "kind": "identity", "frame_number": 4075, "timestamp_epoch": "1725472836.379367000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.server": "DESKTOP-RNVO9AT", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-394e2a8097f5d4c708ebcc7e", "kind": "identity", "frame_number": 4194, "timestamp_epoch": "1725472978.208193000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 115, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-2e43a531f086f7400235cabd", "kind": "identity", "frame_number": 4195, "timestamp_epoch": "1725472978.208535000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 115, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-1df808b5b14b1924e0b500a2", "kind": "identity", "frame_number": 4196, "timestamp_epoch": "1725472978.209133000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 115, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-ecc2d06d39fbbbdd59c6e9b8", "kind": "identity", "frame_number": 4199, "timestamp_epoch": "1725472978.210313000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 115, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-146f3999c283fb0b610faafb", "kind": "identity", "frame_number": 4201, "timestamp_epoch": "1725472978.212460000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 115, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-567ae8a9d4b7399f6e5a7afc", "kind": "identity", "frame_number": 4202, "timestamp_epoch": "1725472978.212881000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 115, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-4fcde8ab206f2d6f4a300a2f", "kind": "identity", "frame_number": 4203, "timestamp_epoch": "1725472978.213087000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 115, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-b350adb14eab41d2b621819c", "kind": "identity", "frame_number": 4204, "timestamp_epoch": "1725472978.213390000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 115, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-3472852e0c6ae3db312a9218", "kind": "identity", "frame_number": 4205, "timestamp_epoch": "1725472978.213408000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 115, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-581b1f34584aaadc8c3fd037", "kind": "identity", "frame_number": 4207, "timestamp_epoch": "1725472978.213587000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 115, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-dd2ccec74aff63f540a42090", "kind": "identity", "frame_number": 4208, "timestamp_epoch": "1725472978.213738000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 115, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-53a55aa502a1b6854c9fe590", "kind": "identity", "frame_number": 4218, "timestamp_epoch": "1725472988.918182000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 115, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-79912065ea368fc24142e81e", "kind": "identity", "frame_number": 4219, "timestamp_epoch": "1725472988.918182000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 115, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-9c4c4170edbf318b2282c61d", "kind": "identity", "frame_number": 4220, "timestamp_epoch": "1725472988.918906000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 115, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-a6feb83411ed600e32cc97af", "kind": "identity", "frame_number": 4221, "timestamp_epoch": "1725472988.918906000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 115, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-cec4c6c43dfe9758a0d20b86", "kind": "identity", "frame_number": 4464, "timestamp_epoch": "1725473399.970958000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-9215ab3aeee04d9210455955", "kind": "identity", "frame_number": 4465, "timestamp_epoch": "1725473399.971030000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-debdafeeb36e2dd5c0722162", "kind": "identity", "frame_number": 4534, "timestamp_epoch": "1725473559.294023000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.server": "DESKTOP-RNVO9AT", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-31cf8f2bf97a063d81b0b965", "kind": "identity", "frame_number": 4564, "timestamp_epoch": "1725473582.134505000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-f07e9d314bbb7c5b653f5916", "kind": "identity", "frame_number": 4566, "timestamp_epoch": "1725473582.135864000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-6ac993d508accad59f766e8a", "kind": "identity", "frame_number": 4567, "timestamp_epoch": "1725473582.136263000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "15" } }, { "event_id": "evt-955b1d3299912f46a5d2affb", "kind": "identity", "frame_number": 4595, "timestamp_epoch": "1725473582.253520000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-fada2a8a08090e1182c483b2", "kind": "identity", "frame_number": 4597, "timestamp_epoch": "1725473582.254343000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-2617560a3c471f8365266a6d", "kind": "identity", "frame_number": 4608, "timestamp_epoch": "1725473582.265434000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 132, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-2ea2c3a225d3f4ca5afd116a", "kind": "identity", "frame_number": 4610, "timestamp_epoch": "1725473582.266232000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 132, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-17603f0334bb3b5af56666a3", "kind": "identity", "frame_number": 4763, "timestamp_epoch": "1725473878.191126000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-acb208316a10abd309f40611", "kind": "identity", "frame_number": 4764, "timestamp_epoch": "1725473878.191522000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-afd142cd1a746e09849b37c1", "kind": "identity", "frame_number": 4765, "timestamp_epoch": "1725473878.192048000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-8973634ad650c6357fa30a92", "kind": "identity", "frame_number": 4768, "timestamp_epoch": "1725473878.193191000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-6ecea1e15d45914014890423", "kind": "identity", "frame_number": 4770, "timestamp_epoch": "1725473878.195427000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-52a17e878d18a4c2b514b336", "kind": "identity", "frame_number": 4771, "timestamp_epoch": "1725473878.195848000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-e11a985639d850c6d830da65", "kind": "identity", "frame_number": 4772, "timestamp_epoch": "1725473878.196092000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-0e28c7c4d3df60227c2458c5", "kind": "identity", "frame_number": 4773, "timestamp_epoch": "1725473878.196406000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-196f6f4bdcf67901a1879033", "kind": "identity", "frame_number": 4774, "timestamp_epoch": "1725473878.196591000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-a79b639e4521ed3deb57e3ec", "kind": "identity", "frame_number": 4775, "timestamp_epoch": "1725473878.196609000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-949ec8ffaee44d843de0d35f", "kind": "identity", "frame_number": 4776, "timestamp_epoch": "1725473878.196873000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-9d8ce8ad6ab568251b02876f", "kind": "identity", "frame_number": 4790, "timestamp_epoch": "1725473888.924775000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-bed870089538ce1b4b5f3d5e", "kind": "identity", "frame_number": 4791, "timestamp_epoch": "1725473888.924775000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-ee1b11a7e3d77ec7bd955332", "kind": "identity", "frame_number": 4792, "timestamp_epoch": "1725473888.925512000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-7b944a3fb62bbff026ef5f2c", "kind": "identity", "frame_number": 4793, "timestamp_epoch": "1725473888.925512000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 138, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-f6798df3645833777702d441", "kind": "identity", "frame_number": 4817, "timestamp_epoch": "1725474000.305859000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-480d2657597c31b720ca7808", "kind": "identity", "frame_number": 4818, "timestamp_epoch": "1725474000.305910000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-814fbc8048f66d82c05281a0", "kind": "identity", "frame_number": 4908, "timestamp_epoch": "1725474279.648734000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.255", "src_port": null, "dst_port": null, "tcp_stream": null, "udp_stream": 14, "fields": { "browser.server": "DESKTOP-RNVO9AT", "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-45b5a8a96bd63803703260d9", "kind": "identity", "frame_number": 4995, "timestamp_epoch": "1725474600.649398000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4" } }, { "event_id": "evt-feae66109b181541cb85bcdf", "kind": "identity", "frame_number": 4996, "timestamp_epoch": "1725474600.649398000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 20, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd" } }, { "event_id": "evt-83e2bd0b14d82b014194a50b", "kind": "identity", "frame_number": 5053, "timestamp_epoch": "1725474712.482512000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 153, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "14" } }, { "event_id": "evt-8e82486d27b709ad352dd066", "kind": "identity", "frame_number": 5055, "timestamp_epoch": "1725474712.483837000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 153, "udp_stream": null, "fields": { "eth.dst": "18:3d:a2:b6:8d:c4", "eth.src": "00:23:ae:50:ba:fd", "kerberos.msg_type": "15" } }, { "event_id": "evt-02440c2fdad544c53a10b5c2", "kind": "identity", "frame_number": 5056, "timestamp_epoch": "1725474712.484070000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 153, "udp_stream": null, "fields": { "eth.dst": "00:23:ae:50:ba:fd", "eth.src": "18:3d:a2:b6:8d:c4", "kerberos.msg_type": "15" } } ], "directory_service": [ { "event_id": "evt-b50706f21e28f855c3c9df3c", "kind": "directory_service", "frame_number": 31, "timestamp_epoch": "1725471151.433000000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-f45ac52c0c1b73a6ce026ac1", "kind": "directory_service", "frame_number": 33, "timestamp_epoch": "1725471151.433776000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-b91f650611c53eb2b73c732d", "kind": "directory_service", "frame_number": 34, "timestamp_epoch": "1725471151.434061000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 0, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-2e13999d9255176563adbddb", "kind": "directory_service", "frame_number": 382, "timestamp_epoch": "1725471275.487359000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 14, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-9fb3590bf76ab09980f58840", "kind": "directory_service", "frame_number": 384, "timestamp_epoch": "1725471275.487796000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 14, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-7be876f73328e6fd88c5cbaa", "kind": "directory_service", "frame_number": 385, "timestamp_epoch": "1725471275.488004000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 14, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-97a71bd27f6d93994bb5b20c", "kind": "directory_service", "frame_number": 386, "timestamp_epoch": "1725471275.488723000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 14, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-19efb6c011bb4541f1e5f560", "kind": "directory_service", "frame_number": 387, "timestamp_epoch": "1725471275.488895000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 14, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-9bd5bb9f9a7b3b9fb58be023", "kind": "directory_service", "frame_number": 388, "timestamp_epoch": "1725471275.489598000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 14, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-8122ff374d77f6e6e2e24eab", "kind": "directory_service", "frame_number": 389, "timestamp_epoch": "1725471275.489718000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 14, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-1426f400e3e49779bdd28cf3", "kind": "directory_service", "frame_number": 391, "timestamp_epoch": "1725471275.489946000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 14, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-deb82813dc9a214f94c5d2bc", "kind": "directory_service", "frame_number": 409, "timestamp_epoch": "1725471275.491823000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-4a2b0a0393b7cd02603576b0", "kind": "directory_service", "frame_number": 410, "timestamp_epoch": "1725471275.492327000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "64" } }, { "event_id": "evt-4b305f96d4705989e8ca9fbe", "kind": "directory_service", "frame_number": 412, "timestamp_epoch": "1725471275.492576000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-44b2c5d19eaf30142c411374", "kind": "directory_service", "frame_number": 413, "timestamp_epoch": "1725471275.492594000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-16e273fc0174ec744974fe72", "kind": "directory_service", "frame_number": 415, "timestamp_epoch": "1725471275.493110000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "6" } }, { "event_id": "evt-1144fc79799282cc84e37be0", "kind": "directory_service", "frame_number": 416, "timestamp_epoch": "1725471275.493261000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-42c2fe39a8169cd3cb0028e0", "kind": "directory_service", "frame_number": 417, "timestamp_epoch": "1725471275.493798000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "5" } }, { "event_id": "evt-e0dcf0f5e39a1f80267eef3b", "kind": "directory_service", "frame_number": 418, "timestamp_epoch": "1725471275.493938000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-c07944c86c27b22e0f1cd135", "kind": "directory_service", "frame_number": 419, "timestamp_epoch": "1725471275.494529000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-1eb1a318dda420f6ad8ab692", "kind": "directory_service", "frame_number": 420, "timestamp_epoch": "1725471275.494592000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-9307db44ba9a3809a20d35a6", "kind": "directory_service", "frame_number": 421, "timestamp_epoch": "1725471275.494763000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-cd3250c03c3ae5db074f85ca", "kind": "directory_service", "frame_number": 422, "timestamp_epoch": "1725471275.495317000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "7" } }, { "event_id": "evt-a2663cf9f40ffebbba43733a", "kind": "directory_service", "frame_number": 423, "timestamp_epoch": "1725471275.495492000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-73cf5bb638bcbabf8e87ccd7", "kind": "directory_service", "frame_number": 424, "timestamp_epoch": "1725471275.496085000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "17" } }, { "event_id": "evt-64ad9cb404084f377249ea48", "kind": "directory_service", "frame_number": 425, "timestamp_epoch": "1725471275.496220000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "34" } }, { "event_id": "evt-33555193e63035f62b6f77ca", "kind": "directory_service", "frame_number": 426, "timestamp_epoch": "1725471275.497023000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "34" } }, { "event_id": "evt-7c627b1b512923ceca70bd98", "kind": "directory_service", "frame_number": 427, "timestamp_epoch": "1725471275.497152000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "36" } }, { "event_id": "evt-212e2bc25d1a708532aad5eb", "kind": "directory_service", "frame_number": 428, "timestamp_epoch": "1725471275.498011000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "36", "samr.samr_UserInfo21.account_name": "afletcher", "samr.samr_UserInfo21.full_name": "Andrew Fletcher" } }, { "event_id": "evt-58f679aeb5ae4fec13bb5d55", "kind": "directory_service", "frame_number": 429, "timestamp_epoch": "1725471275.498143000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "3" } }, { "event_id": "evt-eaaa44022fcd7fb99af8e799", "kind": "directory_service", "frame_number": 430, "timestamp_epoch": "1725471275.498180000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "ldap.baseObject": "DC=bepositive,DC=com", "ldap.filter": "1", "ldap.protocolOp": "3" } }, { "event_id": "evt-aa3143161e36cd034cc0ef3a", "kind": "directory_service", "frame_number": 431, "timestamp_epoch": "1725471275.498918000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "ldap.protocolOp": "4,19,19,19,5" } }, { "event_id": "evt-240bd71117cd907a65529ba7", "kind": "directory_service", "frame_number": 432, "timestamp_epoch": "1725471275.499053000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "3" } }, { "event_id": "evt-46d3ba578a904699f3a0fe22", "kind": "directory_service", "frame_number": 433, "timestamp_epoch": "1725471275.499194000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "39" } }, { "event_id": "evt-8612aa9d5823b5cced36860c", "kind": "directory_service", "frame_number": 434, "timestamp_epoch": "1725471275.499727000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "39" } }, { "event_id": "evt-a34f3dd225b7614103d820ee", "kind": "directory_service", "frame_number": 436, "timestamp_epoch": "1725471275.499914000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "16" } }, { "event_id": "evt-d92acfbf5ff2d40864256d00", "kind": "directory_service", "frame_number": 439, "timestamp_epoch": "1725471275.500351000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "16" } }, { "event_id": "evt-e3dec0b6bea23167fc7df6aa", "kind": "directory_service", "frame_number": 440, "timestamp_epoch": "1725471275.500507000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-1107ef780f5d202c32fb509d", "kind": "directory_service", "frame_number": 441, "timestamp_epoch": "1725471275.500908000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-81bc0aaba6a6b99caa3b72b2", "kind": "directory_service", "frame_number": 443, "timestamp_epoch": "1725471275.501123000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-2cc76695988101fb3c362cba", "kind": "directory_service", "frame_number": 444, "timestamp_epoch": "1725471275.501141000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-50858b5e391449649e0fd72e", "kind": "directory_service", "frame_number": 446, "timestamp_epoch": "1725471275.501610000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-f9797620334589886610a618", "kind": "directory_service", "frame_number": 447, "timestamp_epoch": "1725471275.501755000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-9b9e12a43b399434699be479", "kind": "directory_service", "frame_number": 448, "timestamp_epoch": "1725471275.502192000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-f54c0aae81e87295cc662574", "kind": "directory_service", "frame_number": 449, "timestamp_epoch": "1725471275.502313000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-eb40b72b43a529c4888511eb", "kind": "directory_service", "frame_number": 450, "timestamp_epoch": "1725471275.502748000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 13, "udp_stream": null, "fields": { "samr.opnum": "1" } }, { "event_id": "evt-4c2c54c6e171a0d96af10401", "kind": "directory_service", "frame_number": 452, "timestamp_epoch": "1725471275.502867000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-d996c389ff713827a8a7438a", "kind": "directory_service", "frame_number": 454, "timestamp_epoch": "1725471275.503133000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-3858c03d679a5c50705878b1", "kind": "directory_service", "frame_number": 455, "timestamp_epoch": "1725471275.503379000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-72b0e596e41d8347e5c59c3e", "kind": "directory_service", "frame_number": 456, "timestamp_epoch": "1725471275.503548000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=bepositive,DC=com", "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-e7535e7f6a0a3b1949b1a1d5", "kind": "directory_service", "frame_number": 457, "timestamp_epoch": "1725471275.503918000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-7f85e37205a310a1523b77cc", "kind": "directory_service", "frame_number": 458, "timestamp_epoch": "1725471275.504158000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "ldap.baseObject": "cn=policies,cn=system,DC=bepositive,DC=com", "ldap.filter": "0", "ldap.protocolOp": "3" } }, { "event_id": "evt-4d1077e7b4145d42e46170e5", "kind": "directory_service", "frame_number": 459, "timestamp_epoch": "1725471275.504814000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "ldap.protocolOp": "5" } }, { "event_id": "evt-5abd0c24a9587d66e21c5cd2", "kind": "directory_service", "frame_number": 460, "timestamp_epoch": "1725471275.509681000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 19, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-b61d6173e02db132a0043f65", "kind": "directory_service", "frame_number": 464, "timestamp_epoch": "1725471275.512106000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 18, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-4756940c6373e6a0addb20ad", "kind": "directory_service", "frame_number": 1073, "timestamp_epoch": "1725471280.064881000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-a938297c41dd18ab3c77ab51", "kind": "directory_service", "frame_number": 1074, "timestamp_epoch": "1725471280.065417000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-69a2e944021e4e22b15d7e65", "kind": "directory_service", "frame_number": 1075, "timestamp_epoch": "1725471280.065597000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-a9a0505dace1f9d0dd67c754", "kind": "directory_service", "frame_number": 1076, "timestamp_epoch": "1725471280.066267000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-e333e575ae037e83d3d0d925", "kind": "directory_service", "frame_number": 1077, "timestamp_epoch": "1725471280.066380000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-bbc86ccf9bf7d6ac090ddd95", "kind": "directory_service", "frame_number": 1078, "timestamp_epoch": "1725471280.066598000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-1548ea178fdb9769aeffb705", "kind": "directory_service", "frame_number": 1081, "timestamp_epoch": "1725471280.068000000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-ac06821ecb1a542161f5eed6", "kind": "directory_service", "frame_number": 1082, "timestamp_epoch": "1725471280.068331000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-51373cf42464471826a8c17d", "kind": "directory_service", "frame_number": 1083, "timestamp_epoch": "1725471280.068459000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-ad81ecc0bb795030bdd44f27", "kind": "directory_service", "frame_number": 1084, "timestamp_epoch": "1725471280.069061000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-966f81a867ea1b8211e07791", "kind": "directory_service", "frame_number": 1085, "timestamp_epoch": "1725471280.069158000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-737e0b12d68145e4bc97795f", "kind": "directory_service", "frame_number": 1086, "timestamp_epoch": "1725471280.069418000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 34, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-5eec324b5f92056188a531b3", "kind": "directory_service", "frame_number": 1090, "timestamp_epoch": "1725471280.071077000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-66706ef4285452485457eed9", "kind": "directory_service", "frame_number": 1092, "timestamp_epoch": "1725471280.071847000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-7faae5832d3a6a93f5ee0c31", "kind": "directory_service", "frame_number": 1095, "timestamp_epoch": "1725471280.072734000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-7fcc0de4cc21fce783d92324", "kind": "directory_service", "frame_number": 1097, "timestamp_epoch": "1725471280.074307000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-078230e318e15efefb20c241", "kind": "directory_service", "frame_number": 1098, "timestamp_epoch": "1725471280.074571000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": {} }, { "event_id": "evt-bcd56f74fb0fbe527bda6132", "kind": "directory_service", "frame_number": 1099, "timestamp_epoch": "1725471280.074994000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": {} }, { "event_id": "evt-a21b1c98184aff7a59625a4c", "kind": "directory_service", "frame_number": 1100, "timestamp_epoch": "1725471280.075141000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": {} }, { "event_id": "evt-f936987248eab3c313e377f5", "kind": "directory_service", "frame_number": 1101, "timestamp_epoch": "1725471280.075489000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": {} }, { "event_id": "evt-f41e08874d5a7779dfafe1ad", "kind": "directory_service", "frame_number": 1102, "timestamp_epoch": "1725471280.075615000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": {} }, { "event_id": "evt-795622c4cf2c08f732d44d66", "kind": "directory_service", "frame_number": 1103, "timestamp_epoch": "1725471280.075982000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": {} }, { "event_id": "evt-b522eefbc52fafc31d28fd12", "kind": "directory_service", "frame_number": 1108, "timestamp_epoch": "1725471280.078342000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 36, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-4e391c4fde0eff5290ab7840", "kind": "directory_service", "frame_number": 1110, "timestamp_epoch": "1725471280.079136000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 36, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-93c0e1aae27607d23714123f", "kind": "directory_service", "frame_number": 1111, "timestamp_epoch": "1725471280.079385000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 36, "udp_stream": null, "fields": {} }, { "event_id": "evt-f5bb274b8813a37b09fe93a7", "kind": "directory_service", "frame_number": 1114, "timestamp_epoch": "1725471280.079994000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 36, "udp_stream": null, "fields": {} }, { "event_id": "evt-4e756bddc35b9dfe1fa0e752", "kind": "directory_service", "frame_number": 1116, "timestamp_epoch": "1725471280.080142000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 36, "udp_stream": null, "fields": {} }, { "event_id": "evt-290c4cdc73fc60f1b19d210c", "kind": "directory_service", "frame_number": 1117, "timestamp_epoch": "1725471280.080390000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 36, "udp_stream": null, "fields": {} }, { "event_id": "evt-e38e862bdc6132ba47cb87c0", "kind": "directory_service", "frame_number": 1118, "timestamp_epoch": "1725471280.080498000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 36, "udp_stream": null, "fields": {} }, { "event_id": "evt-1ada0d03669d1f73f3c58d61", "kind": "directory_service", "frame_number": 1121, "timestamp_epoch": "1725471280.080647000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 35, "udp_stream": null, "fields": {} }, { "event_id": "evt-ead98f5f3fe88f34e1535e30", "kind": "directory_service", "frame_number": 1440, "timestamp_epoch": "1725471306.290821000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-4248025937d39c5be1d4350d", "kind": "directory_service", "frame_number": 1441, "timestamp_epoch": "1725471306.291308000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-58e647db7dde305a5c3b8900", "kind": "directory_service", "frame_number": 1442, "timestamp_epoch": "1725471306.291618000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-c542afcf025aa1125bc6460b", "kind": "directory_service", "frame_number": 1443, "timestamp_epoch": "1725471306.292294000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-f503f4a3e4c6c5ec73fa594a", "kind": "directory_service", "frame_number": 1444, "timestamp_epoch": "1725471306.292556000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-5c47ac8a9549df1ef9e8b28d", "kind": "directory_service", "frame_number": 1445, "timestamp_epoch": "1725471306.292766000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-33e052541fec341c6e5ac217", "kind": "directory_service", "frame_number": 1448, "timestamp_epoch": "1725471306.294379000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-24a2fa88f9de97e5b6866525", "kind": "directory_service", "frame_number": 1449, "timestamp_epoch": "1725471306.294708000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-251f607906f90d1ca20d6fe4", "kind": "directory_service", "frame_number": 1450, "timestamp_epoch": "1725471306.294987000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-0104fc9ddb81352cb8709236", "kind": "directory_service", "frame_number": 1451, "timestamp_epoch": "1725471306.295594000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-653240b0441670c00f1acd09", "kind": "directory_service", "frame_number": 1452, "timestamp_epoch": "1725471306.295849000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-517e24f4324b1ffbebaa56e3", "kind": "directory_service", "frame_number": 1453, "timestamp_epoch": "1725471306.296049000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 43, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-627c96ab14949c63c5b9b094", "kind": "directory_service", "frame_number": 1457, "timestamp_epoch": "1725471306.297898000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 44, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-e6d0e633b805d7409f993451", "kind": "directory_service", "frame_number": 1459, "timestamp_epoch": "1725471306.298697000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 44, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-06e5de18d28bd36fe0799b5c", "kind": "directory_service", "frame_number": 1462, "timestamp_epoch": "1725471306.299514000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 44, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-6e8ddebe62a0b35a6117543f", "kind": "directory_service", "frame_number": 1465, "timestamp_epoch": "1725471306.301060000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 44, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-2bde980d17c305a2011112fe", "kind": "directory_service", "frame_number": 1466, "timestamp_epoch": "1725471306.301487000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 44, "udp_stream": null, "fields": {} }, { "event_id": "evt-f244c943df8b9a7eb8e171c4", "kind": "directory_service", "frame_number": 1467, "timestamp_epoch": "1725471306.301925000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 44, "udp_stream": null, "fields": {} }, { "event_id": "evt-615fb2cf1791f3fcf3aa890e", "kind": "directory_service", "frame_number": 1468, "timestamp_epoch": "1725471306.302227000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 44, "udp_stream": null, "fields": {} }, { "event_id": "evt-d406ae88accae663d8a3f4c5", "kind": "directory_service", "frame_number": 1469, "timestamp_epoch": "1725471306.302581000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 44, "udp_stream": null, "fields": {} }, { "event_id": "evt-ceaecc1749c4bd35a930099e", "kind": "directory_service", "frame_number": 1470, "timestamp_epoch": "1725471306.302878000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 44, "udp_stream": null, "fields": {} }, { "event_id": "evt-fc0f69c352e4eb581c0d06b9", "kind": "directory_service", "frame_number": 1471, "timestamp_epoch": "1725471306.303249000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 44, "udp_stream": null, "fields": {} }, { "event_id": "evt-9c4c7242943f01b744a453e1", "kind": "directory_service", "frame_number": 1476, "timestamp_epoch": "1725471306.305744000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 45, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-93770c640c0500c10ce701e4", "kind": "directory_service", "frame_number": 1478, "timestamp_epoch": "1725471306.307290000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 45, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-958d8bae4fe91f393c08aaec", "kind": "directory_service", "frame_number": 1479, "timestamp_epoch": "1725471306.307647000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 45, "udp_stream": null, "fields": {} }, { "event_id": "evt-f51aa76acc41e55a8f28a2a7", "kind": "directory_service", "frame_number": 1482, "timestamp_epoch": "1725471306.308524000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 45, "udp_stream": null, "fields": {} }, { "event_id": "evt-48ee356b6de06466cb127ef3", "kind": "directory_service", "frame_number": 1484, "timestamp_epoch": "1725471306.308675000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 45, "udp_stream": null, "fields": {} }, { "event_id": "evt-b959611e149daf521e44cceb", "kind": "directory_service", "frame_number": 1485, "timestamp_epoch": "1725471306.309206000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 45, "udp_stream": null, "fields": {} }, { "event_id": "evt-931838096e93a2f1b1944ac6", "kind": "directory_service", "frame_number": 1486, "timestamp_epoch": "1725471306.309483000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 45, "udp_stream": null, "fields": {} }, { "event_id": "evt-b9886f0e33fd9c2a8a5b3be9", "kind": "directory_service", "frame_number": 1488, "timestamp_epoch": "1725471306.309623000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 44, "udp_stream": null, "fields": {} }, { "event_id": "evt-3fe09fffb20e221dd98aef40", "kind": "directory_service", "frame_number": 2270, "timestamp_epoch": "1725471336.280751000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-8ed8d20770062110197f949c", "kind": "directory_service", "frame_number": 2271, "timestamp_epoch": "1725471336.281244000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-c4b51539a22e49ab05c00bc2", "kind": "directory_service", "frame_number": 2272, "timestamp_epoch": "1725471336.282167000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-4d3e390cb015040195589913", "kind": "directory_service", "frame_number": 2273, "timestamp_epoch": "1725471336.282937000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-96dd7437cc2e0cb3d5531a70", "kind": "directory_service", "frame_number": 2274, "timestamp_epoch": "1725471336.283480000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-1d48d6ec704427c28dd4dfe6", "kind": "directory_service", "frame_number": 2275, "timestamp_epoch": "1725471336.283854000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-99545346e7f754a11fcaae0a", "kind": "directory_service", "frame_number": 2278, "timestamp_epoch": "1725471336.287328000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-fb0690a81d04b76e75c7e94a", "kind": "directory_service", "frame_number": 2279, "timestamp_epoch": "1725471336.287735000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-b879135f02e1d92310360fce", "kind": "directory_service", "frame_number": 2280, "timestamp_epoch": "1725471336.288333000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-9b6fe1d3ab9973bfb15a4a20", "kind": "directory_service", "frame_number": 2281, "timestamp_epoch": "1725471336.289099000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-6084ffad9c954456104b2c72", "kind": "directory_service", "frame_number": 2282, "timestamp_epoch": "1725471336.289639000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-7c4b54e3e97d25cd127e901b", "kind": "directory_service", "frame_number": 2283, "timestamp_epoch": "1725471336.289993000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 53, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-641812ca0ca8995306cf0ece", "kind": "directory_service", "frame_number": 2287, "timestamp_epoch": "1725471336.295378000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 54, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-5534ca00488ec60864f5e13a", "kind": "directory_service", "frame_number": 2289, "timestamp_epoch": "1725471336.296276000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 54, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-4caf27019bce5fa4abcfca81", "kind": "directory_service", "frame_number": 2292, "timestamp_epoch": "1725471336.298170000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 54, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-8fbe5a778c50af97a3d8c3db", "kind": "directory_service", "frame_number": 2294, "timestamp_epoch": "1725471336.299715000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 54, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-892ac4cd39aff567876006c8", "kind": "directory_service", "frame_number": 2295, "timestamp_epoch": "1725471336.300536000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 54, "udp_stream": null, "fields": {} }, { "event_id": "evt-dfd397154343fd4a9f731c0e", "kind": "directory_service", "frame_number": 2296, "timestamp_epoch": "1725471336.301053000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 54, "udp_stream": null, "fields": {} }, { "event_id": "evt-f9524d4e600b55aab697bd82", "kind": "directory_service", "frame_number": 2297, "timestamp_epoch": "1725471336.301631000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 54, "udp_stream": null, "fields": {} }, { "event_id": "evt-e97f95924a8189dad512b872", "kind": "directory_service", "frame_number": 2298, "timestamp_epoch": "1725471336.302215000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 54, "udp_stream": null, "fields": {} }, { "event_id": "evt-fa2c35d2ff144c84ae7c119e", "kind": "directory_service", "frame_number": 2299, "timestamp_epoch": "1725471336.302747000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 54, "udp_stream": null, "fields": {} }, { "event_id": "evt-3e91d3730eeb91c51a7dafb6", "kind": "directory_service", "frame_number": 2300, "timestamp_epoch": "1725471336.303221000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 54, "udp_stream": null, "fields": {} }, { "event_id": "evt-0db3119f686ed3d7b8254630", "kind": "directory_service", "frame_number": 2305, "timestamp_epoch": "1725471336.308259000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 55, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-714d66e0f90b6ac48b30de75", "kind": "directory_service", "frame_number": 2307, "timestamp_epoch": "1725471336.309847000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 55, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-ac7f001efc26acaac1b575ef", "kind": "directory_service", "frame_number": 2308, "timestamp_epoch": "1725471336.310226000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 55, "udp_stream": null, "fields": {} }, { "event_id": "evt-1d15e388f8dbfbac7c9074a0", "kind": "directory_service", "frame_number": 2311, "timestamp_epoch": "1725471336.311125000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 55, "udp_stream": null, "fields": {} }, { "event_id": "evt-af693aa676ccb3bc48f1a348", "kind": "directory_service", "frame_number": 2313, "timestamp_epoch": "1725471336.311301000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 55, "udp_stream": null, "fields": {} }, { "event_id": "evt-f2881c150e42b64f805c0e5e", "kind": "directory_service", "frame_number": 2314, "timestamp_epoch": "1725471336.311805000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 55, "udp_stream": null, "fields": {} }, { "event_id": "evt-b4ba8760e655747be9d793a4", "kind": "directory_service", "frame_number": 2315, "timestamp_epoch": "1725471336.312087000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 55, "udp_stream": null, "fields": {} }, { "event_id": "evt-210a4d95210d918adea49f55", "kind": "directory_service", "frame_number": 2317, "timestamp_epoch": "1725471336.312163000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 54, "udp_stream": null, "fields": {} }, { "event_id": "evt-2c682ba624dc89e5a1900802", "kind": "directory_service", "frame_number": 2998, "timestamp_epoch": "1725471470.867780000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 64, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-09cd85e940e8d7d723347d09", "kind": "directory_service", "frame_number": 3000, "timestamp_epoch": "1725471470.868117000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 64, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-e4a6d3ac72fe1a14ed3e0f22", "kind": "directory_service", "frame_number": 3015, "timestamp_epoch": "1725471470.873223000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 64, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-f7cc5ab8597610642e5b3bf3", "kind": "directory_service", "frame_number": 3017, "timestamp_epoch": "1725471470.874745000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 64, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-5cca4013cf5d0e8af8aeddcb", "kind": "directory_service", "frame_number": 3018, "timestamp_epoch": "1725471470.875904000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 64, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Andrew Fletcher,CN=Users,DC=bepositive,DC=com", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-e2b6ca7d129178428a65d5af", "kind": "directory_service", "frame_number": 3019, "timestamp_epoch": "1725471470.876521000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 64, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-fd38dd3c5c01985888db946a", "kind": "directory_service", "frame_number": 3020, "timestamp_epoch": "1725471470.876713000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 64, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-3ba2fefc7f18156b3f34fa17", "kind": "directory_service", "frame_number": 3028, "timestamp_epoch": "1725471470.885465000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 66, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-0a914c529c31440ebc823e8f", "kind": "directory_service", "frame_number": 3030, "timestamp_epoch": "1725471470.886990000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 66, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-d295d7935d8982dedb93d4d9", "kind": "directory_service", "frame_number": 3031, "timestamp_epoch": "1725471470.887295000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 66, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Andrew Fletcher,CN=Users,DC=bepositive,DC=com", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-be72bb95af6ae228be9ee7ad", "kind": "directory_service", "frame_number": 3032, "timestamp_epoch": "1725471470.887754000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 66, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-6466143a05373977db859d18", "kind": "directory_service", "frame_number": 3033, "timestamp_epoch": "1725471470.887987000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 66, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-f4e011fbdac453dc6105c217", "kind": "directory_service", "frame_number": 3096, "timestamp_epoch": "1725471576.755314000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 69, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-f8ab99544e3ac7e9d7b448d2", "kind": "directory_service", "frame_number": 3098, "timestamp_epoch": "1725471576.756020000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 69, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-ba537f66adad6f862ae8d7d2", "kind": "directory_service", "frame_number": 3101, "timestamp_epoch": "1725471576.757205000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 69, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-07e6dbc41501a06a44741450", "kind": "directory_service", "frame_number": 3103, "timestamp_epoch": "1725471576.759128000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 69, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-40d2d855bd45ea6a42fc7639", "kind": "directory_service", "frame_number": 3104, "timestamp_epoch": "1725471576.760212000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 69, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Andrew Fletcher,CN=Users,DC=bepositive,DC=com", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-8f21f6ef8a9404fffb31b801", "kind": "directory_service", "frame_number": 3105, "timestamp_epoch": "1725471576.760813000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 69, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-cd158d650808e5d1a342318f", "kind": "directory_service", "frame_number": 3106, "timestamp_epoch": "1725471576.760941000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 69, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-4cb448beeb4f153c703fe4c5", "kind": "directory_service", "frame_number": 3112, "timestamp_epoch": "1725471576.767157000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 70, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-238044cc5aee55756c947e7b", "kind": "directory_service", "frame_number": 3114, "timestamp_epoch": "1725471576.768679000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 70, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-d34598008688fb4ff02c4a38", "kind": "directory_service", "frame_number": 3115, "timestamp_epoch": "1725471576.768906000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 70, "udp_stream": null, "fields": { "ldap.baseObject": "CN=Andrew Fletcher,CN=Users,DC=bepositive,DC=com", "ldap.filter": "3", "ldap.protocolOp": "3" } }, { "event_id": "evt-ffb7fbed23dd249a9f1a75d3", "kind": "directory_service", "frame_number": 3116, "timestamp_epoch": "1725471576.769369000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 70, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-aa9c99fa5c12342385107590", "kind": "directory_service", "frame_number": 3117, "timestamp_epoch": "1725471576.769467000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 70, "udp_stream": null, "fields": { "ldap.protocolOp": "2" } }, { "event_id": "evt-b5cd969a76b2c6bd0e6f1c27", "kind": "directory_service", "frame_number": 3292, "timestamp_epoch": "1725471878.245362000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-a4d8b7025f72390ef35710c3", "kind": "directory_service", "frame_number": 3294, "timestamp_epoch": "1725471878.246043000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-d27619658c74a56c903c55f3", "kind": "directory_service", "frame_number": 3297, "timestamp_epoch": "1725471878.247067000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-5d2a9301bf52b29129a857a4", "kind": "directory_service", "frame_number": 3299, "timestamp_epoch": "1725471878.248800000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-6eb1a000528e4f01643f7a1f", "kind": "directory_service", "frame_number": 3300, "timestamp_epoch": "1725471878.249524000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": {} }, { "event_id": "evt-a69fe5f8221a3bca88ea129d", "kind": "directory_service", "frame_number": 3301, "timestamp_epoch": "1725471878.249906000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": {} }, { "event_id": "evt-b1be7af6c9f5353257a3bfe7", "kind": "directory_service", "frame_number": 3302, "timestamp_epoch": "1725471878.250577000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": {} }, { "event_id": "evt-7208e589fdccee1279522212", "kind": "directory_service", "frame_number": 3303, "timestamp_epoch": "1725471878.251424000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": {} }, { "event_id": "evt-f1e8e1684774460eabae8102", "kind": "directory_service", "frame_number": 3314, "timestamp_epoch": "1725471878.364735000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": {} }, { "event_id": "evt-4ad7aa0e3fffea6fc1494927", "kind": "directory_service", "frame_number": 3316, "timestamp_epoch": "1725471878.365237000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": {} }, { "event_id": "evt-a5c95c021bd1057569536137", "kind": "directory_service", "frame_number": 3327, "timestamp_epoch": "1725471878.473909000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": {} }, { "event_id": "evt-388fdcd162969f5d023d4e5f", "kind": "directory_service", "frame_number": 3329, "timestamp_epoch": "1725471878.474418000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": {} }, { "event_id": "evt-3a8b0aeaff64a9febc0d9c3b", "kind": "directory_service", "frame_number": 3335, "timestamp_epoch": "1725471878.476777000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": {} }, { "event_id": "evt-71559acfe7cdad1737edfd5b", "kind": "directory_service", "frame_number": 3337, "timestamp_epoch": "1725471878.477360000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": {} }, { "event_id": "evt-c3da894dd1579d9fda6d3d64", "kind": "directory_service", "frame_number": 3343, "timestamp_epoch": "1725471878.480714000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": {} }, { "event_id": "evt-5e4d4af15cb7305e1a831462", "kind": "directory_service", "frame_number": 3345, "timestamp_epoch": "1725471878.481232000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": {} }, { "event_id": "evt-8cbc689aae4c8e4dacbb0a3e", "kind": "directory_service", "frame_number": 3346, "timestamp_epoch": "1725471878.482300000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": {} }, { "event_id": "evt-5334709cea46f1357f6404b1", "kind": "directory_service", "frame_number": 3347, "timestamp_epoch": "1725471878.482820000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": {} }, { "event_id": "evt-baa808b96140daa3992b87a3", "kind": "directory_service", "frame_number": 3348, "timestamp_epoch": "1725471878.483405000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 77, "udp_stream": null, "fields": {} }, { "event_id": "evt-c69f0a3c551385c52f3aa79b", "kind": "directory_service", "frame_number": 3565, "timestamp_epoch": "1725472175.785208000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 91, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-b6aa5d1c5911c566da84b6bf", "kind": "directory_service", "frame_number": 3566, "timestamp_epoch": "1725472175.785750000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 91, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-c3930241df7002b083bed17c", "kind": "directory_service", "frame_number": 3567, "timestamp_epoch": "1725472175.786067000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 91, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-3d6ac381cabf5a4eab3bd278", "kind": "directory_service", "frame_number": 3568, "timestamp_epoch": "1725472175.786748000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 91, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-a960a42172dba4575af04b68", "kind": "directory_service", "frame_number": 3569, "timestamp_epoch": "1725472175.786931000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 91, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-d62e189da9872e157a7f71d5", "kind": "directory_service", "frame_number": 3570, "timestamp_epoch": "1725472175.787147000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 91, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-cc97a1d2db44d21bc80583a2", "kind": "directory_service", "frame_number": 3573, "timestamp_epoch": "1725472175.788982000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 91, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-7f61e1e58727520ad4ba46bd", "kind": "directory_service", "frame_number": 3574, "timestamp_epoch": "1725472175.789311000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 91, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-5cb3e8670a6dd4c726dcc252", "kind": "directory_service", "frame_number": 3575, "timestamp_epoch": "1725472175.789505000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 91, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-306717944690e36c87e69f29", "kind": "directory_service", "frame_number": 3576, "timestamp_epoch": "1725472175.790105000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 91, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-0922ad5da8c30c91acd83526", "kind": "directory_service", "frame_number": 3577, "timestamp_epoch": "1725472175.790267000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 91, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-155ac05d4288457e9170f058", "kind": "directory_service", "frame_number": 3578, "timestamp_epoch": "1725472175.790477000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 91, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-00d3617e86ade4ca52336361", "kind": "directory_service", "frame_number": 3582, "timestamp_epoch": "1725472175.792406000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 92, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-5f8ded09b1059d9de4508170", "kind": "directory_service", "frame_number": 3584, "timestamp_epoch": "1725472175.793201000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 92, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-6a55fd51795e3223980cc54a", "kind": "directory_service", "frame_number": 3587, "timestamp_epoch": "1725472175.794146000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 92, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-0ca958c348ca966a7fefd962", "kind": "directory_service", "frame_number": 3589, "timestamp_epoch": "1725472175.795404000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 92, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-4a6889c73b50549ca017db02", "kind": "directory_service", "frame_number": 3590, "timestamp_epoch": "1725472175.795734000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 92, "udp_stream": null, "fields": {} }, { "event_id": "evt-41407a3c7bb469e0ee4599fa", "kind": "directory_service", "frame_number": 3591, "timestamp_epoch": "1725472175.796022000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 92, "udp_stream": null, "fields": {} }, { "event_id": "evt-0496f1bfb104d4b415f8750b", "kind": "directory_service", "frame_number": 3592, "timestamp_epoch": "1725472175.796264000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 92, "udp_stream": null, "fields": {} }, { "event_id": "evt-3215e3e8f2c576e28bd6b214", "kind": "directory_service", "frame_number": 3593, "timestamp_epoch": "1725472175.796445000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 92, "udp_stream": null, "fields": {} }, { "event_id": "evt-dde236c5c6a6cda86729edc6", "kind": "directory_service", "frame_number": 3594, "timestamp_epoch": "1725472175.796636000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 92, "udp_stream": null, "fields": {} }, { "event_id": "evt-bc1c042b1b85fc1f5c4dd3b7", "kind": "directory_service", "frame_number": 3595, "timestamp_epoch": "1725472175.796820000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 92, "udp_stream": null, "fields": {} }, { "event_id": "evt-b35f06b4c70fd09a28268663", "kind": "directory_service", "frame_number": 3600, "timestamp_epoch": "1725472175.799429000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-20f38f116a63b2348fd1d31d", "kind": "directory_service", "frame_number": 3602, "timestamp_epoch": "1725472175.800184000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-cf76ff38ae16038996c38aba", "kind": "directory_service", "frame_number": 3603, "timestamp_epoch": "1725472175.800452000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": {} }, { "event_id": "evt-5bd4755e5faab44db083565a", "kind": "directory_service", "frame_number": 3606, "timestamp_epoch": "1725472175.801121000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": {} }, { "event_id": "evt-d5ac33ec760f2eb9853eae81", "kind": "directory_service", "frame_number": 3608, "timestamp_epoch": "1725472175.801275000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": {} }, { "event_id": "evt-23d869547377495075760a04", "kind": "directory_service", "frame_number": 3609, "timestamp_epoch": "1725472175.801725000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": {} }, { "event_id": "evt-3d09c2aedc091bd51ce89f84", "kind": "directory_service", "frame_number": 3610, "timestamp_epoch": "1725472175.801872000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 93, "udp_stream": null, "fields": {} }, { "event_id": "evt-772d17e8af15ae564ed40577", "kind": "directory_service", "frame_number": 3613, "timestamp_epoch": "1725472175.802068000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 92, "udp_stream": null, "fields": {} }, { "event_id": "evt-b4432823e31c107418a4e0a3", "kind": "directory_service", "frame_number": 4569, "timestamp_epoch": "1725473582.137922000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-6f71356a69268e5c9557702b", "kind": "directory_service", "frame_number": 4570, "timestamp_epoch": "1725473582.138420000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-e79d97f57e9ffb53ace292cb", "kind": "directory_service", "frame_number": 4571, "timestamp_epoch": "1725473582.138836000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-2c0ee717012649bc8a931fd9", "kind": "directory_service", "frame_number": 4572, "timestamp_epoch": "1725473582.139507000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-04b2f1595a32cf8b13356054", "kind": "directory_service", "frame_number": 4573, "timestamp_epoch": "1725473582.139817000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-df62e7551c5fb7d405c09a37", "kind": "directory_service", "frame_number": 4574, "timestamp_epoch": "1725473582.140024000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-6261b278ee3ca66980ce05cb", "kind": "directory_service", "frame_number": 4577, "timestamp_epoch": "1725473582.141394000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-13ea1a14f930adb8cefec13b", "kind": "directory_service", "frame_number": 4578, "timestamp_epoch": "1725473582.141715000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-4ba503da60c506c77852e33b", "kind": "directory_service", "frame_number": 4579, "timestamp_epoch": "1725473582.142062000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-aec83cc74e28c28f01fbc2e6", "kind": "directory_service", "frame_number": 4580, "timestamp_epoch": "1725473582.142667000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-04b014776ee38fb657900934", "kind": "directory_service", "frame_number": 4581, "timestamp_epoch": "1725473582.142965000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-4627846fbe5ba983831dab4e", "kind": "directory_service", "frame_number": 4582, "timestamp_epoch": "1725473582.143161000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 130, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-a39079baae685415107f233e", "kind": "directory_service", "frame_number": 4590, "timestamp_epoch": "1725473582.250270000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" } }, { "event_id": "evt-3d82b7289ca4eaddff175ab9", "kind": "directory_service", "frame_number": 4592, "timestamp_epoch": "1725473582.251027000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": { "ldap.protocolOp": "4,5" } }, { "event_id": "evt-1e389ed0a3cef4ea00aa4acd", "kind": "directory_service", "frame_number": 4595, "timestamp_epoch": "1725473582.253520000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-30f44c5ee2b7547a6c12f837", "kind": "directory_service", "frame_number": 4597, "timestamp_epoch": "1725473582.254343000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-393eb3ac0311485c3a5d92f1", "kind": "directory_service", "frame_number": 4598, "timestamp_epoch": "1725473582.255407000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": {} }, { "event_id": "evt-55dffaaf3ca2775ed4af4da7", "kind": "directory_service", "frame_number": 4599, "timestamp_epoch": "1725473582.255808000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": {} }, { "event_id": "evt-94bbb06552db848a43fe218d", "kind": "directory_service", "frame_number": 4600, "timestamp_epoch": "1725473582.256492000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": {} }, { "event_id": "evt-86f27a812e26085c4a656432", "kind": "directory_service", "frame_number": 4601, "timestamp_epoch": "1725473582.256904000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": {} }, { "event_id": "evt-92aa166d014ecb0d348cef1b", "kind": "directory_service", "frame_number": 4602, "timestamp_epoch": "1725473582.257551000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": {} }, { "event_id": "evt-177bea771e524cf3acc9efc0", "kind": "directory_service", "frame_number": 4603, "timestamp_epoch": "1725473582.257973000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": {} }, { "event_id": "evt-7c835da40e28c159cbb4032a", "kind": "directory_service", "frame_number": 4608, "timestamp_epoch": "1725473582.265434000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 132, "udp_stream": null, "fields": { "ldap.protocolOp": "0" } }, { "event_id": "evt-8d433e5fda67e1729b036934", "kind": "directory_service", "frame_number": 4610, "timestamp_epoch": "1725473582.266232000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 132, "udp_stream": null, "fields": { "ldap.protocolOp": "1" } }, { "event_id": "evt-f50a61a8cb1d8ba348d2a005", "kind": "directory_service", "frame_number": 4611, "timestamp_epoch": "1725473582.267302000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 132, "udp_stream": null, "fields": {} }, { "event_id": "evt-8352f2dbb840056e2a793b22", "kind": "directory_service", "frame_number": 4614, "timestamp_epoch": "1725473582.268104000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 132, "udp_stream": null, "fields": {} }, { "event_id": "evt-b3aedec205194e197e581873", "kind": "directory_service", "frame_number": 4616, "timestamp_epoch": "1725473582.268728000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 132, "udp_stream": null, "fields": {} }, { "event_id": "evt-2e164007ada1d4496db01327", "kind": "directory_service", "frame_number": 4617, "timestamp_epoch": "1725473582.269010000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 132, "udp_stream": null, "fields": {} }, { "event_id": "evt-3e57de772d7e83e0687d0421", "kind": "directory_service", "frame_number": 4618, "timestamp_epoch": "1725473582.269649000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 132, "udp_stream": null, "fields": {} }, { "event_id": "evt-fc51d865d87705f73afcbc25", "kind": "directory_service", "frame_number": 4622, "timestamp_epoch": "1725473582.270163000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 131, "udp_stream": null, "fields": {} }, { "event_id": "evt-3c1f8927d501b45ff49de5fc", "kind": "directory_service", "frame_number": 5058, "timestamp_epoch": "1725474712.484883000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 153, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-3bef3efed945dde462c97038", "kind": "directory_service", "frame_number": 5059, "timestamp_epoch": "1725474712.485285000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 153, "udp_stream": null, "fields": { "drsuapi.opnum": "0" } }, { "event_id": "evt-8c508381235ec4a46bf2e748", "kind": "directory_service", "frame_number": 5060, "timestamp_epoch": "1725474712.485484000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 153, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-aab397d9010b3c90863f1a8c", "kind": "directory_service", "frame_number": 5061, "timestamp_epoch": "1725474712.486185000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 153, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-9d2ccad3cc9fb1786adec17c", "kind": "directory_service", "frame_number": 5062, "timestamp_epoch": "1725474712.486429000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 153, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-7377323830fd01901ef0efea", "kind": "directory_service", "frame_number": 5063, "timestamp_epoch": "1725474712.487014000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 153, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-78cc5cf4a503594ab7a46b0a", "kind": "directory_service", "frame_number": 5064, "timestamp_epoch": "1725474712.487239000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 153, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-df615b31f10ce33dbcaa5289", "kind": "directory_service", "frame_number": 5065, "timestamp_epoch": "1725474712.487821000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 153, "udp_stream": null, "fields": { "drsuapi.opnum": "12" } }, { "event_id": "evt-b817afff00bfe0a51b95c9ef", "kind": "directory_service", "frame_number": 5066, "timestamp_epoch": "1725474712.487995000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": null, "dst_port": null, "tcp_stream": 153, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } }, { "event_id": "evt-1026b44b52c257e11c4099b6", "kind": "directory_service", "frame_number": 5067, "timestamp_epoch": "1725474712.488205000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": null, "dst_port": null, "tcp_stream": 153, "udp_stream": null, "fields": { "drsuapi.opnum": "1" } } ], "unclassified_tcp": [ { "event_id": "evt-c0d77a98e433dbb6b247db22", "kind": "unclassified_tcp", "frame_number": 1392, "timestamp_epoch": "1725471306.197278000", "src_ip": "46.254.34.201", "dst_ip": "172.17.0.99", "src_port": 443, "dst_port": 49806, "tcp_stream": 41, "udp_stream": null, "fields": { "tcp.payload": "2c595354913251251b34a5e73a4011dd49fa2a9a4b82bc064c89fac43af26174cb26bdda6bbad09eaf2bf5f6d554eba797abb2e924fb6380e7f9a60547e56589ff30cb0f6935a8e7ae951efee59f2651cd325f411b28ca9823b00b88dcc7bf441b04651d60bb7ccdb02c695a1ebda38f2264a778242a4fdb53d405095c3388d892e3c7d98d29fe350dd6f7919b6534548a93e93960688c4ceff87223a96f35c6c8ca1aa2e664c50ce64f6525713ebbb5ee12da30033c7eff7bc7ea1de8283b0a43d7f2742dc1034ab808b64d05ec6c2b6e2a26bc5b11eba5188bd612c11b4af1954678347429e47630d29829e1f5f2c00be3a49642937eea99a8db3ad544ed9ef553abee0d9bd3f74a65fbfc104ed1253d0472c6e783cce77e43aa8faacfca187af8311d2c5ac680167ed976d55489e06e8217f535d95dc053bf72868ed70a9f97628f543a3d8b4c976d3e4278bfafeb6a18b091bcc0b583ed3fb5c82cd17a42e67f9e67891db5d940a7414648bfa5bf87d0cf9216179a4857fe8a00c92b324a26742fddb1de5a0a26dbbee221dbaee2da88e595fdba9b64f709f16f261a41e5467b0913d95570bf9e54e6a715aa57a0b955fb3880e4c416b4f2b065ff8ff6b644be8bd87c3fbc7ec6a22749160f4c1bee942e48432660879fea978b7e2f0fa13a6f6ae3d265580204770ad9c735726c001b74d0a987d4d6f7c57abb3319993ded2df9bb2504156ce90a345530ab95891047fc4627e3a33ccba492a4a36f0275f8d170f377a52f1bee03272e8dfbc2af53e749b2de92311dbc6a3b2149f8774c204c1a484e8b2e6b2f0a9db6a7441f6a283ad8c150de3a73802c96e13cce061720de95ff7859ee886b49fcae19d8da1e7cddf8a0a65a2f77e81f2fa066534f87adcde10485ef342378b64324fe0c26ee6ddcb6920fae96f2e6f8eae0b77b60106c0e42c197ceff70973e653e52ee90fcb3a6be65b03141dd2de0f86352eb39e615eb28efc139e3d4ef55db3e5a1c409eda32ab2258dd0aee9a32a210ab5c89b2fd449143cb6da5e76c41522dad213ee799493027bea5be192de3c4106a91e72757117fe12bae2c843cc97c5ad5c314713d418511c73e5942940635953f16683c7d42a94740251c48aa8f23f856736cb8bbcb3e049a7d1502a92b023106da613c644862eaee1ec0c8366714587aebb52cdc34fb3c1e2e42636ddb6bf13159b4b9d5fd016d8f10b630d14b50917061533381097a217d584fc5e7e9f8697b6ebeb587dfa4c99f87bed6c34dfbc2ec4f233e27918765580c1f7486076be411e28820b5b509d243789a551c49378f9087ea8cca6a53a46f1616cf44e8065c89770ea6354bd1832daea694cabad3121f49b3a6a52335d40ec78b51c80903ed9e0b39567c3c52796f2f592c101fe6122d57f965c4c4b957df7a58f64ac6ee064810ab9daae78b18afab2ff3b9165008d26539bb7c734b9c0c23cac26909eabd0ca4db77ceea5f508d494899970436405cd608f6567c15f8fb93c61e8f321c158ec5c94cb0dae92799ce35220d012b784cd2f8817e42eafc040a2a290e0db7fc314d98bd6cfa436a68861388960911d340ae2f6c5adce0d1d9a35a103e9fbcc168d5122aeb49aa73a38b8fa1de7063be42c8b44138c47bba0bcebb59eba13666a545bd08d34394fd519370e7ce2cd8b5db2911706718af293ce5f79ccc42d304e4f8a9ae34ec5fc9db7816489d52b27add0f2a576d5a468f4a6ccacb5619ab24639a7096e7f4d6eb5d6bd9a1d9f3ae5c532a6cbd897dca9f0ffdf6771c305a459190a68a070267efe39badef107e32292c028738e168abb181dfa0295522e6a1fd86a48d1f6bd170351963a283aa0f9a975d96a358f2ff3b7e543b36a993083bbd077988514616cd0a3b1446740bcb59a4b79549e8a98cd0a6a95a6966a8fe94b2a34ab6" } }, { "event_id": "evt-a36766e483c5dd60b4ce3613", "kind": "unclassified_tcp", "frame_number": 1557, "timestamp_epoch": "1725471306.536946000", "src_ip": "46.254.34.201", "dst_ip": "172.17.0.99", "src_port": 443, "dst_port": 49806, "tcp_stream": 41, "udp_stream": null, "fields": { "tcp.payload": "433a334167868d88616fb1a58ce0b28c893ebfab142f481c80278f860b66eed0c0809efd86db4a76204486e262e05aa62b854c6459f5c3bfc1e7c0aed78060e8d9364ddcdd11a4cfd3150273297c5c55f5544094a29ba3b9449201ce0538029022c17bc5e0f1a88da0c050a752116cac891802554f20d3c48010c49c6baaaaeee188b87cd390f268ceb24e8f177d1ffe2c513cde5c6d67dd3f41b71f1d690e1408f3da595ec4b6493a383942ab2015a726cce69241f71889aa256122a4e08c5412d03b9b60b028d1a3b15e43c9efce7a25fb894463895c87bf98fe293f1f76c7c956c8f20e832b5d519dd786afeca7746016d173c38e4c4772161dff5ec6a2010c28be670c6c718ab5809e8d348bcf26fdb6ccca3e3e52b8c8ea9f87608a2a4453cd5c048e9c26c855507fa9a58f13065cf2b956616bd71cb5c81c1d66c55e2ab6a67f9c4973970354a4005dc802d8bf3718951a4898b4b4bc0793748dd17812ba0cd0aa8bf02b6bbc1eaa8a39fa64095e9aa87338935e0d49051456898de617054ace9df1550a3d21bd87b301641d8297e5d5e9246e1dafb2c0567bbbd08450f49072003dab3efca97e3f1cab66426f1769c97bdce3e6b0a0e9c08f6c2fa0338be1b4629ed8b1be83a22e3eec998331803a2ae47d20e71775099d4d00e97f79d098d11cb14c6b26f96df1b42386f12127863a3446176dab3495a2c8f88a89f0810eccfebbaca509d72c467c77fe02f38189cb6ab1a1cf9a248caf1982c0aa63443cbd62cb65c32b31476c6811b19f65bb12a9d61a0dbe4bdbd08bba3c35761fa1c805953aa73516dd069ca8fa2ed7d815594cb5050637e9529d1aafe5a429b57215c1a7649cd81b58e335c415b4a7e797c8e31ddd5ccd94c416e0257eaed48e09febeb3b078416dd10bf6e4270278290282cd79bf11826eb60ee660998d899759db9c3d4cc16d5e61af47b26ee0e240b2c139eb6c308bc8ef16912f90cbf736cc70e1a5a402b63f82a163484c5d0a35a4d6951ab573227b788efd5c3c50c7d11dfc13660c9931b321d860037cce7a36c6b12acfcf863bf8531017cc8256d7963988860febca0eb7ef7fe2b6d2b3dbed102d77679b1f989be396c4b4f54542ee57347d1cde1aa94f2e484bb233b92fbbef3e9c98c71108891adc45f30ca4134ff2f46e31f3592348187b8ad148a6faf6991aef75baeb0b5a9469f53bdfc6bc1d3b6f8b89c6676fe3a4722471fbd6084aa467f7d40728a863888d9a90e8b968c07add0cb8be3dfbc8df3e4127859106fba922e32b7afd01b600ed53e4b94fc722452cd8ff593292497a4cc44b7e9e7493d38854803276180c34a88f5a6bfa537b8f383c08e625e7b36073e2b8dd692fe9f98a2de02de8669c47e2c7bc95372388c4d7e2f95622d39c77154445c2400204d732c4801d81eadbb49434da3140e6d0251528626e61e95ad446309a7f64e16c4cea6177988e6db5cecce0f22fd9301c7576ad9fb1c6bfbce972c5bf83c829133d99e12feaaeae722b0de81fbf63252a121f295a7d0fa7bb958dc4f3458a5f1af0dbe58409681b0b7eddda42418430a68774579cf8c1244c91a64accb0dd5ec3be5f3613ac0895f721b2b3fb5383af494551cad2ed1447def73f32948092acea157e62b96e4808e30e0ca49ebd5c9d9244d25578c26c4c90fa5896de98e915049233dd740fa4440c4073b583eb8ecfc6dd58e159a0e523607ce121e7c0204c963482e3461e498a950b5ee8fe6f822e600dea3cbb99d83d7d439354548e6a7555dd27ac0e97c73afdd7ea62cfc680c9fb8b4a3e12e49402ac0714a53619a814c13d819b16efe1c7fcde06d8cbd64e1c43487c201318464f9b8a76632298a6b0c9a22bd13727ae22824204cb57851f75fcc92ae2d481f7777a51fbe51c85b5077bf584555462a06a7b580906670a88281a" } }, { "event_id": "evt-12c5cd96f3aa3ddd9090e782", "kind": "unclassified_tcp", "frame_number": 1673, "timestamp_epoch": "1725471308.004803000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 49785, "dst_port": 445, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-07de5e14e1ed8ca9914cdbeb", "kind": "unclassified_tcp", "frame_number": 2335, "timestamp_epoch": "1725471338.007534000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 49785, "dst_port": 445, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-27bbcd36d12296528f42bc03", "kind": "unclassified_tcp", "frame_number": 2467, "timestamp_epoch": "1725471398.058046000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ac59f0eb78f93a23944a4f71", "kind": "unclassified_tcp", "frame_number": 3083, "timestamp_epoch": "1725471518.068845000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-d4e7a2e386e0e7e6c6bcb0c7", "kind": "unclassified_tcp", "frame_number": 3085, "timestamp_epoch": "1725471521.022912000", "src_ip": "172.17.0.99", "dst_ip": "20.10.31.115", "src_port": 49771, "dst_port": 443, "tcp_stream": 6, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4bf8a9a99096f921d748552e", "kind": "unclassified_tcp", "frame_number": 3170, "timestamp_epoch": "1725471628.942579000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 49785, "dst_port": 445, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a1692eba004c3141b1058de7", "kind": "unclassified_tcp", "frame_number": 3187, "timestamp_epoch": "1725471658.941911000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 49785, "dst_port": 445, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-54cd96c2ebd09de1229b662c", "kind": "unclassified_tcp", "frame_number": 3195, "timestamp_epoch": "1725471718.982068000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-62826eed6be8119d45f79673", "kind": "unclassified_tcp", "frame_number": 3226, "timestamp_epoch": "1725471766.098516000", "src_ip": "172.17.0.99", "dst_ip": "20.10.31.115", "src_port": 49771, "dst_port": 443, "tcp_stream": 6, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-f97c8414c1f9fdc892ab568a", "kind": "unclassified_tcp", "frame_number": 3255, "timestamp_epoch": "1725471838.998741000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-4fc01cae41076e300a5f2cfd", "kind": "unclassified_tcp", "frame_number": 3431, "timestamp_epoch": "1725471959.007164000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-dd87432898b61732cd02e8e7", "kind": "unclassified_tcp", "frame_number": 3455, "timestamp_epoch": "1725472011.180105000", "src_ip": "172.17.0.99", "dst_ip": "20.10.31.115", "src_port": 49771, "dst_port": 443, "tcp_stream": 6, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-46ea246b4f9046bb6620a9cd", "kind": "unclassified_tcp", "frame_number": 3494, "timestamp_epoch": "1725472079.023559000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-7153edaf3f54a9c4f20bf2da", "kind": "unclassified_tcp", "frame_number": 3776, "timestamp_epoch": "1725472199.038971000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-d9da505eac0f25ebe41156ac", "kind": "unclassified_tcp", "frame_number": 3781, "timestamp_epoch": "1725472229.300006000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 49785, "dst_port": 445, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-b3f05c261750efdcf7e26513", "kind": "unclassified_tcp", "frame_number": 3785, "timestamp_epoch": "1725472256.264322000", "src_ip": "172.17.0.99", "dst_ip": "20.10.31.115", "src_port": 49771, "dst_port": 443, "tcp_stream": 6, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1b81b825db448c16a01ee46c", "kind": "unclassified_tcp", "frame_number": 3787, "timestamp_epoch": "1725472259.298523000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 49785, "dst_port": 445, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-af76dcb534f16d3bafbf84b1", "kind": "unclassified_tcp", "frame_number": 3857, "timestamp_epoch": "1725472319.341097000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-50d289f5a57a4bd6ff4e2329", "kind": "unclassified_tcp", "frame_number": 3896, "timestamp_epoch": "1725472439.357699000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-069d0fa9e3f756dca903dcbf", "kind": "unclassified_tcp", "frame_number": 3966, "timestamp_epoch": "1725472559.372964000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-20a62fc6f09de70d64dfa02c", "kind": "unclassified_tcp", "frame_number": 3991, "timestamp_epoch": "1725472677.734508000", "src_ip": "172.17.0.99", "dst_ip": "20.10.31.115", "src_port": 49771, "dst_port": 443, "tcp_stream": 6, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-343c37d7c3c7414ff8aa64ec", "kind": "unclassified_tcp", "frame_number": 3993, "timestamp_epoch": "1725472679.377962000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-da16b3b493ea24510489cb69", "kind": "unclassified_tcp", "frame_number": 4029, "timestamp_epoch": "1725472799.386477000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-b189f9ce3ced49a352b8df7b", "kind": "unclassified_tcp", "frame_number": 4073, "timestamp_epoch": "1725472829.643747000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 49785, "dst_port": 445, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-7f4b432e64bc8b9a604fecc4", "kind": "unclassified_tcp", "frame_number": 4109, "timestamp_epoch": "1725472859.643452000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 49785, "dst_port": 445, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-7ba857d987d24ac3fa81b928", "kind": "unclassified_tcp", "frame_number": 4144, "timestamp_epoch": "1725472919.680711000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-195950ded4fe570cc3900b0b", "kind": "unclassified_tcp", "frame_number": 4146, "timestamp_epoch": "1725472922.807810000", "src_ip": "172.17.0.99", "dst_ip": "20.10.31.115", "src_port": 49771, "dst_port": 443, "tcp_stream": 6, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8c5172d65bbb2a0e10f6df53", "kind": "unclassified_tcp", "frame_number": 4234, "timestamp_epoch": "1725473039.685460000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ce8b6d3f573f5ba330dbc919", "kind": "unclassified_tcp", "frame_number": 4343, "timestamp_epoch": "1725473159.696498000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-9818d36f6a7f099051f774b5", "kind": "unclassified_tcp", "frame_number": 4346, "timestamp_epoch": "1725473167.885760000", "src_ip": "172.17.0.99", "dst_ip": "20.10.31.115", "src_port": 49771, "dst_port": 443, "tcp_stream": 6, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-872302b715c7fdceeec69bf4", "kind": "unclassified_tcp", "frame_number": 4425, "timestamp_epoch": "1725473279.706663000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ce4216baa5869f2f77b44f51", "kind": "unclassified_tcp", "frame_number": 4462, "timestamp_epoch": "1725473399.719799000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-25038f69bde482f00b1dac68", "kind": "unclassified_tcp", "frame_number": 4471, "timestamp_epoch": "1725473412.962502000", "src_ip": "172.17.0.99", "dst_ip": "20.10.31.115", "src_port": 49771, "dst_port": 443, "tcp_stream": 6, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-deb1aa9afcac9aec2af2956f", "kind": "unclassified_tcp", "frame_number": 4481, "timestamp_epoch": "1725473429.981674000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 49785, "dst_port": 445, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e3da211510ee412732d55afb", "kind": "unclassified_tcp", "frame_number": 4483, "timestamp_epoch": "1725473459.991300000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 49785, "dst_port": 445, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-fce3544e1896aeccefffa443", "kind": "unclassified_tcp", "frame_number": 4503, "timestamp_epoch": "1725473520.018330000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-e781604fa5058ae582fb96f4", "kind": "unclassified_tcp", "frame_number": 4639, "timestamp_epoch": "1725473640.027989000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-454b452ec08234e84000b2d8", "kind": "unclassified_tcp", "frame_number": 4657, "timestamp_epoch": "1725473658.031265000", "src_ip": "172.17.0.99", "dst_ip": "20.10.31.115", "src_port": 49771, "dst_port": 443, "tcp_stream": 6, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a9bcdcaab67a7ba54fcb2ed4", "kind": "unclassified_tcp", "frame_number": 4675, "timestamp_epoch": "1725473760.033345000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-05320ce8e9446265eda51e83", "kind": "unclassified_tcp", "frame_number": 4778, "timestamp_epoch": "1725473880.033963000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-8b14b46a618bc25e03f239b9", "kind": "unclassified_tcp", "frame_number": 4796, "timestamp_epoch": "1725473903.124057000", "src_ip": "172.17.0.99", "dst_ip": "20.10.31.115", "src_port": 49771, "dst_port": 443, "tcp_stream": 6, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-ba2c797de86448a26dfc3b05", "kind": "unclassified_tcp", "frame_number": 4815, "timestamp_epoch": "1725474000.044147000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-265c9b288315dc2655ec09c0", "kind": "unclassified_tcp", "frame_number": 4834, "timestamp_epoch": "1725474030.320666000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 49785, "dst_port": 445, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-203d8a80d48f9adbad149c75", "kind": "unclassified_tcp", "frame_number": 4838, "timestamp_epoch": "1725474060.335335000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 49785, "dst_port": 445, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-6939005080454fb5ce8c5614", "kind": "unclassified_tcp", "frame_number": 4861, "timestamp_epoch": "1725474120.363133000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-1268e37833d0a55819e09a4c", "kind": "unclassified_tcp", "frame_number": 4890, "timestamp_epoch": "1725474240.374321000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-2b6113b68fc2cf21a8402e41", "kind": "unclassified_tcp", "frame_number": 4925, "timestamp_epoch": "1725474357.664189000", "src_ip": "172.17.0.99", "dst_ip": "20.10.31.115", "src_port": 49771, "dst_port": 443, "tcp_stream": 6, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-dca827d840ef3665145347cc", "kind": "unclassified_tcp", "frame_number": 4927, "timestamp_epoch": "1725474360.377257000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-fa80a647afa5340d254ed95f", "kind": "unclassified_tcp", "frame_number": 4963, "timestamp_epoch": "1725474480.385125000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-15133eceac403847ada2ed04", "kind": "unclassified_tcp", "frame_number": 4993, "timestamp_epoch": "1725474600.400328000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-b9d15b4c88c01fc4c87b6bac", "kind": "unclassified_tcp", "frame_number": 4998, "timestamp_epoch": "1725474602.753391000", "src_ip": "172.17.0.99", "dst_ip": "20.10.31.115", "src_port": 49771, "dst_port": 443, "tcp_stream": 6, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-416a196a5e9cce419275e7e4", "kind": "unclassified_tcp", "frame_number": 5023, "timestamp_epoch": "1725474630.663775000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 49785, "dst_port": 445, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-9a2fa579529a1e527cb3e0a4", "kind": "unclassified_tcp", "frame_number": 5038, "timestamp_epoch": "1725474660.665470000", "src_ip": "172.17.0.99", "dst_ip": "172.17.0.17", "src_port": 49785, "dst_port": 445, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } }, { "event_id": "evt-a805471db81fccea5488c6b3", "kind": "unclassified_tcp", "frame_number": 5086, "timestamp_epoch": "1725474720.709445000", "src_ip": "172.17.0.17", "dst_ip": "172.17.0.99", "src_port": 445, "dst_port": 49785, "tcp_stream": 20, "udp_stream": null, "fields": { "tcp.payload": "00" } } ] }, "artifacts": [ { "artifact_id": "artifact-dc888079f167d1c11773e5c8", "type": "http-exported-object", "filename": "index.php", "filenames": [ "index.php" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 105, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 105, "sha256": "ed0855c1637e5f93be7d54acb2cb8872683a0e5eb670258abb1ebc41bfbf4591", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-3e1db0eeb5d2d42d075dfa96", "type": "http-exported-object", "filename": "index.php%3fid=&subid=qIOuKk7U", "filenames": [ "index.php%3fid=&subid=qIOuKk7U" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 61, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 61, "sha256": "736f0cb5cc23435dad920dbe447efcf102e61c8691fa8528f5f39f386537f43e", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-d50a69716d8b2738e4aeba86", "type": "http-exported-object", "filename": "connecttest(1).txt", "filenames": [ "connecttest(1).txt", "connecttest.txt" ], "occurrences": 2, "static_features": { "content_kind": "unclassified", "inspected_bytes": 22, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 22, "sha256": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61", "media_type": "text/plain", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-ebdbcb860d8457f5b93076a8", "type": "http-exported-object", "filename": "ProcessMAU.txt", "filenames": [ "ProcessMAU.txt" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 4, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 4, "sha256": "69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820", "media_type": "text/plain", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-28a949461c43984fc1939b46", "type": "http-exported-object", "filename": "index(1).php", "filenames": [ "index(1).php" ], "occurrences": 1, "static_features": { "content_kind": "unclassified", "inspected_bytes": 1, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 1, "sha256": "3f39d5c348e5b79d06e842c114e6cc571583bbf44e4b0ebfda1a01ec05745d43", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false }, { "artifact_id": "artifact-11ff07d077434887076489c0", "type": "http-exported-object", "filename": "foots(1).php", "filenames": [ "foots(1).php", "foots(10).php", "foots(11).php", "foots(12).php", "foots(13).php", "foots(14).php", "foots(15).php", "foots(16).php", "foots(17).php", "foots(18).php", "foots(19).php", "foots(2).php", "foots(20).php", "foots(21).php", "foots(22).php", "foots(23).php", "foots(24).php", "foots(25).php", "foots(26).php", "foots(27).php", "foots(28).php", "foots(29).php", "foots(3).php", "foots(30).php", "foots(31).php", "foots(32).php", "foots(33).php", "foots(34).php", "foots(35).php", "foots(36).php" ], "occurrences": 48, "static_features": { "content_kind": "unclassified", "inspected_bytes": 0, "inspection_truncated": false, "features": [], "interpretation": "Static content only; not proof of execution, intent, or malware family" }, "size_bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "media_type": "application/octet-stream", "extraction_method": "tshark-http-export-objects", "content_retained_by_analyzer": false } ], "observables": [ { "observable_id": "observable-06b9b7ebb7bb8c08e57e9858", "type": "domain", "value": "a1834.dscg2.akamai.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1725471398.606869000", "last_seen_epoch": "1725471398.624249000", "evidence": [ { "frame_number": 2622, "timestamp_epoch": "1725471398.606869000", "display_filter": "frame.number == 2622", "udp_stream": 38 }, { "frame_number": 2625, "timestamp_epoch": "1725471398.624249000", "display_filter": "frame.number == 2625", "udp_stream": 39 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-af700290dd92481b12bbd2e7", "type": "domain", "value": "acroipm2.adobe.com", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1725471995.444071000", "last_seen_epoch": "1725471995.543188000", "evidence": [ { "frame_number": 3435, "timestamp_epoch": "1725471995.444071000", "display_filter": "frame.number == 3435", "udp_stream": 48 }, { "frame_number": 3436, "timestamp_epoch": "1725471995.498031000", "display_filter": "frame.number == 3436", "udp_stream": 48 }, { "frame_number": 3440, "timestamp_epoch": "1725471995.543188000", "display_filter": "frame.number == 3440", "tcp_stream": 85 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a4c5e40cece9b421b0ba3e39", "type": "domain", "value": "api.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1725471398.149174000", "last_seen_epoch": "1725471398.316055000", "evidence": [ { "frame_number": 2485, "timestamp_epoch": "1725471398.149174000", "display_filter": "frame.number == 2485", "udp_stream": 28 }, { "frame_number": 2486, "timestamp_epoch": "1725471398.149174000", "display_filter": "frame.number == 2486", "udp_stream": 29 }, { "frame_number": 2490, "timestamp_epoch": "1725471398.205460000", "display_filter": "frame.number == 2490", "udp_stream": 28 }, { "frame_number": 2491, "timestamp_epoch": "1725471398.205500000", "display_filter": "frame.number == 2491", "udp_stream": 29 }, { "frame_number": 2499, "timestamp_epoch": "1725471398.255794000", "display_filter": "frame.number == 2499", "tcp_stream": 60 }, { "frame_number": 2521, "timestamp_epoch": "1725471398.316055000", "display_filter": "frame.number == 2521", "tcp_stream": 60 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ca4dd7848f59d3b4c6a63e05", "type": "domain", "value": "arc.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1725471276.287268000", "last_seen_epoch": "1725471276.414787000", "evidence": [ { "frame_number": 565, "timestamp_epoch": "1725471276.287268000", "display_filter": "frame.number == 565", "udp_stream": 16 }, { "frame_number": 575, "timestamp_epoch": "1725471276.337426000", "display_filter": "frame.number == 575", "udp_stream": 16 }, { "frame_number": 579, "timestamp_epoch": "1725471276.414787000", "display_filter": "frame.number == 579", "tcp_stream": 25 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-65c55d0d0775e8f3c5982eb9", "type": "domain", "value": "assets.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1725471276.051539000", "last_seen_epoch": "1725473809.566359000", "evidence": [ { "frame_number": 528, "timestamp_epoch": "1725471276.051539000", "display_filter": "frame.number == 528", "udp_stream": 16 }, { "frame_number": 531, "timestamp_epoch": "1725471276.098646000", "display_filter": "frame.number == 531", "udp_stream": 16 }, { "frame_number": 2487, "timestamp_epoch": "1725471398.149224000", "display_filter": "frame.number == 2487", "udp_stream": 30 }, { "frame_number": 2488, "timestamp_epoch": "1725471398.149224000", "display_filter": "frame.number == 2488", "udp_stream": 31 }, { "frame_number": 2489, "timestamp_epoch": "1725471398.205460000", "display_filter": "frame.number == 2489", "udp_stream": 30 }, { "frame_number": 2495, "timestamp_epoch": "1725471398.250673000", "display_filter": "frame.number == 2495", "udp_stream": 31 }, { "frame_number": 3352, "timestamp_epoch": "1725471878.550055000", "display_filter": "frame.number == 3352", "udp_stream": 44 }, { "frame_number": 3353, "timestamp_epoch": "1725471878.561381000", "display_filter": "frame.number == 3353", "udp_stream": 44 }, { "frame_number": 3503, "timestamp_epoch": "1725472090.678222000", "display_filter": "frame.number == 3503", "udp_stream": 49 }, { "frame_number": 3504, "timestamp_epoch": "1725472090.716600000", "display_filter": "frame.number == 3504", "udp_stream": 49 }, { "frame_number": 4695, "timestamp_epoch": "1725473809.467761000", "display_filter": "frame.number == 4695", "udp_stream": 60 }, { "frame_number": 4696, "timestamp_epoch": "1725473809.500722000", "display_filter": "frame.number == 4696", "udp_stream": 60 }, { "frame_number": 538, "timestamp_epoch": "1725471276.135988000", "display_filter": "frame.number == 538", "tcp_stream": 24 }, { "frame_number": 539, "timestamp_epoch": "1725471276.136172000", "display_filter": "frame.number == 539", "tcp_stream": 23 }, { "frame_number": 811, "timestamp_epoch": "1725471277.238241000", "display_filter": "frame.number == 811", "tcp_stream": 28 }, { "frame_number": 2494, "timestamp_epoch": "1725471398.231353000", "display_filter": "frame.number == 2494" }, { "frame_number": 2557, "timestamp_epoch": "1725471398.483914000", "display_filter": "frame.number == 2557" }, { "frame_number": 3357, "timestamp_epoch": "1725471878.598572000", "display_filter": "frame.number == 3357", "tcp_stream": 82 }, { "frame_number": 3508, "timestamp_epoch": "1725472090.745636000", "display_filter": "frame.number == 3508", "tcp_stream": 88 }, { "frame_number": 3841, "timestamp_epoch": "1725472298.572478000", "display_filter": "frame.number == 3841", "tcp_stream": 102 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e0afa3b44c4808eaa3d183b8", "type": "domain", "value": "bepositive.com", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1725471151.330497000", "last_seen_epoch": "1725471151.332560000", "evidence": [ { "frame_number": 17, "timestamp_epoch": "1725471151.330497000", "display_filter": "frame.number == 17", "udp_stream": 5 }, { "frame_number": 19, "timestamp_epoch": "1725471151.332560000", "display_filter": "frame.number == 19", "udp_stream": 5 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6c1272728012f420d60c7763", "type": "domain", "value": "blob.mwh03prdstf02a.store.core.windows.net", "roles": [ "dns-cname" ], "is_private": null, "first_seen_epoch": "1725471938.579425000", "last_seen_epoch": "1725471938.579425000", "evidence": [ { "frame_number": 3390, "timestamp_epoch": "1725471938.579425000", "display_filter": "frame.number == 3390", "udp_stream": 47 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-eab7e194a5b59b2ee97cc695", "type": "domain", "value": "client.wns.windows.com", "roles": [ "tls-sni" ], "is_private": null, "first_seen_epoch": "1725471223.016189000", "last_seen_epoch": "1725471223.016189000", "evidence": [ { "frame_number": 188, "timestamp_epoch": "1725471223.016189000", "display_filter": "frame.number == 188", "tcp_stream": 6 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-8897b61e8a9c5a8e3a067240", "type": "domain", "value": "ctldl.windowsupdate.com", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1725472865.537171000", "last_seen_epoch": "1725473139.654458000", "evidence": [ { "frame_number": 4115, "timestamp_epoch": "1725472865.537171000", "display_filter": "frame.number == 4115", "udp_stream": 57 }, { "frame_number": 4116, "timestamp_epoch": "1725472865.560513000", "display_filter": "frame.number == 4116", "udp_stream": 57 }, { "frame_number": 4311, "timestamp_epoch": "1725473139.609153000", "display_filter": "frame.number == 4311", "udp_stream": 60 }, { "frame_number": 4312, "timestamp_epoch": "1725473139.609265000", "display_filter": "frame.number == 4312", "udp_stream": 60 }, { "frame_number": 4120, "timestamp_epoch": "1725472865.606024000", "display_filter": "frame.number == 4120", "tcp_stream": 112 }, { "frame_number": 4123, "timestamp_epoch": "1725472865.665480000", "display_filter": "frame.number == 4123", "tcp_stream": 112 }, { "frame_number": 4317, "timestamp_epoch": "1725473139.654458000", "display_filter": "frame.number == 4317", "tcp_stream": 120 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3dc03f446af2816a5e82d113", "type": "domain", "value": "desktop-rnvo9at.bepositive.com", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1725471151.329715000", "last_seen_epoch": "1725471151.329895000", "evidence": [ { "frame_number": 12, "timestamp_epoch": "1725471151.329715000", "display_filter": "frame.number == 12", "udp_stream": 5 }, { "frame_number": 14, "timestamp_epoch": "1725471151.329895000", "display_filter": "frame.number == 14", "udp_stream": 5 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b428371f857286f1be9d427c", "type": "domain", "value": "dns.msftncsi.com", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1725471157.933111000", "last_seen_epoch": "1725473361.448204000", "evidence": [ { "frame_number": 105, "timestamp_epoch": "1725471157.933111000", "display_filter": "frame.number == 105", "udp_stream": 12 }, { "frame_number": 106, "timestamp_epoch": "1725471157.973714000", "display_filter": "frame.number == 106", "udp_stream": 12 }, { "frame_number": 4419, "timestamp_epoch": "1725473271.436327000", "display_filter": "frame.number == 4419", "udp_stream": 12 }, { "frame_number": 4420, "timestamp_epoch": "1725473271.491784000", "display_filter": "frame.number == 4420", "udp_stream": 12 }, { "frame_number": 4452, "timestamp_epoch": "1725473361.436836000", "display_filter": "frame.number == 4452", "udp_stream": 61 }, { "frame_number": 4453, "timestamp_epoch": "1725473361.448204000", "display_filter": "frame.number == 4453", "udp_stream": 61 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-419b61ed724ee80e55d37e92", "type": "domain", "value": "download.windowsupdate.com", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1725471607.486570000", "last_seen_epoch": "1725471607.486570000", "evidence": [ { "frame_number": 3139, "timestamp_epoch": "1725471607.486570000", "display_filter": "frame.number == 3139", "udp_stream": 41 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ea7d83dbf43783fc28df1374", "type": "domain", "value": "ecs.office.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1725472852.139802000", "last_seen_epoch": "1725473825.973368000", "evidence": [ { "frame_number": 4077, "timestamp_epoch": "1725472852.139802000", "display_filter": "frame.number == 4077", "udp_stream": 56 }, { "frame_number": 4078, "timestamp_epoch": "1725472852.165472000", "display_filter": "frame.number == 4078", "udp_stream": 56 }, { "frame_number": 4082, "timestamp_epoch": "1725472852.228611000", "display_filter": "frame.number == 4082", "tcp_stream": 111 }, { "frame_number": 4086, "timestamp_epoch": "1725472852.296590000", "display_filter": "frame.number == 4086", "tcp_stream": 111 }, { "frame_number": 4157, "timestamp_epoch": "1725472924.632500000", "display_filter": "frame.number == 4157", "tcp_stream": 114 }, { "frame_number": 4161, "timestamp_epoch": "1725472924.707889000", "display_filter": "frame.number == 4161", "tcp_stream": 114 }, { "frame_number": 4374, "timestamp_epoch": "1725473224.920740000", "display_filter": "frame.number == 4374", "tcp_stream": 122 }, { "frame_number": 4378, "timestamp_epoch": "1725473224.999746000", "display_filter": "frame.number == 4378", "tcp_stream": 122 }, { "frame_number": 4510, "timestamp_epoch": "1725473525.389849000", "display_filter": "frame.number == 4510", "tcp_stream": 127 }, { "frame_number": 4514, "timestamp_epoch": "1725473525.468695000", "display_filter": "frame.number == 4514", "tcp_stream": 127 }, { "frame_number": 4724, "timestamp_epoch": "1725473825.888774000", "display_filter": "frame.number == 4724", "tcp_stream": 137 }, { "frame_number": 4728, "timestamp_epoch": "1725473825.973368000", "display_filter": "frame.number == 4728", "tcp_stream": 137 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7e00286a14d102353e9dcc20", "type": "domain", "value": "fd.api.iris.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1725471471.481874000", "last_seen_epoch": "1725471471.590000000", "evidence": [ { "frame_number": 3037, "timestamp_epoch": "1725471471.481874000", "display_filter": "frame.number == 3037", "udp_stream": 22 }, { "frame_number": 3038, "timestamp_epoch": "1725471471.488905000", "display_filter": "frame.number == 3038", "udp_stream": 22 }, { "frame_number": 3042, "timestamp_epoch": "1725471471.590000000", "display_filter": "frame.number == 3042", "tcp_stream": 67 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d59b429e345e8f56d52b725e", "type": "domain", "value": "g.live.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1725471279.973890000", "last_seen_epoch": "1725471280.054518000", "evidence": [ { "frame_number": 1051, "timestamp_epoch": "1725471279.973890000", "display_filter": "frame.number == 1051", "udp_stream": 20 }, { "frame_number": 1052, "timestamp_epoch": "1725471279.977517000", "display_filter": "frame.number == 1052", "udp_stream": 20 }, { "frame_number": 1056, "timestamp_epoch": "1725471280.054518000", "display_filter": "frame.number == 1056", "tcp_stream": 32 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-46bf72779d2da81639e5f3e8", "type": "domain", "value": "img-s-msn-com.akamaized.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1725471398.549060000", "last_seen_epoch": "1725471398.650380000", "evidence": [ { "frame_number": 2586, "timestamp_epoch": "1725471398.549060000", "display_filter": "frame.number == 2586", "udp_stream": 38 }, { "frame_number": 2587, "timestamp_epoch": "1725471398.549143000", "display_filter": "frame.number == 2587", "udp_stream": 39 }, { "frame_number": 2622, "timestamp_epoch": "1725471398.606869000", "display_filter": "frame.number == 2622", "udp_stream": 38 }, { "frame_number": 2625, "timestamp_epoch": "1725471398.624249000", "display_filter": "frame.number == 2625", "udp_stream": 39 }, { "frame_number": 2656, "timestamp_epoch": "1725471398.650380000", "display_filter": "frame.number == 2656", "tcp_stream": 62 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1287f8ad7e6ac5062c77014a", "type": "domain", "value": "inputsuggestions.msdxcdn.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1725471296.652976000", "last_seen_epoch": "1725471296.788447000", "evidence": [ { "frame_number": 1244, "timestamp_epoch": "1725471296.652976000", "display_filter": "frame.number == 1244", "udp_stream": 21 }, { "frame_number": 1245, "timestamp_epoch": "1725471296.712511000", "display_filter": "frame.number == 1245", "udp_stream": 21 }, { "frame_number": 1249, "timestamp_epoch": "1725471296.753410000", "display_filter": "frame.number == 1249", "tcp_stream": 40 }, { "frame_number": 1253, "timestamp_epoch": "1725471296.788447000", "display_filter": "frame.number == 1253", "tcp_stream": 40 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a51bcc6575612702706f26d3", "type": "domain", "value": "login.microsoftonline.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1725471280.106056000", "last_seen_epoch": "1725472176.070698000", "evidence": [ { "frame_number": 1126, "timestamp_epoch": "1725471280.106056000", "display_filter": "frame.number == 1126", "udp_stream": 21 }, { "frame_number": 1140, "timestamp_epoch": "1725471280.152646000", "display_filter": "frame.number == 1140", "udp_stream": 21 }, { "frame_number": 3620, "timestamp_epoch": "1725472175.849105000", "display_filter": "frame.number == 3620", "udp_stream": 50 }, { "frame_number": 3621, "timestamp_epoch": "1725472175.894362000", "display_filter": "frame.number == 3621", "udp_stream": 50 }, { "frame_number": 1147, "timestamp_epoch": "1725471280.228480000", "display_filter": "frame.number == 1147", "tcp_stream": 37 }, { "frame_number": 1153, "timestamp_epoch": "1725471280.314863000", "display_filter": "frame.number == 1153", "tcp_stream": 37 }, { "frame_number": 1533, "timestamp_epoch": "1725471306.398391000", "display_filter": "frame.number == 1533", "tcp_stream": 46 }, { "frame_number": 1549, "timestamp_epoch": "1725471306.485925000", "display_filter": "frame.number == 1549", "tcp_stream": 46 }, { "frame_number": 3625, "timestamp_epoch": "1725472175.979960000", "display_filter": "frame.number == 3625", "tcp_stream": 94 }, { "frame_number": 3628, "timestamp_epoch": "1725472176.070698000", "display_filter": "frame.number == 3628", "tcp_stream": 94 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-dd41bc521511e6e4fb7cc50d", "type": "domain", "value": "mobile.events.data.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1725472805.175604000", "last_seen_epoch": "1725474605.276234000", "evidence": [ { "frame_number": 4034, "timestamp_epoch": "1725472805.175604000", "display_filter": "frame.number == 4034", "udp_stream": 55 }, { "frame_number": 4035, "timestamp_epoch": "1725472805.204482000", "display_filter": "frame.number == 4035", "udp_stream": 55 }, { "frame_number": 4039, "timestamp_epoch": "1725472805.290742000", "display_filter": "frame.number == 4039", "tcp_stream": 109 }, { "frame_number": 4042, "timestamp_epoch": "1725472805.387393000", "display_filter": "frame.number == 4042", "tcp_stream": 109 }, { "frame_number": 5003, "timestamp_epoch": "1725474605.172253000", "display_filter": "frame.number == 5003", "tcp_stream": 150 }, { "frame_number": 5006, "timestamp_epoch": "1725474605.276234000", "display_filter": "frame.number == 5006", "tcp_stream": 150 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f16fb627e61ed8e42e726f2b", "type": "domain", "value": "odc.officeapps.live.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1725471277.731425000", "last_seen_epoch": "1725471277.953848000", "evidence": [ { "frame_number": 885, "timestamp_epoch": "1725471277.731425000", "display_filter": "frame.number == 885", "udp_stream": 19 }, { "frame_number": 886, "timestamp_epoch": "1725471277.873237000", "display_filter": "frame.number == 886", "udp_stream": 19 }, { "frame_number": 890, "timestamp_epoch": "1725471277.953848000", "display_filter": "frame.number == 890", "tcp_stream": 30 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-05f34be2af753354a987ddc4", "type": "domain", "value": "officeclient.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1725471276.987349000", "last_seen_epoch": "1725471277.289574000", "evidence": [ { "frame_number": 668, "timestamp_epoch": "1725471276.987349000", "display_filter": "frame.number == 668", "udp_stream": 16 }, { "frame_number": 805, "timestamp_epoch": "1725471277.198320000", "display_filter": "frame.number == 805", "udp_stream": 16 }, { "frame_number": 830, "timestamp_epoch": "1725471277.289574000", "display_filter": "frame.number == 830", "tcp_stream": 29 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-244420acec2e530f95871ffb", "type": "domain", "value": "oneclient.sfx.ms", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1725471280.294043000", "last_seen_epoch": "1725471280.373568000", "evidence": [ { "frame_number": 1150, "timestamp_epoch": "1725471280.294043000", "display_filter": "frame.number == 1150", "udp_stream": 21 }, { "frame_number": 1154, "timestamp_epoch": "1725471280.344228000", "display_filter": "frame.number == 1154", "udp_stream": 21 }, { "frame_number": 1158, "timestamp_epoch": "1725471280.373568000", "display_filter": "frame.number == 1158", "tcp_stream": 38 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f6be1fdd24901ab7607df212", "type": "domain", "value": "pti.store.microsoft.com", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1725471193.048261000", "last_seen_epoch": "1725471193.099436000", "evidence": [ { "frame_number": 152, "timestamp_epoch": "1725471193.048261000", "display_filter": "frame.number == 152", "udp_stream": 16 }, { "frame_number": 153, "timestamp_epoch": "1725471193.099436000", "display_filter": "frame.number == 153", "udp_stream": 16 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-498c9ceb010284295deb2bfb", "type": "domain", "value": "settings-win.data.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1725472176.753545000", "last_seen_epoch": "1725472178.641921000", "evidence": [ { "frame_number": 3683, "timestamp_epoch": "1725472176.753545000", "display_filter": "frame.number == 3683", "udp_stream": 53 }, { "frame_number": 3691, "timestamp_epoch": "1725472176.784640000", "display_filter": "frame.number == 3691", "udp_stream": 53 }, { "frame_number": 3707, "timestamp_epoch": "1725472177.022281000", "display_filter": "frame.number == 3707", "tcp_stream": 97 }, { "frame_number": 3741, "timestamp_epoch": "1725472178.641921000", "display_filter": "frame.number == 3741", "tcp_stream": 98 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-76028cebabec51753a8c63e1", "type": "domain", "value": "srtb.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1725471398.400443000", "last_seen_epoch": "1725471398.530743000", "evidence": [ { "frame_number": 2535, "timestamp_epoch": "1725471398.400443000", "display_filter": "frame.number == 2535", "udp_stream": 33 }, { "frame_number": 2536, "timestamp_epoch": "1725471398.400443000", "display_filter": "frame.number == 2536", "udp_stream": 34 }, { "frame_number": 2537, "timestamp_epoch": "1725471398.401014000", "display_filter": "frame.number == 2537", "udp_stream": 33 }, { "frame_number": 2538, "timestamp_epoch": "1725471398.401014000", "display_filter": "frame.number == 2538", "udp_stream": 34 }, { "frame_number": 2549, "timestamp_epoch": "1725471398.456051000", "display_filter": "frame.number == 2549", "tcp_stream": 61 }, { "frame_number": 2576, "timestamp_epoch": "1725471398.530743000", "display_filter": "frame.number == 2576", "tcp_stream": 61 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-61164e6a015216514a17263c", "type": "domain", "value": "sso.godaddy.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1725471280.556909000", "last_seen_epoch": "1725472176.429820000", "evidence": [ { "frame_number": 1198, "timestamp_epoch": "1725471280.556909000", "display_filter": "frame.number == 1198", "udp_stream": 21 }, { "frame_number": 1199, "timestamp_epoch": "1725471280.593815000", "display_filter": "frame.number == 1199", "udp_stream": 21 }, { "frame_number": 1629, "timestamp_epoch": "1725471306.710868000", "display_filter": "frame.number == 1629", "udp_stream": 22 }, { "frame_number": 1630, "timestamp_epoch": "1725471306.752557000", "display_filter": "frame.number == 1630", "udp_stream": 22 }, { "frame_number": 3645, "timestamp_epoch": "1725472176.363115000", "display_filter": "frame.number == 3645", "udp_stream": 51 }, { "frame_number": 3647, "timestamp_epoch": "1725472176.384136000", "display_filter": "frame.number == 3647", "udp_stream": 51 }, { "frame_number": 1203, "timestamp_epoch": "1725471280.627094000", "display_filter": "frame.number == 1203", "tcp_stream": 39 }, { "frame_number": 1635, "timestamp_epoch": "1725471306.787464000", "display_filter": "frame.number == 1635", "tcp_stream": 47 }, { "frame_number": 3651, "timestamp_epoch": "1725472176.429820000", "display_filter": "frame.number == 3651", "tcp_stream": 95 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0d037f2c2c2b690edc72ad71", "type": "domain", "value": "storecatalogrevocation.storequality.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1725471761.511296000", "last_seen_epoch": "1725471761.569885000", "evidence": [ { "frame_number": 3203, "timestamp_epoch": "1725471761.511296000", "display_filter": "frame.number == 3203", "udp_stream": 42 }, { "frame_number": 3204, "timestamp_epoch": "1725471761.523258000", "display_filter": "frame.number == 3204", "udp_stream": 42 }, { "frame_number": 3208, "timestamp_epoch": "1725471761.569885000", "display_filter": "frame.number == 3208", "tcp_stream": 74 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-fedabb3b92ada532ad804498", "type": "domain", "value": "th.bing.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1725471398.493602000", "last_seen_epoch": "1725471398.581566000", "evidence": [ { "frame_number": 2563, "timestamp_epoch": "1725471398.493602000", "display_filter": "frame.number == 2563", "udp_stream": 36 }, { "frame_number": 2564, "timestamp_epoch": "1725471398.493679000", "display_filter": "frame.number == 2564", "udp_stream": 37 }, { "frame_number": 2579, "timestamp_epoch": "1725471398.543132000", "display_filter": "frame.number == 2579", "udp_stream": 36 }, { "frame_number": 2595, "timestamp_epoch": "1725471398.581566000", "display_filter": "frame.number == 2595", "udp_stream": 37 }, { "frame_number": 2594, "timestamp_epoch": "1725471398.560998000", "display_filter": "frame.number == 2594" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9759066ba8684a16cb391a17", "type": "domain", "value": "v10.events.data.microsoft.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1725471255.643683000", "last_seen_epoch": "1725473078.983435000", "evidence": [ { "frame_number": 243, "timestamp_epoch": "1725471255.643683000", "display_filter": "frame.number == 243", "udp_stream": 16 }, { "frame_number": 244, "timestamp_epoch": "1725471255.698202000", "display_filter": "frame.number == 244", "udp_stream": 16 }, { "frame_number": 3140, "timestamp_epoch": "1725471611.266882000", "display_filter": "frame.number == 3140", "udp_stream": 42 }, { "frame_number": 3141, "timestamp_epoch": "1725471611.311344000", "display_filter": "frame.number == 3141", "udp_stream": 42 }, { "frame_number": 3259, "timestamp_epoch": "1725471852.356759000", "display_filter": "frame.number == 3259", "udp_stream": 43 }, { "frame_number": 3260, "timestamp_epoch": "1725471852.361183000", "display_filter": "frame.number == 3260", "udp_stream": 43 }, { "frame_number": 3666, "timestamp_epoch": "1725472176.534461000", "display_filter": "frame.number == 3666", "udp_stream": 52 }, { "frame_number": 3667, "timestamp_epoch": "1725472176.569111000", "display_filter": "frame.number == 3667", "udp_stream": 52 }, { "frame_number": 4255, "timestamp_epoch": "1725473078.753638000", "display_filter": "frame.number == 4255", "udp_stream": 58 }, { "frame_number": 4256, "timestamp_epoch": "1725473078.775806000", "display_filter": "frame.number == 4256", "udp_stream": 58 }, { "frame_number": 248, "timestamp_epoch": "1725471255.785470000", "display_filter": "frame.number == 248", "tcp_stream": 8 }, { "frame_number": 3145, "timestamp_epoch": "1725471611.405592000", "display_filter": "frame.number == 3145", "tcp_stream": 72 }, { "frame_number": 3264, "timestamp_epoch": "1725471852.446145000", "display_filter": "frame.number == 3264", "tcp_stream": 76 }, { "frame_number": 3673, "timestamp_epoch": "1725472176.675953000", "display_filter": "frame.number == 3673", "tcp_stream": 96 }, { "frame_number": 4260, "timestamp_epoch": "1725473078.983435000", "display_filter": "frame.number == 4260", "tcp_stream": 118 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-99ad4511b0e2e4eccbf5ffb2", "type": "domain", "value": "weathermapdata.blob.core.windows.net", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1725471938.548601000", "last_seen_epoch": "1725471938.764100000", "evidence": [ { "frame_number": 3389, "timestamp_epoch": "1725471938.548601000", "display_filter": "frame.number == 3389", "udp_stream": 47 }, { "frame_number": 3390, "timestamp_epoch": "1725471938.579425000", "display_filter": "frame.number == 3390", "udp_stream": 47 }, { "frame_number": 3394, "timestamp_epoch": "1725471938.677480000", "display_filter": "frame.number == 3394", "tcp_stream": 84 }, { "frame_number": 3397, "timestamp_epoch": "1725471938.764100000", "display_filter": "frame.number == 3397", "tcp_stream": 84 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3c1d6cd794474e12c8704a7e", "type": "domain", "value": "win-ctl9xbq9y19.bepositive.com", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1725471151.329715000", "last_seen_epoch": "1725471151.329895000", "evidence": [ { "frame_number": 13, "timestamp_epoch": "1725471151.329715000", "display_filter": "frame.number == 13", "udp_stream": 6 }, { "frame_number": 15, "timestamp_epoch": "1725471151.329895000", "display_filter": "frame.number == 15", "udp_stream": 6 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-62a3da4feabf87dceb92fb26", "type": "domain", "value": "windows.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1725471397.316273000", "last_seen_epoch": "1725472296.563763000", "evidence": [ { "frame_number": 2385, "timestamp_epoch": "1725471397.316273000", "display_filter": "frame.number == 2385", "udp_stream": 24 }, { "frame_number": 2386, "timestamp_epoch": "1725471397.316273000", "display_filter": "frame.number == 2386", "udp_stream": 25 }, { "frame_number": 2387, "timestamp_epoch": "1725471397.316356000", "display_filter": "frame.number == 2387", "udp_stream": 24 }, { "frame_number": 2394, "timestamp_epoch": "1725471397.361032000", "display_filter": "frame.number == 2394", "udp_stream": 25 }, { "frame_number": 3803, "timestamp_epoch": "1725472296.389804000", "display_filter": "frame.number == 3803", "udp_stream": 54 }, { "frame_number": 3804, "timestamp_epoch": "1725472296.427304000", "display_filter": "frame.number == 3804", "udp_stream": 54 }, { "frame_number": 2400, "timestamp_epoch": "1725471397.393741000", "display_filter": "frame.number == 2400", "tcp_stream": 58 }, { "frame_number": 2402, "timestamp_epoch": "1725471397.394047000", "display_filter": "frame.number == 2402", "tcp_stream": 57 }, { "frame_number": 2406, "timestamp_epoch": "1725471397.466055000", "display_filter": "frame.number == 2406", "tcp_stream": 58 }, { "frame_number": 2410, "timestamp_epoch": "1725471397.476052000", "display_filter": "frame.number == 2410", "tcp_stream": 57 }, { "frame_number": 3808, "timestamp_epoch": "1725472296.497990000", "display_filter": "frame.number == 3808", "tcp_stream": 101 }, { "frame_number": 3812, "timestamp_epoch": "1725472296.563763000", "display_filter": "frame.number == 3812", "tcp_stream": 101 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-96addb1502907b149b469513", "type": "domain", "value": "wpad.bepositive.com", "roles": [ "dns-query" ], "is_private": null, "first_seen_epoch": "1725471151.819433000", "last_seen_epoch": "1725474229.786887000", "evidence": [ { "frame_number": 39, "timestamp_epoch": "1725471151.819433000", "display_filter": "frame.number == 39", "udp_stream": 10 }, { "frame_number": 40, "timestamp_epoch": "1725471151.819433000", "display_filter": "frame.number == 40", "udp_stream": 11 }, { "frame_number": 41, "timestamp_epoch": "1725471151.819563000", "display_filter": "frame.number == 41", "udp_stream": 10 }, { "frame_number": 42, "timestamp_epoch": "1725471151.819563000", "display_filter": "frame.number == 42", "udp_stream": 11 }, { "frame_number": 109, "timestamp_epoch": "1725471169.837118000", "display_filter": "frame.number == 109", "udp_stream": 12 }, { "frame_number": 110, "timestamp_epoch": "1725471169.837323000", "display_filter": "frame.number == 110", "udp_stream": 16 }, { "frame_number": 111, "timestamp_epoch": "1725471169.837437000", "display_filter": "frame.number == 111", "udp_stream": 12 }, { "frame_number": 112, "timestamp_epoch": "1725471169.837588000", "display_filter": "frame.number == 112", "udp_stream": 16 }, { "frame_number": 213, "timestamp_epoch": "1725471229.852947000", "display_filter": "frame.number == 213", "udp_stream": 16 }, { "frame_number": 214, "timestamp_epoch": "1725471229.852947000", "display_filter": "frame.number == 214", "udp_stream": 12 }, { "frame_number": 215, "timestamp_epoch": "1725471229.852947000", "display_filter": "frame.number == 215", "udp_stream": 16 }, { "frame_number": 216, "timestamp_epoch": "1725471229.853010000", "display_filter": "frame.number == 216", "udp_stream": 12 }, { "frame_number": 2383, "timestamp_epoch": "1725471397.236915000", "display_filter": "frame.number == 2383", "udp_stream": 22 }, { "frame_number": 2384, "timestamp_epoch": "1725471397.237001000", "display_filter": "frame.number == 2384", "udp_stream": 22 }, { "frame_number": 2966, "timestamp_epoch": "1725471405.244456000", "display_filter": "frame.number == 2966", "udp_stream": 22 }, { "frame_number": 2967, "timestamp_epoch": "1725471405.244456000", "display_filter": "frame.number == 2967", "udp_stream": 22 }, { "frame_number": 3236, "timestamp_epoch": "1725471829.837424000", "display_filter": "frame.number == 3236", "udp_stream": 12 }, { "frame_number": 3237, "timestamp_epoch": "1725471829.837424000", "display_filter": "frame.number == 3237", "udp_stream": 43 }, { "frame_number": 3238, "timestamp_epoch": "1725471829.837499000", "display_filter": "frame.number == 3238", "udp_stream": 12 }, { "frame_number": 3239, "timestamp_epoch": "1725471829.838019000", "display_filter": "frame.number == 3239", "udp_stream": 43 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-662315583f6bf0f49d3c1c92", "type": "domain", "value": "www.bellantonicioccolato.it", "roles": [ "tls-sni" ], "is_private": null, "first_seen_epoch": "1725471304.852343000", "last_seen_epoch": "1725471309.448825000", "evidence": [ { "frame_number": 1279, "timestamp_epoch": "1725471304.852343000", "display_filter": "frame.number == 1279", "tcp_stream": 41 }, { "frame_number": 1704, "timestamp_epoch": "1725471309.448825000", "display_filter": "frame.number == 1704", "tcp_stream": 50 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7dcd3b8767333676581272ac", "type": "domain", "value": "www.bing.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1725471275.832629000", "last_seen_epoch": "1725471276.854367000", "evidence": [ { "frame_number": 498, "timestamp_epoch": "1725471275.832629000", "display_filter": "frame.number == 498", "udp_stream": 16 }, { "frame_number": 499, "timestamp_epoch": "1725471275.893014000", "display_filter": "frame.number == 499", "udp_stream": 16 }, { "frame_number": 504, "timestamp_epoch": "1725471275.925719000", "display_filter": "frame.number == 504", "tcp_stream": 22 }, { "frame_number": 623, "timestamp_epoch": "1725471276.854367000", "display_filter": "frame.number == 623", "tcp_stream": 27 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-16ff53248072ce41d2f816ab", "type": "domain", "value": "www.msftconnecttest.com", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1725471151.835596000", "last_seen_epoch": "1725471153.035136000", "evidence": [ { "frame_number": 47, "timestamp_epoch": "1725471151.835596000", "display_filter": "frame.number == 47", "udp_stream": 11 }, { "frame_number": 48, "timestamp_epoch": "1725471151.893848000", "display_filter": "frame.number == 48", "udp_stream": 11 }, { "frame_number": 67, "timestamp_epoch": "1725471152.993509000", "display_filter": "frame.number == 67", "udp_stream": 12 }, { "frame_number": 68, "timestamp_epoch": "1725471152.994150000", "display_filter": "frame.number == 68", "udp_stream": 12 }, { "frame_number": 52, "timestamp_epoch": "1725471151.936110000", "display_filter": "frame.number == 52", "tcp_stream": 1 }, { "frame_number": 72, "timestamp_epoch": "1725471153.035136000", "display_filter": "frame.number == 72", "tcp_stream": 2 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-8c6feebc922a82c80750e0c9", "type": "domain", "value": "www.msn.com", "roles": [ "dns-query", "tls-sni" ], "is_private": null, "first_seen_epoch": "1725471276.652439000", "last_seen_epoch": "1725471397.913797000", "evidence": [ { "frame_number": 599, "timestamp_epoch": "1725471276.652439000", "display_filter": "frame.number == 599", "udp_stream": 16 }, { "frame_number": 602, "timestamp_epoch": "1725471276.695416000", "display_filter": "frame.number == 602", "udp_stream": 16 }, { "frame_number": 2437, "timestamp_epoch": "1725471397.772742000", "display_filter": "frame.number == 2437", "udp_stream": 26 }, { "frame_number": 2438, "timestamp_epoch": "1725471397.772803000", "display_filter": "frame.number == 2438", "udp_stream": 27 }, { "frame_number": 2439, "timestamp_epoch": "1725471397.773492000", "display_filter": "frame.number == 2439", "udp_stream": 26 }, { "frame_number": 2440, "timestamp_epoch": "1725471397.773492000", "display_filter": "frame.number == 2440", "udp_stream": 27 }, { "frame_number": 614, "timestamp_epoch": "1725471276.750506000", "display_filter": "frame.number == 614", "tcp_stream": 26 }, { "frame_number": 619, "timestamp_epoch": "1725471276.816165000", "display_filter": "frame.number == 619", "tcp_stream": 26 }, { "frame_number": 2445, "timestamp_epoch": "1725471397.836563000", "display_filter": "frame.number == 2445", "tcp_stream": 59 }, { "frame_number": 2448, "timestamp_epoch": "1725471397.913797000", "display_filter": "frame.number == 2448", "tcp_stream": 59 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5f6aac755abc49487bc5c713", "type": "domain", "value": "x1.c.lencr.org", "roles": [ "dns-query", "http-host" ], "is_private": null, "first_seen_epoch": "1725473139.491801000", "last_seen_epoch": "1725473139.549530000", "evidence": [ { "frame_number": 4303, "timestamp_epoch": "1725473139.491801000", "display_filter": "frame.number == 4303", "udp_stream": 59 }, { "frame_number": 4304, "timestamp_epoch": "1725473139.509498000", "display_filter": "frame.number == 4304", "udp_stream": 59 }, { "frame_number": 4308, "timestamp_epoch": "1725473139.549530000", "display_filter": "frame.number == 4308", "tcp_stream": 119 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-32c64d6ba8531e3e7d0c3319", "type": "ipv4", "value": "0.0.0.0", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-07ece9e613136c222be6dc97", "type": "ipv4", "value": "13.107.246.57", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725471296.712511000", "last_seen_epoch": "1725471296.712511000", "evidence": [ { "frame_number": 1245, "timestamp_epoch": "1725471296.712511000", "display_filter": "frame.number == 1245", "udp_stream": 21 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a90df293efcabaa277bc0671", "type": "ipv4", "value": "13.70.79.200", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725473078.775806000", "last_seen_epoch": "1725473078.775806000", "evidence": [ { "frame_number": 4256, "timestamp_epoch": "1725473078.775806000", "display_filter": "frame.number == 4256", "udp_stream": 58 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-991a8a6ea6374506ae6774b4", "type": "ipv4", "value": "13.89.179.9", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725471611.311344000", "last_seen_epoch": "1725471611.311344000", "evidence": [ { "frame_number": 3141, "timestamp_epoch": "1725471611.311344000", "display_filter": "frame.number == 3141", "udp_stream": 42 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-31bcbc3b9fef2c263ba1f9c7", "type": "ipv4", "value": "131.107.255.255", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471157.973714000", "last_seen_epoch": "1725473361.448204000", "evidence": [ { "frame_number": 106, "timestamp_epoch": "1725471157.973714000", "display_filter": "frame.number == 106", "udp_stream": 12 }, { "frame_number": 4420, "timestamp_epoch": "1725473271.491784000", "display_filter": "frame.number == 4420", "udp_stream": 12 }, { "frame_number": 4453, "timestamp_epoch": "1725473361.448204000", "display_filter": "frame.number == 4453", "udp_stream": 61 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-455257b0a99f25e076b7722c", "type": "ipv4", "value": "172.17.0.17", "roles": [ "dns-answer", "network-endpoint" ], "is_private": true, "first_seen_epoch": "1725471151.328944000", "last_seen_epoch": "1725473582.020674000", "evidence": [ { "frame_number": 9, "timestamp_epoch": "1725471151.328944000", "display_filter": "frame.number == 9", "udp_stream": 2 }, { "frame_number": 14, "timestamp_epoch": "1725471151.329895000", "display_filter": "frame.number == 14", "udp_stream": 5 }, { "frame_number": 15, "timestamp_epoch": "1725471151.329895000", "display_filter": "frame.number == 15", "udp_stream": 6 }, { "frame_number": 25, "timestamp_epoch": "1725471151.431808000", "display_filter": "frame.number == 25", "udp_stream": 6 }, { "frame_number": 2251, "timestamp_epoch": "1725471336.131495000", "display_filter": "frame.number == 2251", "udp_stream": 22 }, { "frame_number": 3305, "timestamp_epoch": "1725471878.253126000", "display_filter": "frame.number == 3305", "udp_stream": 44 }, { "frame_number": 3318, "timestamp_epoch": "1725471878.366739000", "display_filter": "frame.number == 3318", "udp_stream": 44 }, { "frame_number": 4550, "timestamp_epoch": "1725473582.020674000", "display_filter": "frame.number == 4550", "udp_stream": 60 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c70d3930e176616ed9dd9493", "type": "ipv4", "value": "172.17.0.255", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-883558140b35d7023efc530b", "type": "ipv4", "value": "172.17.0.99", "roles": [ "dns-answer", "network-endpoint" ], "is_private": true, "first_seen_epoch": "1725471151.330497000", "last_seen_epoch": "1725471151.332560000", "evidence": [ { "frame_number": 17, "timestamp_epoch": "1725471151.330497000", "display_filter": "frame.number == 17", "udp_stream": 5 }, { "frame_number": 19, "timestamp_epoch": "1725471151.332560000", "display_filter": "frame.number == 19", "udp_stream": 5 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-64ccfc31c40ea59ee7700bf8", "type": "ipv4", "value": "184.29.137.96", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725473139.509498000", "last_seen_epoch": "1725473139.509498000", "evidence": [ { "frame_number": 4304, "timestamp_epoch": "1725473139.509498000", "display_filter": "frame.number == 4304", "udp_stream": 59 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e086efe9fb4a5c50d45dff16", "type": "ipv4", "value": "199.232.210.172", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725472865.560513000", "last_seen_epoch": "1725473139.609265000", "evidence": [ { "frame_number": 4116, "timestamp_epoch": "1725472865.560513000", "display_filter": "frame.number == 4116", "udp_stream": 57 }, { "frame_number": 4312, "timestamp_epoch": "1725473139.609265000", "display_filter": "frame.number == 4312", "udp_stream": 60 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7cf59219d4030f329a8fb0cb", "type": "ipv4", "value": "199.232.214.172", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725472865.560513000", "last_seen_epoch": "1725473139.609265000", "evidence": [ { "frame_number": 4116, "timestamp_epoch": "1725472865.560513000", "display_filter": "frame.number == 4116", "udp_stream": 57 }, { "frame_number": 4312, "timestamp_epoch": "1725473139.609265000", "display_filter": "frame.number == 4312", "udp_stream": 60 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7be9d17fd0fa4a44c8f32058", "type": "ipv4", "value": "20.10.31.115", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-b91057adb9d70474b05b6a10", "type": "ipv4", "value": "20.189.173.1", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725472176.569111000", "last_seen_epoch": "1725472176.569111000", "evidence": [ { "frame_number": 3667, "timestamp_epoch": "1725472176.569111000", "display_filter": "frame.number == 3667", "udp_stream": 52 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-64207bfbb8de5ccb4fbd178e", "type": "ipv4", "value": "20.189.173.18", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725472805.204482000", "last_seen_epoch": "1725472805.204482000", "evidence": [ { "frame_number": 4035, "timestamp_epoch": "1725472805.204482000", "display_filter": "frame.number == 4035", "udp_stream": 55 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-220bcbc7a4e9b02574fa026a", "type": "ipv4", "value": "20.189.173.26", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725471852.361183000", "last_seen_epoch": "1725471852.361183000", "evidence": [ { "frame_number": 3260, "timestamp_epoch": "1725471852.361183000", "display_filter": "frame.number == 3260", "udp_stream": 43 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-afd434c12b8ab5358628ca67", "type": "ipv4", "value": "20.190.135.2", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725472175.894362000", "last_seen_epoch": "1725472175.894362000", "evidence": [ { "frame_number": 3621, "timestamp_epoch": "1725472175.894362000", "display_filter": "frame.number == 3621", "udp_stream": 50 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a90650d45cded46e7ac0ea3f", "type": "ipv4", "value": "20.241.44.114", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725471279.977517000", "last_seen_epoch": "1725471279.977517000", "evidence": [ { "frame_number": 1052, "timestamp_epoch": "1725471279.977517000", "display_filter": "frame.number == 1052", "udp_stream": 20 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0e8efed01d8901f8543ca76b", "type": "ipv4", "value": "20.42.73.28", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725471255.698202000", "last_seen_epoch": "1725471255.698202000", "evidence": [ { "frame_number": 244, "timestamp_epoch": "1725471255.698202000", "display_filter": "frame.number == 244", "udp_stream": 16 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-bf9c483639e2912efcc3591e", "type": "ipv4", "value": "20.60.228.1", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725471938.579425000", "last_seen_epoch": "1725471938.579425000", "evidence": [ { "frame_number": 3390, "timestamp_epoch": "1725471938.579425000", "display_filter": "frame.number == 3390", "udp_stream": 47 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9538d90f188e64e812348fcb", "type": "ipv4", "value": "20.96.153.111", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725471276.337426000", "last_seen_epoch": "1725471471.488905000", "evidence": [ { "frame_number": 575, "timestamp_epoch": "1725471276.337426000", "display_filter": "frame.number == 575", "udp_stream": 16 }, { "frame_number": 3038, "timestamp_epoch": "1725471471.488905000", "display_filter": "frame.number == 3038", "udp_stream": 22 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0854aeee40e3fdf89af3c2f2", "type": "ipv4", "value": "204.79.197.203", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725471276.695416000", "last_seen_epoch": "1725472296.427304000", "evidence": [ { "frame_number": 602, "timestamp_epoch": "1725471276.695416000", "display_filter": "frame.number == 602", "udp_stream": 16 }, { "frame_number": 2387, "timestamp_epoch": "1725471397.316356000", "display_filter": "frame.number == 2387", "udp_stream": 24 }, { "frame_number": 2439, "timestamp_epoch": "1725471397.773492000", "display_filter": "frame.number == 2439", "udp_stream": 26 }, { "frame_number": 2490, "timestamp_epoch": "1725471398.205460000", "display_filter": "frame.number == 2490", "udp_stream": 28 }, { "frame_number": 2537, "timestamp_epoch": "1725471398.401014000", "display_filter": "frame.number == 2537", "udp_stream": 33 }, { "frame_number": 3804, "timestamp_epoch": "1725472296.427304000", "display_filter": "frame.number == 3804", "udp_stream": 54 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f2f779b95434ed795cdcbd52", "type": "ipv4", "value": "224.0.0.251", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-e881271fb667c2516fbd6b39", "type": "ipv4", "value": "224.0.0.252", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-59d3136a53f9e03defa9a742", "type": "ipv4", "value": "23.194.68.140", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725471761.523258000", "last_seen_epoch": "1725471761.523258000", "evidence": [ { "frame_number": 3204, "timestamp_epoch": "1725471761.523258000", "display_filter": "frame.number == 3204", "udp_stream": 42 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3ba9991d1beba904565d42f4", "type": "ipv4", "value": "23.195.212.189", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725471280.593815000", "last_seen_epoch": "1725472176.384136000", "evidence": [ { "frame_number": 1199, "timestamp_epoch": "1725471280.593815000", "display_filter": "frame.number == 1199", "udp_stream": 21 }, { "frame_number": 1630, "timestamp_epoch": "1725471306.752557000", "display_filter": "frame.number == 1630", "udp_stream": 22 }, { "frame_number": 3647, "timestamp_epoch": "1725472176.384136000", "display_filter": "frame.number == 3647", "udp_stream": 51 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-52b04d19d45d3341f14e26ba", "type": "ipv4", "value": "23.220.251.149", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725471151.893848000", "last_seen_epoch": "1725471152.994150000", "evidence": [ { "frame_number": 48, "timestamp_epoch": "1725471151.893848000", "display_filter": "frame.number == 48", "udp_stream": 11 }, { "frame_number": 68, "timestamp_epoch": "1725471152.994150000", "display_filter": "frame.number == 68", "udp_stream": 12 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a18c73d8beaaf7812f4962a3", "type": "ipv4", "value": "23.220.251.153", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725471398.606869000", "last_seen_epoch": "1725471398.606869000", "evidence": [ { "frame_number": 2622, "timestamp_epoch": "1725471398.606869000", "display_filter": "frame.number == 2622", "udp_stream": 38 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d79653c0d699c987e83907a7", "type": "ipv4", "value": "23.220.251.158", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725471151.893848000", "last_seen_epoch": "1725471152.994150000", "evidence": [ { "frame_number": 48, "timestamp_epoch": "1725471151.893848000", "display_filter": "frame.number == 48", "udp_stream": 11 }, { "frame_number": 68, "timestamp_epoch": "1725471152.994150000", "display_filter": "frame.number == 68", "udp_stream": 12 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a23ba92176a945c64b4c5f59", "type": "ipv4", "value": "23.220.251.160", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471398.606869000", "last_seen_epoch": "1725471398.606869000", "evidence": [ { "frame_number": 2622, "timestamp_epoch": "1725471398.606869000", "display_filter": "frame.number == 2622", "udp_stream": 38 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-aab7261dde18af5d51c523cc", "type": "ipv4", "value": "23.220.251.47", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725471995.498031000", "last_seen_epoch": "1725471995.498031000", "evidence": [ { "frame_number": 3436, "timestamp_epoch": "1725471995.498031000", "display_filter": "frame.number == 3436", "udp_stream": 48 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-148c049b9432df69afa97aef", "type": "ipv4", "value": "23.220.251.48", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471995.498031000", "last_seen_epoch": "1725471995.498031000", "evidence": [ { "frame_number": 3436, "timestamp_epoch": "1725471995.498031000", "display_filter": "frame.number == 3436", "udp_stream": 48 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a69154761c5d06f00c6dfc00", "type": "ipv4", "value": "23.221.24.49", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471275.893014000", "last_seen_epoch": "1725471275.893014000", "evidence": [ { "frame_number": 499, "timestamp_epoch": "1725471275.893014000", "display_filter": "frame.number == 499", "udp_stream": 16 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-af6b936f6b82150eef0eb371", "type": "ipv4", "value": "23.221.24.50", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471275.893014000", "last_seen_epoch": "1725471275.893014000", "evidence": [ { "frame_number": 499, "timestamp_epoch": "1725471275.893014000", "display_filter": "frame.number == 499", "udp_stream": 16 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-419c945b325cbeb127cbfc6c", "type": "ipv4", "value": "23.221.24.51", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471275.893014000", "last_seen_epoch": "1725471275.893014000", "evidence": [ { "frame_number": 499, "timestamp_epoch": "1725471275.893014000", "display_filter": "frame.number == 499", "udp_stream": 16 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ae889055fa3369fb5be1d54e", "type": "ipv4", "value": "23.221.24.52", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471275.893014000", "last_seen_epoch": "1725471275.893014000", "evidence": [ { "frame_number": 499, "timestamp_epoch": "1725471275.893014000", "display_filter": "frame.number == 499", "udp_stream": 16 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-8bcf2a3a74432ca36196d77c", "type": "ipv4", "value": "23.221.24.53", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471275.893014000", "last_seen_epoch": "1725471275.893014000", "evidence": [ { "frame_number": 499, "timestamp_epoch": "1725471275.893014000", "display_filter": "frame.number == 499", "udp_stream": 16 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3a779976edebb2e0484c042d", "type": "ipv4", "value": "23.221.24.55", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471275.893014000", "last_seen_epoch": "1725471275.893014000", "evidence": [ { "frame_number": 499, "timestamp_epoch": "1725471275.893014000", "display_filter": "frame.number == 499", "udp_stream": 16 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f412af81fc5f3adc4ac6926d", "type": "ipv4", "value": "23.221.24.56", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471275.893014000", "last_seen_epoch": "1725471398.543132000", "evidence": [ { "frame_number": 499, "timestamp_epoch": "1725471275.893014000", "display_filter": "frame.number == 499", "udp_stream": 16 }, { "frame_number": 2579, "timestamp_epoch": "1725471398.543132000", "display_filter": "frame.number == 2579", "udp_stream": 36 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-961e21ac103e2c32882958ed", "type": "ipv4", "value": "23.221.24.57", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471275.893014000", "last_seen_epoch": "1725471275.893014000", "evidence": [ { "frame_number": 499, "timestamp_epoch": "1725471275.893014000", "display_filter": "frame.number == 499", "udp_stream": 16 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e3774371426d5328b9abfcb4", "type": "ipv4", "value": "23.221.24.58", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725471275.893014000", "last_seen_epoch": "1725471398.543132000", "evidence": [ { "frame_number": 499, "timestamp_epoch": "1725471275.893014000", "display_filter": "frame.number == 499", "udp_stream": 16 }, { "frame_number": 2579, "timestamp_epoch": "1725471398.543132000", "display_filter": "frame.number == 2579", "udp_stream": 36 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-cb486cb06a96efacfebc00b0", "type": "ipv4", "value": "23.221.24.62", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471398.543132000", "last_seen_epoch": "1725471398.543132000", "evidence": [ { "frame_number": 2579, "timestamp_epoch": "1725471398.543132000", "display_filter": "frame.number == 2579", "udp_stream": 36 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-0c6d84af90b01ef25a0e9785", "type": "ipv4", "value": "23.221.24.63", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471398.543132000", "last_seen_epoch": "1725471398.543132000", "evidence": [ { "frame_number": 2579, "timestamp_epoch": "1725471398.543132000", "display_filter": "frame.number == 2579", "udp_stream": 36 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-729b044eec82e546e4d78e01", "type": "ipv4", "value": "23.221.24.64", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471398.543132000", "last_seen_epoch": "1725471398.543132000", "evidence": [ { "frame_number": 2579, "timestamp_epoch": "1725471398.543132000", "display_filter": "frame.number == 2579", "udp_stream": 36 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-48caf43126a2e67f72a0d918", "type": "ipv4", "value": "23.221.24.68", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471398.543132000", "last_seen_epoch": "1725471398.543132000", "evidence": [ { "frame_number": 2579, "timestamp_epoch": "1725471398.543132000", "display_filter": "frame.number == 2579", "udp_stream": 36 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-31257a98e13bd991800e2e38", "type": "ipv4", "value": "23.221.24.69", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725471398.543132000", "last_seen_epoch": "1725471398.543132000", "evidence": [ { "frame_number": 2579, "timestamp_epoch": "1725471398.543132000", "display_filter": "frame.number == 2579", "udp_stream": 36 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3943c2917aeddae6ec2ffd65", "type": "ipv4", "value": "23.221.24.70", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471398.543132000", "last_seen_epoch": "1725471398.543132000", "evidence": [ { "frame_number": 2579, "timestamp_epoch": "1725471398.543132000", "display_filter": "frame.number == 2579", "udp_stream": 36 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-01158a917a91a9204c199760", "type": "ipv4", "value": "23.221.24.73", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471398.543132000", "last_seen_epoch": "1725471398.543132000", "evidence": [ { "frame_number": 2579, "timestamp_epoch": "1725471398.543132000", "display_filter": "frame.number == 2579", "udp_stream": 36 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-262a67735d87965241f2af4e", "type": "ipv4", "value": "23.40.145.142", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725471280.344228000", "last_seen_epoch": "1725471280.344228000", "evidence": [ { "frame_number": 1154, "timestamp_epoch": "1725471280.344228000", "display_filter": "frame.number == 1154", "udp_stream": 21 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-6143a0369ec6c4617c763c2a", "type": "ipv4", "value": "23.45.119.134", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725473809.500722000", "last_seen_epoch": "1725473809.500722000", "evidence": [ { "frame_number": 4696, "timestamp_epoch": "1725473809.500722000", "display_filter": "frame.number == 4696", "udp_stream": 60 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7bb9ef3f053d235c2c2eb861", "type": "ipv4", "value": "23.45.119.140", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725473809.500722000", "last_seen_epoch": "1725473809.500722000", "evidence": [ { "frame_number": 4696, "timestamp_epoch": "1725473809.500722000", "display_filter": "frame.number == 4696", "udp_stream": 60 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-8f0a08185e5cc115e14c353a", "type": "ipv4", "value": "23.45.119.142", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725473809.500722000", "last_seen_epoch": "1725473809.500722000", "evidence": [ { "frame_number": 4696, "timestamp_epoch": "1725473809.500722000", "display_filter": "frame.number == 4696", "udp_stream": 60 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7c6aa5b9bb832d077ee1daba", "type": "ipv4", "value": "23.45.119.143", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725471276.098646000", "last_seen_epoch": "1725472090.716600000", "evidence": [ { "frame_number": 531, "timestamp_epoch": "1725471276.098646000", "display_filter": "frame.number == 531", "udp_stream": 16 }, { "frame_number": 2489, "timestamp_epoch": "1725471398.205460000", "display_filter": "frame.number == 2489", "udp_stream": 30 }, { "frame_number": 3353, "timestamp_epoch": "1725471878.561381000", "display_filter": "frame.number == 3353", "udp_stream": 44 }, { "frame_number": 3504, "timestamp_epoch": "1725472090.716600000", "display_filter": "frame.number == 3504", "udp_stream": 49 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4d9fa9ca715f618134d997fa", "type": "ipv4", "value": "23.45.119.144", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725471276.098646000", "last_seen_epoch": "1725473809.500722000", "evidence": [ { "frame_number": 531, "timestamp_epoch": "1725471276.098646000", "display_filter": "frame.number == 531", "udp_stream": 16 }, { "frame_number": 2489, "timestamp_epoch": "1725471398.205460000", "display_filter": "frame.number == 2489", "udp_stream": 30 }, { "frame_number": 3353, "timestamp_epoch": "1725471878.561381000", "display_filter": "frame.number == 3353", "udp_stream": 44 }, { "frame_number": 3504, "timestamp_epoch": "1725472090.716600000", "display_filter": "frame.number == 3504", "udp_stream": 49 }, { "frame_number": 4696, "timestamp_epoch": "1725473809.500722000", "display_filter": "frame.number == 4696", "udp_stream": 60 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7dd9dcf2af3de59b1841dfc5", "type": "ipv4", "value": "23.45.119.146", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471398.205460000", "last_seen_epoch": "1725473809.500722000", "evidence": [ { "frame_number": 2489, "timestamp_epoch": "1725471398.205460000", "display_filter": "frame.number == 2489", "udp_stream": 30 }, { "frame_number": 4696, "timestamp_epoch": "1725473809.500722000", "display_filter": "frame.number == 4696", "udp_stream": 60 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a69ef70fa4b8062476f01a34", "type": "ipv4", "value": "23.45.119.147", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725473809.500722000", "last_seen_epoch": "1725473809.500722000", "evidence": [ { "frame_number": 4696, "timestamp_epoch": "1725473809.500722000", "display_filter": "frame.number == 4696", "udp_stream": 60 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c164f783ed37326a1ea58c57", "type": "ipv4", "value": "23.45.119.166", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471607.486570000", "last_seen_epoch": "1725471607.486570000", "evidence": [ { "frame_number": 3139, "timestamp_epoch": "1725471607.486570000", "display_filter": "frame.number == 3139", "udp_stream": 41 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-1c23eb13d70d5520e7b7570c", "type": "ipv4", "value": "23.45.119.174", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471607.486570000", "last_seen_epoch": "1725471607.486570000", "evidence": [ { "frame_number": 3139, "timestamp_epoch": "1725471607.486570000", "display_filter": "frame.number == 3139", "udp_stream": 41 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f3e96b25b071ae27fa6cb950", "type": "ipv4", "value": "255.255.255.255", "roles": [ "network-endpoint" ], "is_private": true, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-8b13cca13380cd7365e540ae", "type": "ipv4", "value": "40.119.249.228", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725472176.784640000", "last_seen_epoch": "1725472176.784640000", "evidence": [ { "frame_number": 3691, "timestamp_epoch": "1725472176.784640000", "display_filter": "frame.number == 3691", "udp_stream": 53 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e147472bfaefcc942273df22", "type": "ipv4", "value": "40.126.28.11", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471280.152646000", "last_seen_epoch": "1725472175.894362000", "evidence": [ { "frame_number": 1140, "timestamp_epoch": "1725471280.152646000", "display_filter": "frame.number == 1140", "udp_stream": 21 }, { "frame_number": 3621, "timestamp_epoch": "1725472175.894362000", "display_filter": "frame.number == 3621", "udp_stream": 50 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7c55c64539e9533aaaad94e2", "type": "ipv4", "value": "40.126.28.12", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725471280.152646000", "last_seen_epoch": "1725471280.152646000", "evidence": [ { "frame_number": 1140, "timestamp_epoch": "1725471280.152646000", "display_filter": "frame.number == 1140", "udp_stream": 21 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-482491f0566aa3f856da3aa2", "type": "ipv4", "value": "40.126.28.13", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471280.152646000", "last_seen_epoch": "1725471280.152646000", "evidence": [ { "frame_number": 1140, "timestamp_epoch": "1725471280.152646000", "display_filter": "frame.number == 1140", "udp_stream": 21 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f2512f4cff8e422b052a86ec", "type": "ipv4", "value": "40.126.28.18", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471280.152646000", "last_seen_epoch": "1725471280.152646000", "evidence": [ { "frame_number": 1140, "timestamp_epoch": "1725471280.152646000", "display_filter": "frame.number == 1140", "udp_stream": 21 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2e8ecacc0db29157eb5e9dea", "type": "ipv4", "value": "40.126.28.19", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725472175.894362000", "last_seen_epoch": "1725472175.894362000", "evidence": [ { "frame_number": 3621, "timestamp_epoch": "1725472175.894362000", "display_filter": "frame.number == 3621", "udp_stream": 50 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-45ff9179c5452b0476eb0834", "type": "ipv4", "value": "40.126.28.20", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471280.152646000", "last_seen_epoch": "1725472175.894362000", "evidence": [ { "frame_number": 1140, "timestamp_epoch": "1725471280.152646000", "display_filter": "frame.number == 1140", "udp_stream": 21 }, { "frame_number": 3621, "timestamp_epoch": "1725472175.894362000", "display_filter": "frame.number == 3621", "udp_stream": 50 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e30605c133819f986e89d634", "type": "ipv4", "value": "40.126.28.21", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725472175.894362000", "last_seen_epoch": "1725472175.894362000", "evidence": [ { "frame_number": 3621, "timestamp_epoch": "1725472175.894362000", "display_filter": "frame.number == 3621", "udp_stream": 50 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e6fabcf46745ca823afc81dc", "type": "ipv4", "value": "40.126.28.22", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725472175.894362000", "last_seen_epoch": "1725472175.894362000", "evidence": [ { "frame_number": 3621, "timestamp_epoch": "1725472175.894362000", "display_filter": "frame.number == 3621", "udp_stream": 50 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-8cf5ccdb138f7268fad961b2", "type": "ipv4", "value": "40.126.28.23", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471280.152646000", "last_seen_epoch": "1725472175.894362000", "evidence": [ { "frame_number": 1140, "timestamp_epoch": "1725471280.152646000", "display_filter": "frame.number == 1140", "udp_stream": 21 }, { "frame_number": 3621, "timestamp_epoch": "1725472175.894362000", "display_filter": "frame.number == 3621", "udp_stream": 50 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b5bf0c53bc07bd6732718567", "type": "ipv4", "value": "40.126.7.32", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471280.152646000", "last_seen_epoch": "1725472175.894362000", "evidence": [ { "frame_number": 1140, "timestamp_epoch": "1725471280.152646000", "display_filter": "frame.number == 1140", "udp_stream": 21 }, { "frame_number": 3621, "timestamp_epoch": "1725472175.894362000", "display_filter": "frame.number == 3621", "udp_stream": 50 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-def4a686c001a7db7f726ae2", "type": "ipv4", "value": "40.126.7.35", "roles": [ "dns-answer" ], "is_private": false, "first_seen_epoch": "1725471280.152646000", "last_seen_epoch": "1725471280.152646000", "evidence": [ { "frame_number": 1140, "timestamp_epoch": "1725471280.152646000", "display_filter": "frame.number == 1140", "udp_stream": 21 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-55fa74a6c176fa48c0ebffdc", "type": "ipv4", "value": "46.254.34.201", "roles": [ "network-endpoint" ], "is_private": false, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-7081e61bc8b39accd5691d76", "type": "ipv4", "value": "52.109.0.142", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725471277.873237000", "last_seen_epoch": "1725471277.873237000", "evidence": [ { "frame_number": 886, "timestamp_epoch": "1725471277.873237000", "display_filter": "frame.number == 886", "udp_stream": 19 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c22217fa5c92e25c1d651c90", "type": "ipv4", "value": "52.109.0.91", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725471277.198320000", "last_seen_epoch": "1725471277.198320000", "evidence": [ { "frame_number": 805, "timestamp_epoch": "1725471277.198320000", "display_filter": "frame.number == 805", "udp_stream": 16 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-b0cf8b36ad03ffc51f620831", "type": "ipv4", "value": "52.113.194.132", "roles": [ "dns-answer", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725472852.165472000", "last_seen_epoch": "1725472852.165472000", "evidence": [ { "frame_number": 4078, "timestamp_epoch": "1725472852.165472000", "display_filter": "frame.number == 4078", "udp_stream": 56 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-9aad575f3b70c234efe526c8", "type": "ipv4", "value": "79.124.78.197", "roles": [ "http-host", "network-endpoint" ], "is_private": false, "first_seen_epoch": "1725471307.211814000", "last_seen_epoch": "1725474713.072428000", "evidence": [ { "frame_number": 1668, "timestamp_epoch": "1725471307.211814000", "display_filter": "frame.number == 1668", "tcp_stream": 48 }, { "frame_number": 1672, "timestamp_epoch": "1725471307.858400000", "display_filter": "frame.number == 1672", "tcp_stream": 48 }, { "frame_number": 1697, "timestamp_epoch": "1725471308.684142000", "display_filter": "frame.number == 1697", "tcp_stream": 48 }, { "frame_number": 2227, "timestamp_epoch": "1725471311.316859000", "display_filter": "frame.number == 2227", "tcp_stream": 51 }, { "frame_number": 2236, "timestamp_epoch": "1725471312.546458000", "display_filter": "frame.number == 2236", "tcp_stream": 51 }, { "frame_number": 2347, "timestamp_epoch": "1725471377.781476000", "display_filter": "frame.number == 2347", "tcp_stream": 56 }, { "frame_number": 2985, "timestamp_epoch": "1725471446.911862000", "display_filter": "frame.number == 2985", "tcp_stream": 63 }, { "frame_number": 3077, "timestamp_epoch": "1725471516.062291000", "display_filter": "frame.number == 3077", "tcp_stream": 68 }, { "frame_number": 3129, "timestamp_epoch": "1725471585.206401000", "display_filter": "frame.number == 3129", "tcp_stream": 71 }, { "frame_number": 3181, "timestamp_epoch": "1725471654.324762000", "display_filter": "frame.number == 3181", "tcp_stream": 73 }, { "frame_number": 3191, "timestamp_epoch": "1725471714.999064000", "display_filter": "frame.number == 3191", "tcp_stream": 73 }, { "frame_number": 3232, "timestamp_epoch": "1725471775.696228000", "display_filter": "frame.number == 3232", "tcp_stream": 73 }, { "frame_number": 3251, "timestamp_epoch": "1725471836.836309000", "display_filter": "frame.number == 3251", "tcp_stream": 75 }, { "frame_number": 3385, "timestamp_epoch": "1725471897.919897000", "display_filter": "frame.number == 3385", "tcp_stream": 83 }, { "frame_number": 3429, "timestamp_epoch": "1725471958.615189000", "display_filter": "frame.number == 3429", "tcp_stream": 83 }, { "frame_number": 3464, "timestamp_epoch": "1725472019.697304000", "display_filter": "frame.number == 3464", "tcp_stream": 86 }, { "frame_number": 3531, "timestamp_epoch": "1725472104.750554000", "display_filter": "frame.number == 3531", "tcp_stream": 89 }, { "frame_number": 3772, "timestamp_epoch": "1725472189.873627000", "display_filter": "frame.number == 3772", "tcp_stream": 99 }, { "frame_number": 3799, "timestamp_epoch": "1725472275.032276000", "display_filter": "frame.number == 3799", "tcp_stream": 100 }, { "frame_number": 3873, "timestamp_epoch": "1725472360.171010000", "display_filter": "frame.number == 3873", "tcp_stream": 103 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-f253ac4fec12237c939af847", "type": "ja3", "value": "091f51a7a1c3a4504a224cc081ce9cee", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1725471255.785470000", "last_seen_epoch": "1725473078.983435000", "evidence": [ { "frame_number": 248, "timestamp_epoch": "1725471255.785470000", "display_filter": "frame.number == 248", "tcp_stream": 8 }, { "frame_number": 3145, "timestamp_epoch": "1725471611.405592000", "display_filter": "frame.number == 3145", "tcp_stream": 72 }, { "frame_number": 3264, "timestamp_epoch": "1725471852.446145000", "display_filter": "frame.number == 3264", "tcp_stream": 76 }, { "frame_number": 3673, "timestamp_epoch": "1725472176.675953000", "display_filter": "frame.number == 3673", "tcp_stream": 96 }, { "frame_number": 3707, "timestamp_epoch": "1725472177.022281000", "display_filter": "frame.number == 3707", "tcp_stream": 97 }, { "frame_number": 3741, "timestamp_epoch": "1725472178.641921000", "display_filter": "frame.number == 3741", "tcp_stream": 98 }, { "frame_number": 4260, "timestamp_epoch": "1725473078.983435000", "display_filter": "frame.number == 4260", "tcp_stream": 118 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-73a1c2312a42902f31b6f490", "type": "ja3", "value": "1a0fcf72de58b80a8499dea99e961714", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1725471397.394047000", "last_seen_epoch": "1725471397.476052000", "evidence": [ { "frame_number": 2402, "timestamp_epoch": "1725471397.394047000", "display_filter": "frame.number == 2402", "tcp_stream": 57 }, { "frame_number": 2410, "timestamp_epoch": "1725471397.476052000", "display_filter": "frame.number == 2410", "tcp_stream": 57 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-776374f5991e03b8432e17d1", "type": "ja3", "value": "350c9b4a3f847974933dd25e9f9dc620", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1725471397.393741000", "last_seen_epoch": "1725471397.466055000", "evidence": [ { "frame_number": 2400, "timestamp_epoch": "1725471397.393741000", "display_filter": "frame.number == 2400", "tcp_stream": 58 }, { "frame_number": 2406, "timestamp_epoch": "1725471397.466055000", "display_filter": "frame.number == 2406", "tcp_stream": 58 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-5d86304a8d8687932b426f69", "type": "ja3", "value": "3c293bdf2a25c07559b560ba86debc77", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1725471276.135988000", "last_seen_epoch": "1725473809.566359000", "evidence": [ { "frame_number": 538, "timestamp_epoch": "1725471276.135988000", "display_filter": "frame.number == 538", "tcp_stream": 24 }, { "frame_number": 539, "timestamp_epoch": "1725471276.136172000", "display_filter": "frame.number == 539", "tcp_stream": 23 }, { "frame_number": 1056, "timestamp_epoch": "1725471280.054518000", "display_filter": "frame.number == 1056", "tcp_stream": 32 }, { "frame_number": 1158, "timestamp_epoch": "1725471280.373568000", "display_filter": "frame.number == 1158", "tcp_stream": 38 }, { "frame_number": 3357, "timestamp_epoch": "1725471878.598572000", "display_filter": "frame.number == 3357", "tcp_stream": 82 }, { "frame_number": 3394, "timestamp_epoch": "1725471938.677480000", "display_filter": "frame.number == 3394", "tcp_stream": 84 }, { "frame_number": 3397, "timestamp_epoch": "1725471938.764100000", "display_filter": "frame.number == 3397", "tcp_stream": 84 }, { "frame_number": 3508, "timestamp_epoch": "1725472090.745636000", "display_filter": "frame.number == 3508", "tcp_stream": 88 }, { "frame_number": 4039, "timestamp_epoch": "1725472805.290742000", "display_filter": "frame.number == 4039", "tcp_stream": 109 }, { "frame_number": 4042, "timestamp_epoch": "1725472805.387393000", "display_filter": "frame.number == 4042", "tcp_stream": 109 }, { "frame_number": 4082, "timestamp_epoch": "1725472852.228611000", "display_filter": "frame.number == 4082", "tcp_stream": 111 }, { "frame_number": 4086, "timestamp_epoch": "1725472852.296590000", "display_filter": "frame.number == 4086", "tcp_stream": 111 }, { "frame_number": 4700, "timestamp_epoch": "1725473809.566359000", "display_filter": "frame.number == 4700", "tcp_stream": 136 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7065c7ea3de590e4a466383a", "type": "ja3", "value": "3c4eb72b882d4d1442c67ce73f1292a9", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1725471304.852343000", "last_seen_epoch": "1725471309.448825000", "evidence": [ { "frame_number": 1279, "timestamp_epoch": "1725471304.852343000", "display_filter": "frame.number == 1279", "tcp_stream": 41 }, { "frame_number": 1704, "timestamp_epoch": "1725471309.448825000", "display_filter": "frame.number == 1704", "tcp_stream": 50 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c0c8a936221fd9315ac5c885", "type": "ja3", "value": "4c6de70d03b552090a8d77fcb0e10629", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1725471397.836563000", "last_seen_epoch": "1725471397.913797000", "evidence": [ { "frame_number": 2445, "timestamp_epoch": "1725471397.836563000", "display_filter": "frame.number == 2445", "tcp_stream": 59 }, { "frame_number": 2448, "timestamp_epoch": "1725471397.913797000", "display_filter": "frame.number == 2448", "tcp_stream": 59 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a6c207d6769cc16574ced07c", "type": "ja3", "value": "5291cc6eebf72ef2ca72d48a1dd0d72f", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1725471398.483914000", "last_seen_epoch": "1725471398.483914000", "evidence": [ { "frame_number": 2557, "timestamp_epoch": "1725471398.483914000", "display_filter": "frame.number == 2557" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3442a629518332ba6ac521c9", "type": "ja3", "value": "5919f6108f098e14c2f37619021ebd4d", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1725472298.572478000", "last_seen_epoch": "1725474605.276234000", "evidence": [ { "frame_number": 3841, "timestamp_epoch": "1725472298.572478000", "display_filter": "frame.number == 3841", "tcp_stream": 102 }, { "frame_number": 3922, "timestamp_epoch": "1725472478.585142000", "display_filter": "frame.number == 3922", "tcp_stream": 105 }, { "frame_number": 4157, "timestamp_epoch": "1725472924.632500000", "display_filter": "frame.number == 4157", "tcp_stream": 114 }, { "frame_number": 4161, "timestamp_epoch": "1725472924.707889000", "display_filter": "frame.number == 4161", "tcp_stream": 114 }, { "frame_number": 4374, "timestamp_epoch": "1725473224.920740000", "display_filter": "frame.number == 4374", "tcp_stream": 122 }, { "frame_number": 4378, "timestamp_epoch": "1725473224.999746000", "display_filter": "frame.number == 4378", "tcp_stream": 122 }, { "frame_number": 4510, "timestamp_epoch": "1725473525.389849000", "display_filter": "frame.number == 4510", "tcp_stream": 127 }, { "frame_number": 4514, "timestamp_epoch": "1725473525.468695000", "display_filter": "frame.number == 4514", "tcp_stream": 127 }, { "frame_number": 4724, "timestamp_epoch": "1725473825.888774000", "display_filter": "frame.number == 4724", "tcp_stream": 137 }, { "frame_number": 4728, "timestamp_epoch": "1725473825.973368000", "display_filter": "frame.number == 4728", "tcp_stream": 137 }, { "frame_number": 5003, "timestamp_epoch": "1725474605.172253000", "display_filter": "frame.number == 5003", "tcp_stream": 150 }, { "frame_number": 5006, "timestamp_epoch": "1725474605.276234000", "display_filter": "frame.number == 5006", "tcp_stream": 150 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-465bcde4b224a7797368a2d2", "type": "ja3", "value": "65005c9d9ae0f0ebeaf22c210571d482", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1725471275.925719000", "last_seen_epoch": "1725472296.563763000", "evidence": [ { "frame_number": 504, "timestamp_epoch": "1725471275.925719000", "display_filter": "frame.number == 504", "tcp_stream": 22 }, { "frame_number": 579, "timestamp_epoch": "1725471276.414787000", "display_filter": "frame.number == 579", "tcp_stream": 25 }, { "frame_number": 614, "timestamp_epoch": "1725471276.750506000", "display_filter": "frame.number == 614", "tcp_stream": 26 }, { "frame_number": 619, "timestamp_epoch": "1725471276.816165000", "display_filter": "frame.number == 619", "tcp_stream": 26 }, { "frame_number": 623, "timestamp_epoch": "1725471276.854367000", "display_filter": "frame.number == 623", "tcp_stream": 27 }, { "frame_number": 811, "timestamp_epoch": "1725471277.238241000", "display_filter": "frame.number == 811", "tcp_stream": 28 }, { "frame_number": 830, "timestamp_epoch": "1725471277.289574000", "display_filter": "frame.number == 830", "tcp_stream": 29 }, { "frame_number": 890, "timestamp_epoch": "1725471277.953848000", "display_filter": "frame.number == 890", "tcp_stream": 30 }, { "frame_number": 1147, "timestamp_epoch": "1725471280.228480000", "display_filter": "frame.number == 1147", "tcp_stream": 37 }, { "frame_number": 1153, "timestamp_epoch": "1725471280.314863000", "display_filter": "frame.number == 1153", "tcp_stream": 37 }, { "frame_number": 1203, "timestamp_epoch": "1725471280.627094000", "display_filter": "frame.number == 1203", "tcp_stream": 39 }, { "frame_number": 1249, "timestamp_epoch": "1725471296.753410000", "display_filter": "frame.number == 1249", "tcp_stream": 40 }, { "frame_number": 1253, "timestamp_epoch": "1725471296.788447000", "display_filter": "frame.number == 1253", "tcp_stream": 40 }, { "frame_number": 1533, "timestamp_epoch": "1725471306.398391000", "display_filter": "frame.number == 1533", "tcp_stream": 46 }, { "frame_number": 1549, "timestamp_epoch": "1725471306.485925000", "display_filter": "frame.number == 1549", "tcp_stream": 46 }, { "frame_number": 1635, "timestamp_epoch": "1725471306.787464000", "display_filter": "frame.number == 1635", "tcp_stream": 47 }, { "frame_number": 3042, "timestamp_epoch": "1725471471.590000000", "display_filter": "frame.number == 3042", "tcp_stream": 67 }, { "frame_number": 3208, "timestamp_epoch": "1725471761.569885000", "display_filter": "frame.number == 3208", "tcp_stream": 74 }, { "frame_number": 3625, "timestamp_epoch": "1725472175.979960000", "display_filter": "frame.number == 3625", "tcp_stream": 94 }, { "frame_number": 3628, "timestamp_epoch": "1725472176.070698000", "display_filter": "frame.number == 3628", "tcp_stream": 94 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4940dfa985f94b3bfdd4833e", "type": "ja3", "value": "6a5d235ee78c6aede6a61448b4e9ff1e", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1725471223.016189000", "last_seen_epoch": "1725471223.016189000", "evidence": [ { "frame_number": 188, "timestamp_epoch": "1725471223.016189000", "display_filter": "frame.number == 188", "tcp_stream": 6 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-3f483d8b0dd5f7817f968fb2", "type": "ja3", "value": "81e0f23545c783a55096f99f7c4755d7", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1725471398.456051000", "last_seen_epoch": "1725471398.530743000", "evidence": [ { "frame_number": 2549, "timestamp_epoch": "1725471398.456051000", "display_filter": "frame.number == 2549", "tcp_stream": 61 }, { "frame_number": 2576, "timestamp_epoch": "1725471398.530743000", "display_filter": "frame.number == 2576", "tcp_stream": 61 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7aa1f9924801da44272c582d", "type": "ja3", "value": "a25c14084d58bfea7bb5de112124edb3", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1725471398.231353000", "last_seen_epoch": "1725471398.231353000", "evidence": [ { "frame_number": 2494, "timestamp_epoch": "1725471398.231353000", "display_filter": "frame.number == 2494" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4b89cfab4610c76703e57ab1", "type": "ja3", "value": "a35e0e26a8a46900d0f8297769d1112c", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1725471398.255794000", "last_seen_epoch": "1725471398.316055000", "evidence": [ { "frame_number": 2499, "timestamp_epoch": "1725471398.255794000", "display_filter": "frame.number == 2499", "tcp_stream": 60 }, { "frame_number": 2521, "timestamp_epoch": "1725471398.316055000", "display_filter": "frame.number == 2521", "tcp_stream": 60 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-a6d6d03ff773812717665f79", "type": "ja3", "value": "cad306d4b414c5fcf993c03e0d596109", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1725471398.650380000", "last_seen_epoch": "1725471398.650380000", "evidence": [ { "frame_number": 2656, "timestamp_epoch": "1725471398.650380000", "display_filter": "frame.number == 2656", "tcp_stream": 62 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-c4deb8fc130c3d098a6f5009", "type": "ja3", "value": "f06a64ec6ecba24167cfe2612badcd91", "roles": [ "tls-client-fingerprint" ], "is_private": null, "first_seen_epoch": "1725471398.560998000", "last_seen_epoch": "1725471398.560998000", "evidence": [ { "frame_number": 2594, "timestamp_epoch": "1725471398.560998000", "display_filter": "frame.number == 2594" } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-ff81e2b69f62d558ca25dcf9", "type": "sha256", "value": "3f39d5c348e5b79d06e842c114e6cc571583bbf44e4b0ebfda1a01ec05745d43", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-5a8db03d7490cf307ab16d3a", "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-71f8b19895d3f59eb13d3aff", "type": "sha256", "value": "69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-f6acd4c493dee97ab17e841b", "type": "sha256", "value": "736f0cb5cc23435dad920dbe447efcf102e61c8691fa8528f5f39f386537f43e", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-9f14debed35fff4f84bc656a", "type": "sha256", "value": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-ce506bcef731bebd341d1d76", "type": "sha256", "value": "ed0855c1637e5f93be7d54acb2cb8872683a0e5eb670258abb1ebc41bfbf4591", "roles": [ "exported-object" ], "is_private": null, "first_seen_epoch": "", "last_seen_epoch": "", "evidence": [], "enrichment_state": "not_requested" }, { "observable_id": "observable-4d536b9d965ac3ac89ada924", "type": "url", "value": "http://79.124.78.197/foots.php", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1725471307.211814000", "last_seen_epoch": "1725474713.072428000", "evidence": [ { "frame_number": 1668, "timestamp_epoch": "1725471307.211814000", "display_filter": "frame.number == 1668", "tcp_stream": 48 }, { "frame_number": 1672, "timestamp_epoch": "1725471307.858400000", "display_filter": "frame.number == 1672", "tcp_stream": 48 }, { "frame_number": 1697, "timestamp_epoch": "1725471308.684142000", "display_filter": "frame.number == 1697", "tcp_stream": 48 }, { "frame_number": 2347, "timestamp_epoch": "1725471377.781476000", "display_filter": "frame.number == 2347", "tcp_stream": 56 }, { "frame_number": 2985, "timestamp_epoch": "1725471446.911862000", "display_filter": "frame.number == 2985", "tcp_stream": 63 }, { "frame_number": 3077, "timestamp_epoch": "1725471516.062291000", "display_filter": "frame.number == 3077", "tcp_stream": 68 }, { "frame_number": 3129, "timestamp_epoch": "1725471585.206401000", "display_filter": "frame.number == 3129", "tcp_stream": 71 }, { "frame_number": 3181, "timestamp_epoch": "1725471654.324762000", "display_filter": "frame.number == 3181", "tcp_stream": 73 }, { "frame_number": 3191, "timestamp_epoch": "1725471714.999064000", "display_filter": "frame.number == 3191", "tcp_stream": 73 }, { "frame_number": 3232, "timestamp_epoch": "1725471775.696228000", "display_filter": "frame.number == 3232", "tcp_stream": 73 }, { "frame_number": 3251, "timestamp_epoch": "1725471836.836309000", "display_filter": "frame.number == 3251", "tcp_stream": 75 }, { "frame_number": 3385, "timestamp_epoch": "1725471897.919897000", "display_filter": "frame.number == 3385", "tcp_stream": 83 }, { "frame_number": 3429, "timestamp_epoch": "1725471958.615189000", "display_filter": "frame.number == 3429", "tcp_stream": 83 }, { "frame_number": 3464, "timestamp_epoch": "1725472019.697304000", "display_filter": "frame.number == 3464", "tcp_stream": 86 }, { "frame_number": 3531, "timestamp_epoch": "1725472104.750554000", "display_filter": "frame.number == 3531", "tcp_stream": 89 }, { "frame_number": 3772, "timestamp_epoch": "1725472189.873627000", "display_filter": "frame.number == 3772", "tcp_stream": 99 }, { "frame_number": 3799, "timestamp_epoch": "1725472275.032276000", "display_filter": "frame.number == 3799", "tcp_stream": 100 }, { "frame_number": 3873, "timestamp_epoch": "1725472360.171010000", "display_filter": "frame.number == 3873", "tcp_stream": 103 }, { "frame_number": 3908, "timestamp_epoch": "1725472450.320388000", "display_filter": "frame.number == 3908", "tcp_stream": 104 }, { "frame_number": 3962, "timestamp_epoch": "1725472540.401561000", "display_filter": "frame.number == 3962", "tcp_stream": 106 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-adcae288b8bc60eb1d218453", "type": "url", "value": "http://79.124.78.197/index.php", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1725471312.546458000", "last_seen_epoch": "1725471312.546458000", "evidence": [ { "frame_number": 2236, "timestamp_epoch": "1725471312.546458000", "display_filter": "frame.number == 2236", "tcp_stream": 51 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-d4724a1b5c0dff9f878973a9", "type": "url", "value": "http://79.124.78.197/index.php?id=&subid=qIOuKk7U", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1725471311.316859000", "last_seen_epoch": "1725471311.316859000", "evidence": [ { "frame_number": 2227, "timestamp_epoch": "1725471311.316859000", "display_filter": "frame.number == 2227", "tcp_stream": 51 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-445370c25ce268c696ccfd1f", "type": "url", "value": "http://acroipm2.adobe.com/assets/Owner/arm/ProcessMAU.txt", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1725471995.543188000", "last_seen_epoch": "1725471995.543188000", "evidence": [ { "frame_number": 3440, "timestamp_epoch": "1725471995.543188000", "display_filter": "frame.number == 3440", "tcp_stream": 85 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-e54af60241c90764ac2ebe6d", "type": "url", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?d7a8a57aa5acd39b", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1725472865.606024000", "last_seen_epoch": "1725472865.606024000", "evidence": [ { "frame_number": 4120, "timestamp_epoch": "1725472865.606024000", "display_filter": "frame.number == 4120", "tcp_stream": 112 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-812a7ce7b09da89d1073333d", "type": "url", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?91717f420e6dda94", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1725472865.665480000", "last_seen_epoch": "1725472865.665480000", "evidence": [ { "frame_number": 4123, "timestamp_epoch": "1725472865.665480000", "display_filter": "frame.number == 4123", "tcp_stream": 112 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4f0385e12b0566355c1f989d", "type": "url", "value": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?a5fef2ac8502b132", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1725473139.654458000", "last_seen_epoch": "1725473139.654458000", "evidence": [ { "frame_number": 4317, "timestamp_epoch": "1725473139.654458000", "display_filter": "frame.number == 4317", "tcp_stream": 120 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-7f5788a3eff53eaed6f011f2", "type": "url", "value": "http://www.msftconnecttest.com/connecttest.txt", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1725471151.936110000", "last_seen_epoch": "1725471153.035136000", "evidence": [ { "frame_number": 52, "timestamp_epoch": "1725471151.936110000", "display_filter": "frame.number == 52", "tcp_stream": 1 }, { "frame_number": 72, "timestamp_epoch": "1725471153.035136000", "display_filter": "frame.number == 72", "tcp_stream": 2 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-2d4fa9f6c421414af2d03c3b", "type": "url", "value": "http://x1.c.lencr.org/", "roles": [ "http-request" ], "is_private": null, "first_seen_epoch": "1725473139.549530000", "last_seen_epoch": "1725473139.549530000", "evidence": [ { "frame_number": 4308, "timestamp_epoch": "1725473139.549530000", "display_filter": "frame.number == 4308", "tcp_stream": 119 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4c6131d2e47f83319880db69", "type": "user_agent", "value": "Microsoft NCSI", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1725471151.936110000", "last_seen_epoch": "1725471153.035136000", "evidence": [ { "frame_number": 52, "timestamp_epoch": "1725471151.936110000", "display_filter": "frame.number == 52", "tcp_stream": 1 }, { "frame_number": 72, "timestamp_epoch": "1725471153.035136000", "display_filter": "frame.number == 72", "tcp_stream": 2 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-62b7ab39c38e7a69796f4bae", "type": "user_agent", "value": "Microsoft-CryptoAPI/10.0", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1725472865.606024000", "last_seen_epoch": "1725473139.654458000", "evidence": [ { "frame_number": 4120, "timestamp_epoch": "1725472865.606024000", "display_filter": "frame.number == 4120", "tcp_stream": 112 }, { "frame_number": 4123, "timestamp_epoch": "1725472865.665480000", "display_filter": "frame.number == 4123", "tcp_stream": 112 }, { "frame_number": 4308, "timestamp_epoch": "1725473139.549530000", "display_filter": "frame.number == 4308", "tcp_stream": 119 }, { "frame_number": 4317, "timestamp_epoch": "1725473139.654458000", "display_filter": "frame.number == 4317", "tcp_stream": 120 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-4d6ec745e9a6e0056190c7f0", "type": "user_agent", "value": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1725471307.211814000", "last_seen_epoch": "1725474713.072428000", "evidence": [ { "frame_number": 1668, "timestamp_epoch": "1725471307.211814000", "display_filter": "frame.number == 1668", "tcp_stream": 48 }, { "frame_number": 1672, "timestamp_epoch": "1725471307.858400000", "display_filter": "frame.number == 1672", "tcp_stream": 48 }, { "frame_number": 1697, "timestamp_epoch": "1725471308.684142000", "display_filter": "frame.number == 1697", "tcp_stream": 48 }, { "frame_number": 2347, "timestamp_epoch": "1725471377.781476000", "display_filter": "frame.number == 2347", "tcp_stream": 56 }, { "frame_number": 2985, "timestamp_epoch": "1725471446.911862000", "display_filter": "frame.number == 2985", "tcp_stream": 63 }, { "frame_number": 3077, "timestamp_epoch": "1725471516.062291000", "display_filter": "frame.number == 3077", "tcp_stream": 68 }, { "frame_number": 3129, "timestamp_epoch": "1725471585.206401000", "display_filter": "frame.number == 3129", "tcp_stream": 71 }, { "frame_number": 3181, "timestamp_epoch": "1725471654.324762000", "display_filter": "frame.number == 3181", "tcp_stream": 73 }, { "frame_number": 3191, "timestamp_epoch": "1725471714.999064000", "display_filter": "frame.number == 3191", "tcp_stream": 73 }, { "frame_number": 3232, "timestamp_epoch": "1725471775.696228000", "display_filter": "frame.number == 3232", "tcp_stream": 73 }, { "frame_number": 3251, "timestamp_epoch": "1725471836.836309000", "display_filter": "frame.number == 3251", "tcp_stream": 75 }, { "frame_number": 3385, "timestamp_epoch": "1725471897.919897000", "display_filter": "frame.number == 3385", "tcp_stream": 83 }, { "frame_number": 3429, "timestamp_epoch": "1725471958.615189000", "display_filter": "frame.number == 3429", "tcp_stream": 83 }, { "frame_number": 3464, "timestamp_epoch": "1725472019.697304000", "display_filter": "frame.number == 3464", "tcp_stream": 86 }, { "frame_number": 3531, "timestamp_epoch": "1725472104.750554000", "display_filter": "frame.number == 3531", "tcp_stream": 89 }, { "frame_number": 3772, "timestamp_epoch": "1725472189.873627000", "display_filter": "frame.number == 3772", "tcp_stream": 99 }, { "frame_number": 3799, "timestamp_epoch": "1725472275.032276000", "display_filter": "frame.number == 3799", "tcp_stream": 100 }, { "frame_number": 3873, "timestamp_epoch": "1725472360.171010000", "display_filter": "frame.number == 3873", "tcp_stream": 103 }, { "frame_number": 3908, "timestamp_epoch": "1725472450.320388000", "display_filter": "frame.number == 3908", "tcp_stream": 104 }, { "frame_number": 3962, "timestamp_epoch": "1725472540.401561000", "display_filter": "frame.number == 3962", "tcp_stream": 106 } ], "enrichment_state": "not_requested" }, { "observable_id": "observable-94a8905bfa52b1856dfd5f01", "type": "user_agent", "value": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)", "roles": [ "http-client" ], "is_private": null, "first_seen_epoch": "1725471995.543188000", "last_seen_epoch": "1725471995.543188000", "evidence": [ { "frame_number": 3440, "timestamp_epoch": "1725471995.543188000", "display_filter": "frame.number == 3440", "tcp_stream": 85 } ], "enrichment_state": "not_requested" } ], "findings": [ { "finding_id": "finding-1462733523147699ecaa2de6", "rule_id": "repeated-http-posts", "rule_version": "pcap-rules-v3", "severity": "medium", "title": "Repeated outbound HTTP POST activity", "explanation": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review.", "confidence": 0.72, "status": "candidate", "evidence": [ { "frame_number": 1668, "timestamp_epoch": "1725471307.211814000", "display_filter": "frame.number == 1668", "tcp_stream": 48 }, { "frame_number": 1672, "timestamp_epoch": "1725471307.858400000", "display_filter": "frame.number == 1672", "tcp_stream": 48 }, { "frame_number": 1697, "timestamp_epoch": "1725471308.684142000", "display_filter": "frame.number == 1697", "tcp_stream": 48 }, { "frame_number": 2347, "timestamp_epoch": "1725471377.781476000", "display_filter": "frame.number == 2347", "tcp_stream": 56 }, { "frame_number": 2985, "timestamp_epoch": "1725471446.911862000", "display_filter": "frame.number == 2985", "tcp_stream": 63 }, { "frame_number": 3077, "timestamp_epoch": "1725471516.062291000", "display_filter": "frame.number == 3077", "tcp_stream": 68 }, { "frame_number": 3129, "timestamp_epoch": "1725471585.206401000", "display_filter": "frame.number == 3129", "tcp_stream": 71 }, { "frame_number": 3181, "timestamp_epoch": "1725471654.324762000", "display_filter": "frame.number == 3181", "tcp_stream": 73 }, { "frame_number": 3191, "timestamp_epoch": "1725471714.999064000", "display_filter": "frame.number == 3191", "tcp_stream": 73 }, { "frame_number": 3232, "timestamp_epoch": "1725471775.696228000", "display_filter": "frame.number == 3232", "tcp_stream": 73 }, { "frame_number": 3251, "timestamp_epoch": "1725471836.836309000", "display_filter": "frame.number == 3251", "tcp_stream": 75 }, { "frame_number": 3385, "timestamp_epoch": "1725471897.919897000", "display_filter": "frame.number == 3385", "tcp_stream": 83 }, { "frame_number": 3429, "timestamp_epoch": "1725471958.615189000", "display_filter": "frame.number == 3429", "tcp_stream": 83 }, { "frame_number": 3464, "timestamp_epoch": "1725472019.697304000", "display_filter": "frame.number == 3464", "tcp_stream": 86 }, { "frame_number": 3531, "timestamp_epoch": "1725472104.750554000", "display_filter": "frame.number == 3531", "tcp_stream": 89 }, { "frame_number": 3772, "timestamp_epoch": "1725472189.873627000", "display_filter": "frame.number == 3772", "tcp_stream": 99 }, { "frame_number": 3799, "timestamp_epoch": "1725472275.032276000", "display_filter": "frame.number == 3799", "tcp_stream": 100 }, { "frame_number": 3873, "timestamp_epoch": "1725472360.171010000", "display_filter": "frame.number == 3873", "tcp_stream": 103 }, { "frame_number": 3908, "timestamp_epoch": "1725472450.320388000", "display_filter": "frame.number == 3908", "tcp_stream": 104 }, { "frame_number": 3962, "timestamp_epoch": "1725472540.401561000", "display_filter": "frame.number == 3962", "tcp_stream": 106 }, { "frame_number": 3984, "timestamp_epoch": "1725472630.504776000", "display_filter": "frame.number == 3984", "tcp_stream": 107 }, { "frame_number": 4011, "timestamp_epoch": "1725472720.632883000", "display_filter": "frame.number == 4011", "tcp_stream": 108 }, { "frame_number": 4064, "timestamp_epoch": "1725472806.765839000", "display_filter": "frame.number == 4064", "tcp_stream": 110 }, { "frame_number": 4135, "timestamp_epoch": "1725472892.834551000", "display_filter": "frame.number == 4135", "tcp_stream": 113 }, { "frame_number": 4214, "timestamp_epoch": "1725472978.902877000", "display_filter": "frame.number == 4214", "tcp_stream": 116 }, { "frame_number": 4247, "timestamp_epoch": "1725473065.026600000", "display_filter": "frame.number == 4247", "tcp_stream": 117 }, { "frame_number": 4330, "timestamp_epoch": "1725473153.133865000", "display_filter": "frame.number == 4330", "tcp_stream": 121 }, { "frame_number": 4402, "timestamp_epoch": "1725473242.405323000", "display_filter": "frame.number == 4402", "tcp_stream": 123 }, { "frame_number": 4440, "timestamp_epoch": "1725473330.470020000", "display_filter": "frame.number == 4440", "tcp_stream": 124 }, { "frame_number": 4477, "timestamp_epoch": "1725473418.609257000", "display_filter": "frame.number == 4477", "tcp_stream": 125 }, { "frame_number": 4499, "timestamp_epoch": "1725473496.778262000", "display_filter": "frame.number == 4499", "tcp_stream": 126 }, { "frame_number": 4545, "timestamp_epoch": "1725473574.825234000", "display_filter": "frame.number == 4545", "tcp_stream": 128 }, { "frame_number": 4653, "timestamp_epoch": "1725473653.888797000", "display_filter": "frame.number == 4653", "tcp_stream": 133 }, { "frame_number": 4671, "timestamp_epoch": "1725473731.986370000", "display_filter": "frame.number == 4671", "tcp_stream": 134 }, { "frame_number": 4691, "timestamp_epoch": "1725473807.300640000", "display_filter": "frame.number == 4691", "tcp_stream": 135 }, { "frame_number": 4786, "timestamp_epoch": "1725473881.418761000", "display_filter": "frame.number == 4786", "tcp_stream": 139 }, { "frame_number": 4811, "timestamp_epoch": "1725473955.568280000", "display_filter": "frame.number == 4811", "tcp_stream": 140 }, { "frame_number": 4832, "timestamp_epoch": "1725474029.695712000", "display_filter": "frame.number == 4832", "tcp_stream": 141 }, { "frame_number": 4854, "timestamp_epoch": "1725474103.799656000", "display_filter": "frame.number == 4854", "tcp_stream": 142 }, { "frame_number": 4876, "timestamp_epoch": "1725474175.903686000", "display_filter": "frame.number == 4876", "tcp_stream": 143 }, { "frame_number": 4904, "timestamp_epoch": "1725474248.045044000", "display_filter": "frame.number == 4904", "tcp_stream": 144 }, { "frame_number": 4921, "timestamp_epoch": "1725474320.202713000", "display_filter": "frame.number == 4921", "tcp_stream": 145 }, { "frame_number": 4943, "timestamp_epoch": "1725474392.348254000", "display_filter": "frame.number == 4943", "tcp_stream": 146 }, { "frame_number": 4959, "timestamp_epoch": "1725474464.546934000", "display_filter": "frame.number == 4959", "tcp_stream": 147 }, { "frame_number": 4974, "timestamp_epoch": "1725474526.700596000", "display_filter": "frame.number == 4974", "tcp_stream": 148 }, { "frame_number": 4987, "timestamp_epoch": "1725474588.843962000", "display_filter": "frame.number == 4987", "tcp_stream": 149 }, { "frame_number": 5032, "timestamp_epoch": "1725474650.997683000", "display_filter": "frame.number == 5032", "tcp_stream": 151 }, { "frame_number": 5077, "timestamp_epoch": "1725474713.072428000", "display_filter": "frame.number == 5077", "tcp_stream": 154 } ], "metrics": { "request_count": 48, "declared_body_bytes": 2046, "source": "172.17.0.99", "destination": "79.124.78.197", "port": 80, "host": "79.124.78.197", "uri": "/foots.php" } }, { "finding_id": "finding-99970ae01bf2fac5f4f43b24", "rule_id": "repeated-nxdomain", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Repeated unsuccessful DNS resolution", "explanation": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.", "confidence": 0.5, "status": "candidate", "evidence": [ { "frame_number": 41, "timestamp_epoch": "1725471151.819563000", "display_filter": "frame.number == 41", "udp_stream": 10 }, { "frame_number": 42, "timestamp_epoch": "1725471151.819563000", "display_filter": "frame.number == 42", "udp_stream": 11 }, { "frame_number": 111, "timestamp_epoch": "1725471169.837437000", "display_filter": "frame.number == 111", "udp_stream": 12 }, { "frame_number": 112, "timestamp_epoch": "1725471169.837588000", "display_filter": "frame.number == 112", "udp_stream": 16 }, { "frame_number": 215, "timestamp_epoch": "1725471229.852947000", "display_filter": "frame.number == 215", "udp_stream": 16 }, { "frame_number": 216, "timestamp_epoch": "1725471229.853010000", "display_filter": "frame.number == 216", "udp_stream": 12 }, { "frame_number": 2384, "timestamp_epoch": "1725471397.237001000", "display_filter": "frame.number == 2384", "udp_stream": 22 }, { "frame_number": 2967, "timestamp_epoch": "1725471405.244456000", "display_filter": "frame.number == 2967", "udp_stream": 22 }, { "frame_number": 3238, "timestamp_epoch": "1725471829.837499000", "display_filter": "frame.number == 3238", "udp_stream": 12 }, { "frame_number": 3239, "timestamp_epoch": "1725471829.838019000", "display_filter": "frame.number == 3239", "udp_stream": 43 }, { "frame_number": 3446, "timestamp_epoch": "1725471996.162993000", "display_filter": "frame.number == 3446", "udp_stream": 49 }, { "frame_number": 3454, "timestamp_epoch": "1725472004.172794000", "display_filter": "frame.number == 3454", "udp_stream": 49 }, { "frame_number": 3887, "timestamp_epoch": "1725472429.829740000", "display_filter": "frame.number == 3887", "udp_stream": 12 }, { "frame_number": 3888, "timestamp_epoch": "1725472429.829740000", "display_filter": "frame.number == 3888", "udp_stream": 55 }, { "frame_number": 4228, "timestamp_epoch": "1725473029.805065000", "display_filter": "frame.number == 4228", "udp_stream": 58 }, { "frame_number": 4229, "timestamp_epoch": "1725473029.805065000", "display_filter": "frame.number == 4229", "udp_stream": 12 }, { "frame_number": 4633, "timestamp_epoch": "1725473629.795240000", "display_filter": "frame.number == 4633", "udp_stream": 64 }, { "frame_number": 4634, "timestamp_epoch": "1725473629.795240000", "display_filter": "frame.number == 4634", "udp_stream": 60 }, { "frame_number": 4882, "timestamp_epoch": "1725474229.786354000", "display_filter": "frame.number == 4882", "udp_stream": 64 }, { "frame_number": 4883, "timestamp_epoch": "1725474229.786887000", "display_filter": "frame.number == 4883", "udp_stream": 65 } ], "metrics": { "source": "172.17.0.99", "domain": "wpad.bepositive.com", "response_count": 20 } }, { "finding_id": "finding-8c6df9f2decff1732e943737", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 384, "timestamp_epoch": "1725471275.487796000", "display_filter": "frame.number == 384", "tcp_stream": 14 }, { "frame_number": 386, "timestamp_epoch": "1725471275.488723000", "display_filter": "frame.number == 386", "tcp_stream": 14 }, { "frame_number": 388, "timestamp_epoch": "1725471275.489598000", "display_filter": "frame.number == 388", "tcp_stream": 14 }, { "frame_number": 391, "timestamp_epoch": "1725471275.489946000", "display_filter": "frame.number == 391", "tcp_stream": 14 }, { "frame_number": 1074, "timestamp_epoch": "1725471280.065417000", "display_filter": "frame.number == 1074", "tcp_stream": 34 }, { "frame_number": 1076, "timestamp_epoch": "1725471280.066267000", "display_filter": "frame.number == 1076", "tcp_stream": 34 }, { "frame_number": 1078, "timestamp_epoch": "1725471280.066598000", "display_filter": "frame.number == 1078", "tcp_stream": 34 }, { "frame_number": 1082, "timestamp_epoch": "1725471280.068331000", "display_filter": "frame.number == 1082", "tcp_stream": 34 }, { "frame_number": 1084, "timestamp_epoch": "1725471280.069061000", "display_filter": "frame.number == 1084", "tcp_stream": 34 }, { "frame_number": 1086, "timestamp_epoch": "1725471280.069418000", "display_filter": "frame.number == 1086", "tcp_stream": 34 }, { "frame_number": 1441, "timestamp_epoch": "1725471306.291308000", "display_filter": "frame.number == 1441", "tcp_stream": 43 }, { "frame_number": 1443, "timestamp_epoch": "1725471306.292294000", "display_filter": "frame.number == 1443", "tcp_stream": 43 }, { "frame_number": 1445, "timestamp_epoch": "1725471306.292766000", "display_filter": "frame.number == 1445", "tcp_stream": 43 }, { "frame_number": 1449, "timestamp_epoch": "1725471306.294708000", "display_filter": "frame.number == 1449", "tcp_stream": 43 }, { "frame_number": 1451, "timestamp_epoch": "1725471306.295594000", "display_filter": "frame.number == 1451", "tcp_stream": 43 }, { "frame_number": 1453, "timestamp_epoch": "1725471306.296049000", "display_filter": "frame.number == 1453", "tcp_stream": 43 }, { "frame_number": 2271, "timestamp_epoch": "1725471336.281244000", "display_filter": "frame.number == 2271", "tcp_stream": 53 }, { "frame_number": 2273, "timestamp_epoch": "1725471336.282937000", "display_filter": "frame.number == 2273", "tcp_stream": 53 }, { "frame_number": 2275, "timestamp_epoch": "1725471336.283854000", "display_filter": "frame.number == 2275", "tcp_stream": 53 }, { "frame_number": 2279, "timestamp_epoch": "1725471336.287735000", "display_filter": "frame.number == 2279", "tcp_stream": 53 }, { "frame_number": 2281, "timestamp_epoch": "1725471336.289099000", "display_filter": "frame.number == 2281", "tcp_stream": 53 }, { "frame_number": 2283, "timestamp_epoch": "1725471336.289993000", "display_filter": "frame.number == 2283", "tcp_stream": 53 }, { "frame_number": 3566, "timestamp_epoch": "1725472175.785750000", "display_filter": "frame.number == 3566", "tcp_stream": 91 }, { "frame_number": 3568, "timestamp_epoch": "1725472175.786748000", "display_filter": "frame.number == 3568", "tcp_stream": 91 }, { "frame_number": 3570, "timestamp_epoch": "1725472175.787147000", "display_filter": "frame.number == 3570", "tcp_stream": 91 }, { "frame_number": 3574, "timestamp_epoch": "1725472175.789311000", "display_filter": "frame.number == 3574", "tcp_stream": 91 }, { "frame_number": 3576, "timestamp_epoch": "1725472175.790105000", "display_filter": "frame.number == 3576", "tcp_stream": 91 }, { "frame_number": 3578, "timestamp_epoch": "1725472175.790477000", "display_filter": "frame.number == 3578", "tcp_stream": 91 }, { "frame_number": 4570, "timestamp_epoch": "1725473582.138420000", "display_filter": "frame.number == 4570", "tcp_stream": 130 }, { "frame_number": 4572, "timestamp_epoch": "1725473582.139507000", "display_filter": "frame.number == 4572", "tcp_stream": 130 }, { "frame_number": 4574, "timestamp_epoch": "1725473582.140024000", "display_filter": "frame.number == 4574", "tcp_stream": 130 }, { "frame_number": 4578, "timestamp_epoch": "1725473582.141715000", "display_filter": "frame.number == 4578", "tcp_stream": 130 }, { "frame_number": 4580, "timestamp_epoch": "1725473582.142667000", "display_filter": "frame.number == 4580", "tcp_stream": 130 }, { "frame_number": 4582, "timestamp_epoch": "1725473582.143161000", "display_filter": "frame.number == 4582", "tcp_stream": 130 }, { "frame_number": 5059, "timestamp_epoch": "1725474712.485285000", "display_filter": "frame.number == 5059", "tcp_stream": 153 }, { "frame_number": 5061, "timestamp_epoch": "1725474712.486185000", "display_filter": "frame.number == 5061", "tcp_stream": 153 }, { "frame_number": 5063, "timestamp_epoch": "1725474712.487014000", "display_filter": "frame.number == 5063", "tcp_stream": 153 }, { "frame_number": 5065, "timestamp_epoch": "1725474712.487821000", "display_filter": "frame.number == 5065", "tcp_stream": 153 }, { "frame_number": 5067, "timestamp_epoch": "1725474712.488205000", "display_filter": "frame.number == 5067", "tcp_stream": 153 } ], "metrics": { "source": "172.17.0.17", "destination": "172.17.0.99", "protocol": "drsuapi", "event_count": 39, "operation_numbers": [ "0", "1", "12" ] } }, { "finding_id": "finding-7554a50e1a4a9ef2df003606", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 33, "timestamp_epoch": "1725471151.433776000", "display_filter": "frame.number == 33", "tcp_stream": 0 }, { "frame_number": 419, "timestamp_epoch": "1725471275.494529000", "display_filter": "frame.number == 419", "tcp_stream": 18 }, { "frame_number": 431, "timestamp_epoch": "1725471275.498918000", "display_filter": "frame.number == 431", "tcp_stream": 18 }, { "frame_number": 452, "timestamp_epoch": "1725471275.502867000", "display_filter": "frame.number == 452", "tcp_stream": 19 }, { "frame_number": 455, "timestamp_epoch": "1725471275.503379000", "display_filter": "frame.number == 455", "tcp_stream": 19 }, { "frame_number": 457, "timestamp_epoch": "1725471275.503918000", "display_filter": "frame.number == 457", "tcp_stream": 19 }, { "frame_number": 459, "timestamp_epoch": "1725471275.504814000", "display_filter": "frame.number == 459", "tcp_stream": 18 }, { "frame_number": 1092, "timestamp_epoch": "1725471280.071847000", "display_filter": "frame.number == 1092", "tcp_stream": 35 }, { "frame_number": 1097, "timestamp_epoch": "1725471280.074307000", "display_filter": "frame.number == 1097", "tcp_stream": 35 }, { "frame_number": 1099, "timestamp_epoch": "1725471280.074994000", "display_filter": "frame.number == 1099", "tcp_stream": 35 }, { "frame_number": 1101, "timestamp_epoch": "1725471280.075489000", "display_filter": "frame.number == 1101", "tcp_stream": 35 }, { "frame_number": 1103, "timestamp_epoch": "1725471280.075982000", "display_filter": "frame.number == 1103", "tcp_stream": 35 }, { "frame_number": 1110, "timestamp_epoch": "1725471280.079136000", "display_filter": "frame.number == 1110", "tcp_stream": 36 }, { "frame_number": 1114, "timestamp_epoch": "1725471280.079994000", "display_filter": "frame.number == 1114", "tcp_stream": 36 }, { "frame_number": 1117, "timestamp_epoch": "1725471280.080390000", "display_filter": "frame.number == 1117", "tcp_stream": 36 }, { "frame_number": 1459, "timestamp_epoch": "1725471306.298697000", "display_filter": "frame.number == 1459", "tcp_stream": 44 }, { "frame_number": 1465, "timestamp_epoch": "1725471306.301060000", "display_filter": "frame.number == 1465", "tcp_stream": 44 }, { "frame_number": 1467, "timestamp_epoch": "1725471306.301925000", "display_filter": "frame.number == 1467", "tcp_stream": 44 }, { "frame_number": 1469, "timestamp_epoch": "1725471306.302581000", "display_filter": "frame.number == 1469", "tcp_stream": 44 }, { "frame_number": 1471, "timestamp_epoch": "1725471306.303249000", "display_filter": "frame.number == 1471", "tcp_stream": 44 }, { "frame_number": 1478, "timestamp_epoch": "1725471306.307290000", "display_filter": "frame.number == 1478", "tcp_stream": 45 }, { "frame_number": 1482, "timestamp_epoch": "1725471306.308524000", "display_filter": "frame.number == 1482", "tcp_stream": 45 }, { "frame_number": 1485, "timestamp_epoch": "1725471306.309206000", "display_filter": "frame.number == 1485", "tcp_stream": 45 }, { "frame_number": 2289, "timestamp_epoch": "1725471336.296276000", "display_filter": "frame.number == 2289", "tcp_stream": 54 }, { "frame_number": 2294, "timestamp_epoch": "1725471336.299715000", "display_filter": "frame.number == 2294", "tcp_stream": 54 }, { "frame_number": 2296, "timestamp_epoch": "1725471336.301053000", "display_filter": "frame.number == 2296", "tcp_stream": 54 }, { "frame_number": 2298, "timestamp_epoch": "1725471336.302215000", "display_filter": "frame.number == 2298", "tcp_stream": 54 }, { "frame_number": 2300, "timestamp_epoch": "1725471336.303221000", "display_filter": "frame.number == 2300", "tcp_stream": 54 }, { "frame_number": 2307, "timestamp_epoch": "1725471336.309847000", "display_filter": "frame.number == 2307", "tcp_stream": 55 }, { "frame_number": 2311, "timestamp_epoch": "1725471336.311125000", "display_filter": "frame.number == 2311", "tcp_stream": 55 }, { "frame_number": 2314, "timestamp_epoch": "1725471336.311805000", "display_filter": "frame.number == 2314", "tcp_stream": 55 }, { "frame_number": 3000, "timestamp_epoch": "1725471470.868117000", "display_filter": "frame.number == 3000", "tcp_stream": 64 }, { "frame_number": 3017, "timestamp_epoch": "1725471470.874745000", "display_filter": "frame.number == 3017", "tcp_stream": 64 }, { "frame_number": 3019, "timestamp_epoch": "1725471470.876521000", "display_filter": "frame.number == 3019", "tcp_stream": 64 }, { "frame_number": 3030, "timestamp_epoch": "1725471470.886990000", "display_filter": "frame.number == 3030", "tcp_stream": 66 }, { "frame_number": 3032, "timestamp_epoch": "1725471470.887754000", "display_filter": "frame.number == 3032", "tcp_stream": 66 }, { "frame_number": 3098, "timestamp_epoch": "1725471576.756020000", "display_filter": "frame.number == 3098", "tcp_stream": 69 }, { "frame_number": 3103, "timestamp_epoch": "1725471576.759128000", "display_filter": "frame.number == 3103", "tcp_stream": 69 }, { "frame_number": 3105, "timestamp_epoch": "1725471576.760813000", "display_filter": "frame.number == 3105", "tcp_stream": 69 }, { "frame_number": 3114, "timestamp_epoch": "1725471576.768679000", "display_filter": "frame.number == 3114", "tcp_stream": 70 }, { "frame_number": 3116, "timestamp_epoch": "1725471576.769369000", "display_filter": "frame.number == 3116", "tcp_stream": 70 }, { "frame_number": 3294, "timestamp_epoch": "1725471878.246043000", "display_filter": "frame.number == 3294", "tcp_stream": 77 }, { "frame_number": 3299, "timestamp_epoch": "1725471878.248800000", "display_filter": "frame.number == 3299", "tcp_stream": 77 }, { "frame_number": 3301, "timestamp_epoch": "1725471878.249906000", "display_filter": "frame.number == 3301", "tcp_stream": 77 }, { "frame_number": 3303, "timestamp_epoch": "1725471878.251424000", "display_filter": "frame.number == 3303", "tcp_stream": 77 }, { "frame_number": 3316, "timestamp_epoch": "1725471878.365237000", "display_filter": "frame.number == 3316", "tcp_stream": 77 }, { "frame_number": 3329, "timestamp_epoch": "1725471878.474418000", "display_filter": "frame.number == 3329", "tcp_stream": 77 }, { "frame_number": 3337, "timestamp_epoch": "1725471878.477360000", "display_filter": "frame.number == 3337", "tcp_stream": 77 }, { "frame_number": 3345, "timestamp_epoch": "1725471878.481232000", "display_filter": "frame.number == 3345", "tcp_stream": 77 }, { "frame_number": 3347, "timestamp_epoch": "1725471878.482820000", "display_filter": "frame.number == 3347", "tcp_stream": 77 }, { "frame_number": 3584, "timestamp_epoch": "1725472175.793201000", "display_filter": "frame.number == 3584", "tcp_stream": 92 }, { "frame_number": 3589, "timestamp_epoch": "1725472175.795404000", "display_filter": "frame.number == 3589", "tcp_stream": 92 }, { "frame_number": 3591, "timestamp_epoch": "1725472175.796022000", "display_filter": "frame.number == 3591", "tcp_stream": 92 }, { "frame_number": 3593, "timestamp_epoch": "1725472175.796445000", "display_filter": "frame.number == 3593", "tcp_stream": 92 }, { "frame_number": 3595, "timestamp_epoch": "1725472175.796820000", "display_filter": "frame.number == 3595", "tcp_stream": 92 }, { "frame_number": 3602, "timestamp_epoch": "1725472175.800184000", "display_filter": "frame.number == 3602", "tcp_stream": 93 }, { "frame_number": 3606, "timestamp_epoch": "1725472175.801121000", "display_filter": "frame.number == 3606", "tcp_stream": 93 }, { "frame_number": 3609, "timestamp_epoch": "1725472175.801725000", "display_filter": "frame.number == 3609", "tcp_stream": 93 }, { "frame_number": 4592, "timestamp_epoch": "1725473582.251027000", "display_filter": "frame.number == 4592", "tcp_stream": 131 }, { "frame_number": 4597, "timestamp_epoch": "1725473582.254343000", "display_filter": "frame.number == 4597", "tcp_stream": 131 }, { "frame_number": 4599, "timestamp_epoch": "1725473582.255808000", "display_filter": "frame.number == 4599", "tcp_stream": 131 }, { "frame_number": 4601, "timestamp_epoch": "1725473582.256904000", "display_filter": "frame.number == 4601", "tcp_stream": 131 }, { "frame_number": 4603, "timestamp_epoch": "1725473582.257973000", "display_filter": "frame.number == 4603", "tcp_stream": 131 }, { "frame_number": 4610, "timestamp_epoch": "1725473582.266232000", "display_filter": "frame.number == 4610", "tcp_stream": 132 }, { "frame_number": 4614, "timestamp_epoch": "1725473582.268104000", "display_filter": "frame.number == 4614", "tcp_stream": 132 }, { "frame_number": 4617, "timestamp_epoch": "1725473582.269010000", "display_filter": "frame.number == 4617", "tcp_stream": 132 } ], "metrics": { "source": "172.17.0.17", "destination": "172.17.0.99", "protocol": "ldap", "event_count": 66, "operation_numbers": [ "", "1", "4,19,19,19,5", "4,5", "5" ] } }, { "finding_id": "finding-c12435e5fb1d2d38701df4f7", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 410, "timestamp_epoch": "1725471275.492327000", "display_filter": "frame.number == 410", "tcp_stream": 13 }, { "frame_number": 415, "timestamp_epoch": "1725471275.493110000", "display_filter": "frame.number == 415", "tcp_stream": 13 }, { "frame_number": 417, "timestamp_epoch": "1725471275.493798000", "display_filter": "frame.number == 417", "tcp_stream": 13 }, { "frame_number": 420, "timestamp_epoch": "1725471275.494592000", "display_filter": "frame.number == 420", "tcp_stream": 13 }, { "frame_number": 422, "timestamp_epoch": "1725471275.495317000", "display_filter": "frame.number == 422", "tcp_stream": 13 }, { "frame_number": 424, "timestamp_epoch": "1725471275.496085000", "display_filter": "frame.number == 424", "tcp_stream": 13 }, { "frame_number": 426, "timestamp_epoch": "1725471275.497023000", "display_filter": "frame.number == 426", "tcp_stream": 13 }, { "frame_number": 428, "timestamp_epoch": "1725471275.498011000", "display_filter": "frame.number == 428", "tcp_stream": 13 }, { "frame_number": 432, "timestamp_epoch": "1725471275.499053000", "display_filter": "frame.number == 432", "tcp_stream": 13 }, { "frame_number": 434, "timestamp_epoch": "1725471275.499727000", "display_filter": "frame.number == 434", "tcp_stream": 13 }, { "frame_number": 439, "timestamp_epoch": "1725471275.500351000", "display_filter": "frame.number == 439", "tcp_stream": 13 }, { "frame_number": 441, "timestamp_epoch": "1725471275.500908000", "display_filter": "frame.number == 441", "tcp_stream": 13 }, { "frame_number": 446, "timestamp_epoch": "1725471275.501610000", "display_filter": "frame.number == 446", "tcp_stream": 13 }, { "frame_number": 448, "timestamp_epoch": "1725471275.502192000", "display_filter": "frame.number == 448", "tcp_stream": 13 }, { "frame_number": 450, "timestamp_epoch": "1725471275.502748000", "display_filter": "frame.number == 450", "tcp_stream": 13 } ], "metrics": { "source": "172.17.0.17", "destination": "172.17.0.99", "protocol": "samr", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] } }, { "finding_id": "finding-023ac4b3d6b6fce3323ddbfa", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 382, "timestamp_epoch": "1725471275.487359000", "display_filter": "frame.number == 382", "tcp_stream": 14 }, { "frame_number": 385, "timestamp_epoch": "1725471275.488004000", "display_filter": "frame.number == 385", "tcp_stream": 14 }, { "frame_number": 387, "timestamp_epoch": "1725471275.488895000", "display_filter": "frame.number == 387", "tcp_stream": 14 }, { "frame_number": 389, "timestamp_epoch": "1725471275.489718000", "display_filter": "frame.number == 389", "tcp_stream": 14 }, { "frame_number": 1073, "timestamp_epoch": "1725471280.064881000", "display_filter": "frame.number == 1073", "tcp_stream": 34 }, { "frame_number": 1075, "timestamp_epoch": "1725471280.065597000", "display_filter": "frame.number == 1075", "tcp_stream": 34 }, { "frame_number": 1077, "timestamp_epoch": "1725471280.066380000", "display_filter": "frame.number == 1077", "tcp_stream": 34 }, { "frame_number": 1081, "timestamp_epoch": "1725471280.068000000", "display_filter": "frame.number == 1081", "tcp_stream": 34 }, { "frame_number": 1083, "timestamp_epoch": "1725471280.068459000", "display_filter": "frame.number == 1083", "tcp_stream": 34 }, { "frame_number": 1085, "timestamp_epoch": "1725471280.069158000", "display_filter": "frame.number == 1085", "tcp_stream": 34 }, { "frame_number": 1440, "timestamp_epoch": "1725471306.290821000", "display_filter": "frame.number == 1440", "tcp_stream": 43 }, { "frame_number": 1442, "timestamp_epoch": "1725471306.291618000", "display_filter": "frame.number == 1442", "tcp_stream": 43 }, { "frame_number": 1444, "timestamp_epoch": "1725471306.292556000", "display_filter": "frame.number == 1444", "tcp_stream": 43 }, { "frame_number": 1448, "timestamp_epoch": "1725471306.294379000", "display_filter": "frame.number == 1448", "tcp_stream": 43 }, { "frame_number": 1450, "timestamp_epoch": "1725471306.294987000", "display_filter": "frame.number == 1450", "tcp_stream": 43 }, { "frame_number": 1452, "timestamp_epoch": "1725471306.295849000", "display_filter": "frame.number == 1452", "tcp_stream": 43 }, { "frame_number": 2270, "timestamp_epoch": "1725471336.280751000", "display_filter": "frame.number == 2270", "tcp_stream": 53 }, { "frame_number": 2272, "timestamp_epoch": "1725471336.282167000", "display_filter": "frame.number == 2272", "tcp_stream": 53 }, { "frame_number": 2274, "timestamp_epoch": "1725471336.283480000", "display_filter": "frame.number == 2274", "tcp_stream": 53 }, { "frame_number": 2278, "timestamp_epoch": "1725471336.287328000", "display_filter": "frame.number == 2278", "tcp_stream": 53 }, { "frame_number": 2280, "timestamp_epoch": "1725471336.288333000", "display_filter": "frame.number == 2280", "tcp_stream": 53 }, { "frame_number": 2282, "timestamp_epoch": "1725471336.289639000", "display_filter": "frame.number == 2282", "tcp_stream": 53 }, { "frame_number": 3565, "timestamp_epoch": "1725472175.785208000", "display_filter": "frame.number == 3565", "tcp_stream": 91 }, { "frame_number": 3567, "timestamp_epoch": "1725472175.786067000", "display_filter": "frame.number == 3567", "tcp_stream": 91 }, { "frame_number": 3569, "timestamp_epoch": "1725472175.786931000", "display_filter": "frame.number == 3569", "tcp_stream": 91 }, { "frame_number": 3573, "timestamp_epoch": "1725472175.788982000", "display_filter": "frame.number == 3573", "tcp_stream": 91 }, { "frame_number": 3575, "timestamp_epoch": "1725472175.789505000", "display_filter": "frame.number == 3575", "tcp_stream": 91 }, { "frame_number": 3577, "timestamp_epoch": "1725472175.790267000", "display_filter": "frame.number == 3577", "tcp_stream": 91 }, { "frame_number": 4569, "timestamp_epoch": "1725473582.137922000", "display_filter": "frame.number == 4569", "tcp_stream": 130 }, { "frame_number": 4571, "timestamp_epoch": "1725473582.138836000", "display_filter": "frame.number == 4571", "tcp_stream": 130 }, { "frame_number": 4573, "timestamp_epoch": "1725473582.139817000", "display_filter": "frame.number == 4573", "tcp_stream": 130 }, { "frame_number": 4577, "timestamp_epoch": "1725473582.141394000", "display_filter": "frame.number == 4577", "tcp_stream": 130 }, { "frame_number": 4579, "timestamp_epoch": "1725473582.142062000", "display_filter": "frame.number == 4579", "tcp_stream": 130 }, { "frame_number": 4581, "timestamp_epoch": "1725473582.142965000", "display_filter": "frame.number == 4581", "tcp_stream": 130 }, { "frame_number": 5058, "timestamp_epoch": "1725474712.484883000", "display_filter": "frame.number == 5058", "tcp_stream": 153 }, { "frame_number": 5060, "timestamp_epoch": "1725474712.485484000", "display_filter": "frame.number == 5060", "tcp_stream": 153 }, { "frame_number": 5062, "timestamp_epoch": "1725474712.486429000", "display_filter": "frame.number == 5062", "tcp_stream": 153 }, { "frame_number": 5064, "timestamp_epoch": "1725474712.487239000", "display_filter": "frame.number == 5064", "tcp_stream": 153 }, { "frame_number": 5066, "timestamp_epoch": "1725474712.487995000", "display_filter": "frame.number == 5066", "tcp_stream": 153 } ], "metrics": { "source": "172.17.0.99", "destination": "172.17.0.17", "protocol": "drsuapi", "event_count": 39, "operation_numbers": [ "0", "1", "12" ] } }, { "finding_id": "finding-86175cf0a61d613434da7ba2", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 31, "timestamp_epoch": "1725471151.433000000", "display_filter": "frame.number == 31", "tcp_stream": 0 }, { "frame_number": 34, "timestamp_epoch": "1725471151.434061000", "display_filter": "frame.number == 34", "tcp_stream": 0 }, { "frame_number": 412, "timestamp_epoch": "1725471275.492576000", "display_filter": "frame.number == 412", "tcp_stream": 18 }, { "frame_number": 430, "timestamp_epoch": "1725471275.498180000", "display_filter": "frame.number == 430", "tcp_stream": 18 }, { "frame_number": 443, "timestamp_epoch": "1725471275.501123000", "display_filter": "frame.number == 443", "tcp_stream": 19 }, { "frame_number": 454, "timestamp_epoch": "1725471275.503133000", "display_filter": "frame.number == 454", "tcp_stream": 19 }, { "frame_number": 456, "timestamp_epoch": "1725471275.503548000", "display_filter": "frame.number == 456", "tcp_stream": 19 }, { "frame_number": 458, "timestamp_epoch": "1725471275.504158000", "display_filter": "frame.number == 458", "tcp_stream": 18 }, { "frame_number": 460, "timestamp_epoch": "1725471275.509681000", "display_filter": "frame.number == 460", "tcp_stream": 19 }, { "frame_number": 464, "timestamp_epoch": "1725471275.512106000", "display_filter": "frame.number == 464", "tcp_stream": 18 }, { "frame_number": 1090, "timestamp_epoch": "1725471280.071077000", "display_filter": "frame.number == 1090", "tcp_stream": 35 }, { "frame_number": 1095, "timestamp_epoch": "1725471280.072734000", "display_filter": "frame.number == 1095", "tcp_stream": 35 }, { "frame_number": 1098, "timestamp_epoch": "1725471280.074571000", "display_filter": "frame.number == 1098", "tcp_stream": 35 }, { "frame_number": 1100, "timestamp_epoch": "1725471280.075141000", "display_filter": "frame.number == 1100", "tcp_stream": 35 }, { "frame_number": 1102, "timestamp_epoch": "1725471280.075615000", "display_filter": "frame.number == 1102", "tcp_stream": 35 }, { "frame_number": 1108, "timestamp_epoch": "1725471280.078342000", "display_filter": "frame.number == 1108", "tcp_stream": 36 }, { "frame_number": 1111, "timestamp_epoch": "1725471280.079385000", "display_filter": "frame.number == 1111", "tcp_stream": 36 }, { "frame_number": 1116, "timestamp_epoch": "1725471280.080142000", "display_filter": "frame.number == 1116", "tcp_stream": 36 }, { "frame_number": 1118, "timestamp_epoch": "1725471280.080498000", "display_filter": "frame.number == 1118", "tcp_stream": 36 }, { "frame_number": 1121, "timestamp_epoch": "1725471280.080647000", "display_filter": "frame.number == 1121", "tcp_stream": 35 }, { "frame_number": 1457, "timestamp_epoch": "1725471306.297898000", "display_filter": "frame.number == 1457", "tcp_stream": 44 }, { "frame_number": 1462, "timestamp_epoch": "1725471306.299514000", "display_filter": "frame.number == 1462", "tcp_stream": 44 }, { "frame_number": 1466, "timestamp_epoch": "1725471306.301487000", "display_filter": "frame.number == 1466", "tcp_stream": 44 }, { "frame_number": 1468, "timestamp_epoch": "1725471306.302227000", "display_filter": "frame.number == 1468", "tcp_stream": 44 }, { "frame_number": 1470, "timestamp_epoch": "1725471306.302878000", "display_filter": "frame.number == 1470", "tcp_stream": 44 }, { "frame_number": 1476, "timestamp_epoch": "1725471306.305744000", "display_filter": "frame.number == 1476", "tcp_stream": 45 }, { "frame_number": 1479, "timestamp_epoch": "1725471306.307647000", "display_filter": "frame.number == 1479", "tcp_stream": 45 }, { "frame_number": 1484, "timestamp_epoch": "1725471306.308675000", "display_filter": "frame.number == 1484", "tcp_stream": 45 }, { "frame_number": 1486, "timestamp_epoch": "1725471306.309483000", "display_filter": "frame.number == 1486", "tcp_stream": 45 }, { "frame_number": 1488, "timestamp_epoch": "1725471306.309623000", "display_filter": "frame.number == 1488", "tcp_stream": 44 }, { "frame_number": 2287, "timestamp_epoch": "1725471336.295378000", "display_filter": "frame.number == 2287", "tcp_stream": 54 }, { "frame_number": 2292, "timestamp_epoch": "1725471336.298170000", "display_filter": "frame.number == 2292", "tcp_stream": 54 }, { "frame_number": 2295, "timestamp_epoch": "1725471336.300536000", "display_filter": "frame.number == 2295", "tcp_stream": 54 }, { "frame_number": 2297, "timestamp_epoch": "1725471336.301631000", "display_filter": "frame.number == 2297", "tcp_stream": 54 }, { "frame_number": 2299, "timestamp_epoch": "1725471336.302747000", "display_filter": "frame.number == 2299", "tcp_stream": 54 }, { "frame_number": 2305, "timestamp_epoch": "1725471336.308259000", "display_filter": "frame.number == 2305", "tcp_stream": 55 }, { "frame_number": 2308, "timestamp_epoch": "1725471336.310226000", "display_filter": "frame.number == 2308", "tcp_stream": 55 }, { "frame_number": 2313, "timestamp_epoch": "1725471336.311301000", "display_filter": "frame.number == 2313", "tcp_stream": 55 }, { "frame_number": 2315, "timestamp_epoch": "1725471336.312087000", "display_filter": "frame.number == 2315", "tcp_stream": 55 }, { "frame_number": 2317, "timestamp_epoch": "1725471336.312163000", "display_filter": "frame.number == 2317", "tcp_stream": 54 }, { "frame_number": 2998, "timestamp_epoch": "1725471470.867780000", "display_filter": "frame.number == 2998", "tcp_stream": 64 }, { "frame_number": 3015, "timestamp_epoch": "1725471470.873223000", "display_filter": "frame.number == 3015", "tcp_stream": 64 }, { "frame_number": 3018, "timestamp_epoch": "1725471470.875904000", "display_filter": "frame.number == 3018", "tcp_stream": 64 }, { "frame_number": 3020, "timestamp_epoch": "1725471470.876713000", "display_filter": "frame.number == 3020", "tcp_stream": 64 }, { "frame_number": 3028, "timestamp_epoch": "1725471470.885465000", "display_filter": "frame.number == 3028", "tcp_stream": 66 }, { "frame_number": 3031, "timestamp_epoch": "1725471470.887295000", "display_filter": "frame.number == 3031", "tcp_stream": 66 }, { "frame_number": 3033, "timestamp_epoch": "1725471470.887987000", "display_filter": "frame.number == 3033", "tcp_stream": 66 }, { "frame_number": 3096, "timestamp_epoch": "1725471576.755314000", "display_filter": "frame.number == 3096", "tcp_stream": 69 }, { "frame_number": 3101, "timestamp_epoch": "1725471576.757205000", "display_filter": "frame.number == 3101", "tcp_stream": 69 }, { "frame_number": 3104, "timestamp_epoch": "1725471576.760212000", "display_filter": "frame.number == 3104", "tcp_stream": 69 }, { "frame_number": 3106, "timestamp_epoch": "1725471576.760941000", "display_filter": "frame.number == 3106", "tcp_stream": 69 }, { "frame_number": 3112, "timestamp_epoch": "1725471576.767157000", "display_filter": "frame.number == 3112", "tcp_stream": 70 }, { "frame_number": 3115, "timestamp_epoch": "1725471576.768906000", "display_filter": "frame.number == 3115", "tcp_stream": 70 }, { "frame_number": 3117, "timestamp_epoch": "1725471576.769467000", "display_filter": "frame.number == 3117", "tcp_stream": 70 }, { "frame_number": 3292, "timestamp_epoch": "1725471878.245362000", "display_filter": "frame.number == 3292", "tcp_stream": 77 }, { "frame_number": 3297, "timestamp_epoch": "1725471878.247067000", "display_filter": "frame.number == 3297", "tcp_stream": 77 }, { "frame_number": 3300, "timestamp_epoch": "1725471878.249524000", "display_filter": "frame.number == 3300", "tcp_stream": 77 }, { "frame_number": 3302, "timestamp_epoch": "1725471878.250577000", "display_filter": "frame.number == 3302", "tcp_stream": 77 }, { "frame_number": 3314, "timestamp_epoch": "1725471878.364735000", "display_filter": "frame.number == 3314", "tcp_stream": 77 }, { "frame_number": 3327, "timestamp_epoch": "1725471878.473909000", "display_filter": "frame.number == 3327", "tcp_stream": 77 }, { "frame_number": 3335, "timestamp_epoch": "1725471878.476777000", "display_filter": "frame.number == 3335", "tcp_stream": 77 }, { "frame_number": 3343, "timestamp_epoch": "1725471878.480714000", "display_filter": "frame.number == 3343", "tcp_stream": 77 }, { "frame_number": 3346, "timestamp_epoch": "1725471878.482300000", "display_filter": "frame.number == 3346", "tcp_stream": 77 }, { "frame_number": 3348, "timestamp_epoch": "1725471878.483405000", "display_filter": "frame.number == 3348", "tcp_stream": 77 }, { "frame_number": 3582, "timestamp_epoch": "1725472175.792406000", "display_filter": "frame.number == 3582", "tcp_stream": 92 }, { "frame_number": 3587, "timestamp_epoch": "1725472175.794146000", "display_filter": "frame.number == 3587", "tcp_stream": 92 }, { "frame_number": 3590, "timestamp_epoch": "1725472175.795734000", "display_filter": "frame.number == 3590", "tcp_stream": 92 }, { "frame_number": 3592, "timestamp_epoch": "1725472175.796264000", "display_filter": "frame.number == 3592", "tcp_stream": 92 }, { "frame_number": 3594, "timestamp_epoch": "1725472175.796636000", "display_filter": "frame.number == 3594", "tcp_stream": 92 }, { "frame_number": 3600, "timestamp_epoch": "1725472175.799429000", "display_filter": "frame.number == 3600", "tcp_stream": 93 }, { "frame_number": 3603, "timestamp_epoch": "1725472175.800452000", "display_filter": "frame.number == 3603", "tcp_stream": 93 }, { "frame_number": 3608, "timestamp_epoch": "1725472175.801275000", "display_filter": "frame.number == 3608", "tcp_stream": 93 }, { "frame_number": 3610, "timestamp_epoch": "1725472175.801872000", "display_filter": "frame.number == 3610", "tcp_stream": 93 }, { "frame_number": 3613, "timestamp_epoch": "1725472175.802068000", "display_filter": "frame.number == 3613", "tcp_stream": 92 }, { "frame_number": 4590, "timestamp_epoch": "1725473582.250270000", "display_filter": "frame.number == 4590", "tcp_stream": 131 }, { "frame_number": 4595, "timestamp_epoch": "1725473582.253520000", "display_filter": "frame.number == 4595", "tcp_stream": 131 }, { "frame_number": 4598, "timestamp_epoch": "1725473582.255407000", "display_filter": "frame.number == 4598", "tcp_stream": 131 }, { "frame_number": 4600, "timestamp_epoch": "1725473582.256492000", "display_filter": "frame.number == 4600", "tcp_stream": 131 }, { "frame_number": 4602, "timestamp_epoch": "1725473582.257551000", "display_filter": "frame.number == 4602", "tcp_stream": 131 }, { "frame_number": 4608, "timestamp_epoch": "1725473582.265434000", "display_filter": "frame.number == 4608", "tcp_stream": 132 }, { "frame_number": 4611, "timestamp_epoch": "1725473582.267302000", "display_filter": "frame.number == 4611", "tcp_stream": 132 }, { "frame_number": 4616, "timestamp_epoch": "1725473582.268728000", "display_filter": "frame.number == 4616", "tcp_stream": 132 }, { "frame_number": 4618, "timestamp_epoch": "1725473582.269649000", "display_filter": "frame.number == 4618", "tcp_stream": 132 }, { "frame_number": 4622, "timestamp_epoch": "1725473582.270163000", "display_filter": "frame.number == 4622", "tcp_stream": 131 } ], "metrics": { "source": "172.17.0.99", "destination": "172.17.0.17", "protocol": "ldap", "event_count": 84, "operation_numbers": [ "", "0", "2", "3" ] } }, { "finding_id": "finding-a49be6f52e47825b864daab9", "rule_id": "directory-service-activity", "rule_version": "pcap-rules-v3", "severity": "low", "title": "Directory-service protocol activity", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "confidence": 0.95, "status": "candidate", "evidence": [ { "frame_number": 409, "timestamp_epoch": "1725471275.491823000", "display_filter": "frame.number == 409", "tcp_stream": 13 }, { "frame_number": 413, "timestamp_epoch": "1725471275.492594000", "display_filter": "frame.number == 413", "tcp_stream": 13 }, { "frame_number": 416, "timestamp_epoch": "1725471275.493261000", "display_filter": "frame.number == 416", "tcp_stream": 13 }, { "frame_number": 418, "timestamp_epoch": "1725471275.493938000", "display_filter": "frame.number == 418", "tcp_stream": 13 }, { "frame_number": 421, "timestamp_epoch": "1725471275.494763000", "display_filter": "frame.number == 421", "tcp_stream": 13 }, { "frame_number": 423, "timestamp_epoch": "1725471275.495492000", "display_filter": "frame.number == 423", "tcp_stream": 13 }, { "frame_number": 425, "timestamp_epoch": "1725471275.496220000", "display_filter": "frame.number == 425", "tcp_stream": 13 }, { "frame_number": 427, "timestamp_epoch": "1725471275.497152000", "display_filter": "frame.number == 427", "tcp_stream": 13 }, { "frame_number": 429, "timestamp_epoch": "1725471275.498143000", "display_filter": "frame.number == 429", "tcp_stream": 13 }, { "frame_number": 433, "timestamp_epoch": "1725471275.499194000", "display_filter": "frame.number == 433", "tcp_stream": 13 }, { "frame_number": 436, "timestamp_epoch": "1725471275.499914000", "display_filter": "frame.number == 436", "tcp_stream": 13 }, { "frame_number": 440, "timestamp_epoch": "1725471275.500507000", "display_filter": "frame.number == 440", "tcp_stream": 13 }, { "frame_number": 444, "timestamp_epoch": "1725471275.501141000", "display_filter": "frame.number == 444", "tcp_stream": 13 }, { "frame_number": 447, "timestamp_epoch": "1725471275.501755000", "display_filter": "frame.number == 447", "tcp_stream": 13 }, { "frame_number": 449, "timestamp_epoch": "1725471275.502313000", "display_filter": "frame.number == 449", "tcp_stream": 13 } ], "metrics": { "source": "172.17.0.99", "destination": "172.17.0.17", "protocol": "samr", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] } } ], "attack_candidates": [], "actor_leads": [], "coverage": { "event_limits": { "dns": { "returned": 173, "truncated": false }, "http_request": { "returned": 57, "truncated": false }, "http_response": { "returned": 57, "truncated": false }, "tls_client_hello": { "returned": 72, "truncated": false }, "dhcp": { "returned": 4, "truncated": false }, "identity": { "returned": 294, "truncated": false }, "directory_service": { "returned": 258, "truncated": false }, "unclassified_tcp": { "returned": 56, "truncated": false } }, "warnings": [], "encrypted_payload_visibility": "metadata-only", "name_resolution": false, "http_objects": { "exported_objects": 54, "hashed_objects": 54, "unique_hashes": 6, "returned_unique_hashes": 6, "detailed_objects": 6, "compact_hash_index": [], "compact_objects": 0, "omitted_unique_hashes": 0, "unhashed_objects": 0, "hashed_bytes": 215, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "complete": true }, "complete_within_profile": true, "limitations": [ "Encrypted application contents are not decrypted", "Protocol decoding and heuristic findings do not establish malware family or attribution", "No endpoint execution, persistence, or credential-theft proof without corresponding evidence" ] }, "summary": "Decoded 5091 packets across 42 IP endpoints and 221 transport flows. Observed 173 DNS events, 57 HTTP requests, 72 TLS ClientHello events, and 6 exported HTTP object(s). Deterministic rules produced 8 finding(s): 0 high, 1 medium, and 7 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "semantic_sha256": "4897ba23edbbda370beb304db04a336b3872d332b86d9834b16bb29e87c6d8b5" }, "context": { "schema_version": "pcap-context-v1", "created_at": "2026-09-19T12:08:45.501397+00:00", "session_id": "df6c55a2-3630-4e95-82d0-0eebb41c3b51", "source_semantic_sha256": "4897ba23edbbda370beb304db04a336b3872d332b86d9834b16bb29e87c6d8b5", "mode": "local-only", "external_enrichment": { "status": "not-requested", "requests": 0, "reason": "Requires explicit provider consent and privacy review" }, "coverage": { "observables_total": 147, "observables_checked": 147, "observable_limit": 5000, "truncated": false, "matched_observables": 0, "no_exact_match": 147, "prior_cases_checked": 7, "prior_case_limit_reached": false }, "matches": [], "source_actor_links": [], "techniques": [], "cross_case_correlations": [ { "analysis_id": "08324647-35af-4af2-8d82-4387eec03918", "session_id": "426471ed-5e63-4b7e-ac6c-d36e060a4739", "source_sha256": "a38267943a7bf3b0e445d7e51cb0a68b3dee797d67081bc9a033f73d079c0f50", "shared_observables": [ { "type": "domain", "value": "a1834.dscg2.akamai.net" }, { "type": "domain", "value": "acroipm2.adobe.com" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "assets.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "img-s-msn-com.akamaized.net" }, { "type": "domain", "value": "inputsuggestions.msdxcdn.microsoft.com" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "mobile.events.data.microsoft.com" }, { "type": "domain", "value": "odc.officeapps.live.com" }, { "type": "domain", "value": "officeclient.microsoft.com" }, { "type": "domain", "value": "srtb.msn.com" }, { "type": "domain", "value": "storecatalogrevocation.storequality.microsoft.com" }, { "type": "domain", "value": "th.bing.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "windows.msn.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.msftconnecttest.com" }, { "type": "domain", "value": "www.msn.com" }, { "type": "ipv4", "value": "13.107.246.57" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "20.189.173.26" }, { "type": "ipv4", "value": "20.190.135.2" }, { "type": "ipv4", "value": "20.42.73.28" }, { "type": "ipv4", "value": "20.96.153.111" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "40.126.28.11" }, { "type": "ipv4", "value": "40.126.28.22" }, { "type": "ipv4", "value": "40.126.7.32" }, { "type": "ipv4", "value": "52.113.194.132" }, { "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61" }, { "type": "sha256", "value": "69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820" } ], "shared_count": 38, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "616a90fa-f15e-4fcb-8d56-7b8e0eff5785", "session_id": "1ea146b9-1fb6-4be9-8adc-154756a8642c", "source_sha256": "21bb800849459709a7ceb5513573b2b20f090ffccd00eb89b9886feedd47a2df", "shared_observables": [ { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "mobile.events.data.microsoft.com" }, { "type": "domain", "value": "odc.officeapps.live.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "ipv4", "value": "40.126.28.19" }, { "type": "ipv4", "value": "40.126.28.20" }, { "type": "ipv4", "value": "40.126.28.21" }, { "type": "ipv4", "value": "40.126.28.23" }, { "type": "ipv4", "value": "40.126.7.35" } ], "shared_count": 12, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "459e119d-191f-49e8-85ea-c78f9de41826", "session_id": "45dead98-56f7-41bd-bcd0-62bcf13e9f9b", "source_sha256": "0ea6b597732a9ce6af9a7e3adff4512c9a91b4bce27184c8fdeb746f05cce170", "shared_observables": [ { "type": "domain", "value": "a1834.dscg2.akamai.net" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "assets.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "download.windowsupdate.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "img-s-msn-com.akamaized.net" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "mobile.events.data.microsoft.com" }, { "type": "domain", "value": "officeclient.microsoft.com" }, { "type": "domain", "value": "pti.store.microsoft.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "srtb.msn.com" }, { "type": "domain", "value": "th.bing.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "windows.msn.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.msftconnecttest.com" }, { "type": "domain", "value": "www.msn.com" }, { "type": "ipv4", "value": "199.232.210.172" }, { "type": "ipv4", "value": "199.232.214.172" }, { "type": "ipv4", "value": "20.190.135.2" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "40.126.28.11" }, { "type": "ipv4", "value": "40.126.28.22" }, { "type": "ipv4", "value": "40.126.28.23" }, { "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61" } ], "shared_count": 31, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "7a2cfe72-f48d-4894-8a2d-8889cb3b11b2", "session_id": "d201ef05-c1ff-4b51-bfb6-594810367b62", "source_sha256": "3dc470f5490ec15b4024c513e87c67e0b17caeae2a2ce3d83541be24ef407e61", "shared_observables": [ { "type": "domain", "value": "a1834.dscg2.akamai.net" }, { "type": "domain", "value": "acroipm2.adobe.com" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "assets.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "g.live.com" }, { "type": "domain", "value": "img-s-msn-com.akamaized.net" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "mobile.events.data.microsoft.com" }, { "type": "domain", "value": "odc.officeapps.live.com" }, { "type": "domain", "value": "officeclient.microsoft.com" }, { "type": "domain", "value": "oneclient.sfx.ms" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "srtb.msn.com" }, { "type": "domain", "value": "th.bing.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "windows.msn.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.msftconnecttest.com" }, { "type": "domain", "value": "www.msn.com" }, { "type": "ipv4", "value": "13.107.246.57" }, { "type": "ipv4", "value": "13.70.79.200" }, { "type": "ipv4", "value": "13.89.179.9" }, { "type": "ipv4", "value": "199.232.210.172" }, { "type": "ipv4", "value": "199.232.214.172" }, { "type": "ipv4", "value": "20.189.173.1" }, { "type": "ipv4", "value": "20.190.135.2" }, { "type": "ipv4", "value": "20.96.153.111" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "40.119.249.228" }, { "type": "ipv4", "value": "40.126.28.11" }, { "type": "ipv4", "value": "40.126.28.12" }, { "type": "ipv4", "value": "40.126.28.13" }, { "type": "ipv4", "value": "40.126.28.18" }, { "type": "ipv4", "value": "40.126.28.19" }, { "type": "ipv4", "value": "40.126.28.20" }, { "type": "ipv4", "value": "40.126.28.21" }, { "type": "ipv4", "value": "40.126.28.22" }, { "type": "ipv4", "value": "40.126.28.23" }, { "type": "ipv4", "value": "40.126.7.32" }, { "type": "ipv4", "value": "40.126.7.35" }, { "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61" } ], "shared_count": 47, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "81373b30-6a59-49d1-89b0-bad73ed19eaa", "session_id": "28d700f9-1f64-46d0-ab25-5dd6123537fa", "source_sha256": "f755444d0b6eac847e07b73dea0774084b232d8577f536547a12f39b959d7833", "shared_observables": [ { "type": "domain", "value": "a1834.dscg2.akamai.net" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "assets.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "img-s-msn-com.akamaized.net" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "odc.officeapps.live.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "srtb.msn.com" }, { "type": "domain", "value": "th.bing.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "windows.msn.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.msftconnecttest.com" }, { "type": "domain", "value": "www.msn.com" }, { "type": "ipv4", "value": "13.107.246.57" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "20.96.153.111" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "52.109.0.142" }, { "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61" } ], "shared_count": 26, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "38851ad7-b3a0-423d-ae89-3b7be4e4b908", "session_id": "d001b3fc-7e55-401a-8bb6-381e0c10fbda", "source_sha256": "33e274d7246f4eca8fbe7337c465c7ded077cd650d5d4d42481cad822c962741", "shared_observables": [ { "type": "domain", "value": "acroipm2.adobe.com" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "assets.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "srtb.msn.com" }, { "type": "domain", "value": "th.bing.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "windows.msn.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.msftconnecttest.com" }, { "type": "domain", "value": "www.msn.com" }, { "type": "ipv4", "value": "13.107.246.57" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "20.190.135.2" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "40.126.28.12" }, { "type": "ipv4", "value": "40.126.28.19" }, { "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61" } ], "shared_count": 26, "status": "shared-observation-not-common-campaign" }, { "analysis_id": "bfccc426-aa9b-4007-8558-a66d37ecb90c", "session_id": "bc2c808d-5171-4ed5-9832-5cbf7c3a8866", "source_sha256": "e59db1c07c6fdefafa0abdbca03248c341cdc36c09c34753204d3162802a3586", "shared_observables": [ { "type": "domain", "value": "a1834.dscg2.akamai.net" }, { "type": "domain", "value": "api.msn.com" }, { "type": "domain", "value": "assets.msn.com" }, { "type": "domain", "value": "client.wns.windows.com" }, { "type": "domain", "value": "ctldl.windowsupdate.com" }, { "type": "domain", "value": "dns.msftncsi.com" }, { "type": "domain", "value": "download.windowsupdate.com" }, { "type": "domain", "value": "ecs.office.com" }, { "type": "domain", "value": "fd.api.iris.microsoft.com" }, { "type": "domain", "value": "g.live.com" }, { "type": "domain", "value": "img-s-msn-com.akamaized.net" }, { "type": "domain", "value": "login.microsoftonline.com" }, { "type": "domain", "value": "mobile.events.data.microsoft.com" }, { "type": "domain", "value": "odc.officeapps.live.com" }, { "type": "domain", "value": "officeclient.microsoft.com" }, { "type": "domain", "value": "oneclient.sfx.ms" }, { "type": "domain", "value": "pti.store.microsoft.com" }, { "type": "domain", "value": "settings-win.data.microsoft.com" }, { "type": "domain", "value": "srtb.msn.com" }, { "type": "domain", "value": "th.bing.com" }, { "type": "domain", "value": "v10.events.data.microsoft.com" }, { "type": "domain", "value": "windows.msn.com" }, { "type": "domain", "value": "www.bing.com" }, { "type": "domain", "value": "www.msftconnecttest.com" }, { "type": "domain", "value": "www.msn.com" }, { "type": "ipv4", "value": "13.107.246.57" }, { "type": "ipv4", "value": "131.107.255.255" }, { "type": "ipv4", "value": "199.232.210.172" }, { "type": "ipv4", "value": "199.232.214.172" }, { "type": "ipv4", "value": "20.10.31.115" }, { "type": "ipv4", "value": "20.189.173.18" }, { "type": "ipv4", "value": "20.190.135.2" }, { "type": "ipv4", "value": "20.241.44.114" }, { "type": "ipv4", "value": "20.96.153.111" }, { "type": "ipv4", "value": "204.79.197.203" }, { "type": "ipv4", "value": "224.0.0.251" }, { "type": "ipv4", "value": "224.0.0.252" }, { "type": "ipv4", "value": "23.45.119.134" }, { "type": "ipv4", "value": "23.45.119.143" }, { "type": "ipv4", "value": "23.45.119.144" }, { "type": "ipv4", "value": "23.45.119.146" }, { "type": "ipv4", "value": "23.45.119.147" }, { "type": "ipv4", "value": "40.126.28.11" }, { "type": "ipv4", "value": "40.126.28.12" }, { "type": "ipv4", "value": "40.126.28.18" }, { "type": "ipv4", "value": "40.126.28.19" }, { "type": "ipv4", "value": "40.126.28.20" }, { "type": "ipv4", "value": "40.126.28.21" }, { "type": "ipv4", "value": "40.126.28.22" }, { "type": "ipv4", "value": "40.126.28.23" }, { "type": "ipv4", "value": "40.126.7.32" }, { "type": "ipv4", "value": "40.126.7.35" }, { "type": "ipv4", "value": "52.109.0.142" }, { "type": "ipv4", "value": "52.109.0.91" }, { "type": "ipv4", "value": "52.113.194.132" }, { "type": "sha256", "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61" } ], "shared_count": 56, "status": "shared-observation-not-common-campaign" } ], "interpretation": "No match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.", "snapshot_sha256": "99bf9b0d5c90e5eb36c1f5a055241fc0beb1b677bd448cb59545c1ac1d629049" }, "techniques": [], "apt_matches": [] }