Vectra Cognito Detect

Overview

Vectra provides AI-powered incident detection and resolution support for native and hybrid clouds.

• Vendor:
• Supported environment: SaaS
• Detection based on: Telemetry
• Supported application or feature: Authentication logs

Configure

This setup guide will show you how to forward logs produced by your Vectra Appliance server to Sekoia.io by means of an rsyslog transport channel.

Configure the Rsyslog server

Please consult the Rsyslog Transport documentation to forward these logs to Sekoia.io.

Raw Events Samples

In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.

vectra_account_scoringvectra_campaignvectra_command_controlvectra_host_lockdownvectra_host_scoringvectra_infovectra_lateral_movementvectra_lockdownvectra_several_ports_scanned_01vectra_several_ports_scanned_02vectra_threat1vectra_threat1_10vectra_threat1_11vectra_threat1_12vectra_threat1_13vectra_threat1_14vectra_threat1_15vectra_threat1_16vectra_threat1_17vectra_threat1_18vectra_threat1_19vectra_threat1_2vectra_threat1_20vectra_threat1_21vectra_threat1_22vectra_threat1_23vectra_threat1_24vectra_threat1_25vectra_threat1_3vectra_threat1_4vectra_threat1_5vectra_threat1_6vectra_threat1_7vectra_threat1_8vectra_threat1_9vectra_threat2vectra_threat3vectra_threat4

- :{"version":"6.12","account_id":123456,"headend_addr":"198.51.100.94","account_uid":"admin-prtg@company.local","threat":0,"certainty":0,"score_decreases":true,"privilege":4,"href":"https:/198.51.100.94/accounts/522","category":"ACCOUNT SCORING","tags":[],"host_access_history":[{"id":22235,"name":"HOSTNAME.COMPANY.LOCAL","privilege":null,"privilegeCategory":null,"lastSeen":"2021-09-30T08:06:46+00:00"}],"service_access_history":[{"id":1470943,"uid":"cifs/serssq01.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T08:06:46+00:00"},{"id":5,"uid":"krbtgt/company.local.company@company","privilege":null,"privilegeCategory":null,"lastSeen":"2021-09-30T08:04:19+00:00"},{"id":2614295,"uid":"rpcss/host109.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T08:04:19+00:00"},{"id":2614304,"uid":"rpcss/host2db01.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T08:04:04+00:00"},{"id":2614297,"uid":"rpcss/host110.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T07:57:44+00:00"},{"id":990,"uid":"rpcss/srv-appli02.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T07:54:04+00:00"},{"id":2614303,"uid":"rpcss/host201.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T07:37:28+00:00"},{"id":4214403,"uid":"http/alm.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T07:21:04+00:00"},{"id":4186134,"uid":"http/host109.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T07:20:50+00:00"},{"id":3693289,"uid":"http/host110.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T07:20:38+00:00"}],"last_detection_type":"Privilege Anomaly: Unusual Service - Insider","vectra_timestamp":"1633338457"}

-: {"src_name": "IP-255.255.255.1", "src_ip": "255.255.255.1", "src_hid": 11111, "dest_name": "push.services.mozilla.com", "dest_ip": "255.255.255.2", "dest_id": "external", "timestamp": 1111111222.0, "campaign_name": "push.services.mozilla.com-13", "campaign_id": 222, "campaign_link": "https://255.255.255.3/campaigns/222", "action": "ADD", "reason": "Connection", "version": "6.8", "headend_addr": "255.255.255.3", "dvchost": "255.255.255.3", "vectra_timestamp": "1111111111"}

-: {"version": "6.12", "detection_id": 13281, "category": "COMMAND & CONTROL", "severity": 6.0, "threat": 60, "certainty": 72, "d_type": "hidden_http_tunnel_cnc", "d_type_vname": "Hidden HTTP Tunnel", "triaged": false, "headend_addr": "198.51.100.94", "dvchost": "198.51.100.94", "href": "https://198.51.100.94/detections/13281?detail_id=94738", "dd_dst_ip": "198.51.100.1", "dd_dst_port": 8002, "dd_dst_dns": "mirror.centos.org", "dd_bytes_sent": 1476677, "dd_bytes_rcvd": 8269214038, "host_name": "IP-198.51.100.14", "host_ip": "198.51.100.14", "dd_proto": "tcp", "vectra_timestamp": "1633516306"}

- :{"type":"some-type","version":"6.12","account_id":123456,"headend_addr":"198.51.100.94","account_uid":"admin-prtg@company.local","threat":0,"certainty":0,"score_decreases":true,"privilege":4,"href":"https:/198.51.100.94/accounts/522","category":"HOST_LOCKDOWN","tags":[],"host_access_history":[{"id":22235,"name":"HOSTNAME.COMPANY.LOCAL","privilege":null,"privilegeCategory":null,"lastSeen":"2021-09-30T08:06:46+00:00"}],"service_access_history":[{"id":1470943,"uid":"cifs/serssq01.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T08:06:46+00:00"},{"id":5,"uid":"krbtgt/company.local.company@company","privilege":null,"privilegeCategory":null,"lastSeen":"2021-09-30T08:04:19+00:00"},{"id":2614295,"uid":"rpcss/host109.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T08:04:19+00:00"},{"id":2614304,"uid":"rpcss/host2db01.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T08:04:04+00:00"},{"id":2614297,"uid":"rpcss/host110.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T07:57:44+00:00"},{"id":990,"uid":"rpcss/srv-appli02.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T07:54:04+00:00"},{"id":2614303,"uid":"rpcss/host201.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T07:37:28+00:00"},{"id":4214403,"uid":"http/alm.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T07:21:04+00:00"},{"id":4186134,"uid":"http/host109.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T07:20:50+00:00"},{"id":3693289,"uid":"http/host110.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T07:20:38+00:00"}],"last_detection_type":"Privilege Anomaly: Unusual Service - Insider","vectra_timestamp":"1633338457"}

-: {"version": "6.12", "host_id": 27617, "headend_addr": "198.51.100.94", "host_name": "IP-198.51.100.14", "dvchost": "198.51.100.94", "host_ip": "198.51.100.14", "threat": 22, "certainty": 31, "privilege": 0, "score_decreases": false, "href": "https://198.51.100.94/hosts/27617", "host_roles": "", "src_key_asset": false, "dst_key_asset": false, "category": "HOST SCORING", "sensor": "E123456789123456", "detection_profile": {"name": "saas", "vname": "Cloud Services", "scoringDetections": ["Hidden HTTP Tunnel (C&C)"]}, "host_groups": [], "tags": [], "account_access_history": [], "service_access_history": [], "mac_address": null, "mac_vendor": null, "last_detection_type": "Hidden HTTP Tunnel", "vectra_timestamp": "1633690973"}

-: {"category": "INFO", "certainty": 0, "d_type": "si_new_host", "d_type_vname": "New Host", "dd_bytes_rcvd": null, "dd_bytes_sent": null, "dd_dst_dns": "", "dd_dst_ip": "0.0.0.0", "dd_dst_port": 80, "dd_proto": "", "detection_id": 9999, "dvchost": "255.255.255.1", "headend_addr": "255.255.255.1", "host_ip": "10.0.0.1", "host_name": "plop-99", "href": "https://255.255.255.1/detections/9999?detail_id=11111", "severity": 0, "threat": 0, "triaged": false, "vectra_timestamp": "1099999999", "version": "6.7"}

-: {"accounts": "user@company.net", "shares": "", "reason": "MORE_PROCESSING_REQUIRED", "count": 295, "version": "6.12", "detection_id": 13295, "category": "LATERAL MOVEMENT", "severity": 2.0, "threat": 20, "certainty": 74, "d_type": "smb_brute_force", "d_type_vname": "SMB Brute-Force", "triaged": false, "headend_addr": "198.51.100.94", "dvchost": "198.51.100.94", "href": "https://198.51.100.94/detections/13295?detail_id=94908", "dd_dst_ip": "198.51.100.38", "dd_dst_port": 445, "dd_dst_dns": "", "dd_bytes_sent": null, "dd_bytes_rcvd": null, "host_name": "hostname", "host_ip": "198.51.100.155", "dd_proto": "", "vectra_timestamp": "1633681756"}

- :{"version":"6.12","account_id":123456,"headend_addr":"198.51.100.94","account_uid":"admin-prtg@company.local","threat":0,"certainty":0,"score_decreases":true,"privilege":4,"href":"https:/198.51.100.94/accounts/522","category":"LOCKDOWN","tags":[],"host_access_history":[{"id":22235,"name":"HOSTNAME.COMPANY.LOCAL","privilege":null,"privilegeCategory":null,"lastSeen":"2021-09-30T08:06:46+00:00"}],"service_access_history":[{"id":1470943,"uid":"cifs/serssq01.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T08:06:46+00:00"},{"id":5,"uid":"krbtgt/company.local.company@company","privilege":null,"privilegeCategory":null,"lastSeen":"2021-09-30T08:04:19+00:00"},{"id":2614295,"uid":"rpcss/host109.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T08:04:19+00:00"},{"id":2614304,"uid":"rpcss/host2db01.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T08:04:04+00:00"},{"id":2614297,"uid":"rpcss/host110.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T07:57:44+00:00"},{"id":990,"uid":"rpcss/srv-appli02.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T07:54:04+00:00"},{"id":2614303,"uid":"rpcss/host201.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T07:37:28+00:00"},{"id":4214403,"uid":"http/alm.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T07:21:04+00:00"},{"id":4186134,"uid":"http/host109.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T07:20:50+00:00"},{"id":3693289,"uid":"http/host110.company.local@company.local","privilege":4,"privilegeCategory":"Medium","lastSeen":"2021-09-30T07:20:38+00:00"}],"last_detection_type":"Privilege Anomaly: Unusual Service - Insider","vectra_timestamp":"1633338457"}

-: {"ports": "7-9,13,21-26,37,53,79-81,88,106,110-113,119,135,139-144,179,199,389,427,443-445,465,513-515,543-544,548,554,587,631,646,873,990,993-995,1025-1029,1110,1433,1720,1723,1755,1900,2000-2001,2049,2121,2717,3000,3128,3306,3389,3986,4899,5000,5009,5051,5060,5101,5190,5357,5432,5631,5666,5800,5900,6000-6001,6646,7070,8000,8008-8009,8080-8081,8443,8888,9100,9999-10000,32768,49152-49157", "scans": 100, "successes": 0, "version": "8.5", "detection_id": 85003, "category": "RECONNAISSANCE", "severity": 0, "threat": 0, "certainty": 0, "d_type": "port_scan", "d_type_vname": "Port Scan", "triaged": true, "headend_addr": "1.2.3.4", "dvchost": "1.2.3.4", "href": "https://1.2.3.4/detections/85003?detail_id=2029813", "dd_dst_ip": "5.6.7.8", "dd_dst_port": 0, "dd_dst_dns": "", "dd_bytes_sent": 0, "dd_bytes_rcvd": 0, "mitre": ["T1046", "T1018", "T1072"], "host_name": "host", "host_ip": "3.4.5.6", "dd_proto": "tcp", "vectra_timestamp": "1721184242"}

-: {"ports": "7-9,13,21-26,37,53,79-81,88,106,110-113,119,135,139-144,179,199,389,427,443-445,465,513-515,543-544,548,554,587,631,646,873,990,993-995,1025-1029,1110,1433,1720,1723,1755,1900,2000-2001,2049,2121,2717,3000,3128,3306,3389,3986,4899,5000,5009,5051,5060,5101,5190,5357,5432,5631,5666,5800,5900,6000-6001,6646,7070,8000,8008-8009,8080-8081,8443,8888,9100,9999-10000,32768,49152-49157", "scans": 100, "successes": 0, "version": "8.5", "detection_id": 85003, "category": "RECONNAISSANCE", "severity": 0, "threat": 0, "certainty": 0, "d_type": "port_scan", "d_type_vname": "Port Scan", "triaged": true, "headend_addr": "1.2.3.4", "dvchost": "1.2.3.4", "href": "https://1.2.3.4/detections/85003?detail_id=2029784", "dd_dst_ip": "5.6.7.8", "dd_dst_port": 0, "dd_dst_dns": "", "dd_bytes_sent": 0, "dd_bytes_rcvd": 0, "mitre": ["T1046", "T1018", "T1072"], "host_name": "host", "host_ip": "3.4.5.6", "dd_proto": "tcp", "vectra_timestamp": "1721183706"}

-: {"version": "6.8", "detection_id": 1900, "category": "RECONNAISSANCE", "severity": 7.0, "threat": 70, "certainty": 86, "d_type": "rpc_recon_1to1", "d_type_vname": "RPC Targeted Recon", "triaged": false, "headend_addr": "255.255.255.1", "dvchost": "255.255.255.1", "href": "https://255.255.255.1/detections/1900?detail_id=66777", "dd_dst_ip": "10.43.0.81", "dd_dst_port": 49668, "dd_dst_dns": "", "dd_bytes_sent": null, "dd_bytes_rcvd": null, "host_name": "IP-192.168.71.1", "host_ip": "192.168.71.1", "dd_proto": "", "vectra_timestamp": "1623742534"}

-: {"version": "6.8", "detection_id": 1900, "category": "RECONNAISSANCE", "severity": 7.0, "threat": 70, "certainty": 86, "d_type": "rpc_recon_1to1", "d_type_vname": "Suspicious Remote Desktop", "triaged": false, "headend_addr": "255.255.255.1", "dvchost": "255.255.255.1", "href": "https://255.255.255.1/detections/1900?detail_id=66777", "dd_dst_ip": "10.43.0.81", "dd_dst_port": 49668, "dd_dst_dns": "", "dd_bytes_sent": null, "dd_bytes_rcvd": null, "host_name": "IP-192.168.71.1", "host_ip": "192.168.71.1", "dd_proto": "", "vectra_timestamp": "1623742534"}

-: {"version": "6.8", "detection_id": 1900, "category": "RECONNAISSANCE", "severity": 7.0, "threat": 70, "certainty": 86, "d_type": "rpc_recon_1to1", "d_type_vname": "Suspicious Remote Execution", "triaged": false, "headend_addr": "255.255.255.1", "dvchost": "255.255.255.1", "href": "https://255.255.255.1/detections/1900?detail_id=66777", "dd_dst_ip": "10.43.0.81", "dd_dst_port": 49668, "dd_dst_dns": "", "dd_bytes_sent": null, "dd_bytes_rcvd": null, "host_name": "IP-192.168.71.1", "host_ip": "192.168.71.1", "dd_proto": "", "vectra_timestamp": "1623742534"}

-: {"version": "6.8", "detection_id": 1900, "category": "RECONNAISSANCE", "severity": 7.0, "threat": 70, "certainty": 86, "d_type": "rpc_recon_1to1", "d_type_vname": "Internal Stage Loader", "triaged": false, "headend_addr": "255.255.255.1", "dvchost": "255.255.255.1", "href": "https://255.255.255.1/detections/1900?detail_id=66777", "dd_dst_ip": "10.43.0.81", "dd_dst_port": 49668, "dd_dst_dns": "", "dd_bytes_sent": null, "dd_bytes_rcvd": null, "host_name": "IP-192.168.71.1", "host_ip": "192.168.71.1", "dd_proto": "", "vectra_timestamp": "1623742534"}

-: {"version": "6.8", "detection_id": 1900, "category": "RECONNAISSANCE", "severity": 7.0, "threat": 70, "certainty": 86, "d_type": "rpc_recon_1to1", "d_type_vname": "Suspicious LDAP Query", "triaged": false, "headend_addr": "255.255.255.1", "dvchost": "255.255.255.1", "href": "https://255.255.255.1/detections/1900?detail_id=66777", "dd_dst_ip": "10.43.0.81", "dd_dst_port": 49668, "dd_dst_dns": "", "dd_bytes_sent": null, "dd_bytes_rcvd": null, "host_name": "IP-192.168.71.1", "host_ip": "192.168.71.1", "dd_proto": "", "vectra_timestamp": "1623742534"}

-: {"version": "6.8", "detection_id": 1900, "category": "RECONNAISSANCE", "severity": 7.0, "threat": 70, "certainty": 86, "d_type": "rpc_recon_1to1", "d_type_vname": "RPC Recon", "triaged": false, "headend_addr": "255.255.255.1", "dvchost": "255.255.255.1", "href": "https://255.255.255.1/detections/1900?detail_id=66777", "dd_dst_ip": "10.43.0.81", "dd_dst_port": 49668, "dd_dst_dns": "", "dd_bytes_sent": null, "dd_bytes_rcvd": null, "host_name": "IP-192.168.71.1", "host_ip": "192.168.71.1", "dd_proto": "", "vectra_timestamp": "1623742534"}

-: {"version": "6.8", "detection_id": 1900, "category": "RECONNAISSANCE", "severity": 7.0, "threat": 70, "certainty": 86, "d_type": "rpc_recon_1to1", "d_type_vname": "RDP Recon", "triaged": false, "headend_addr": "255.255.255.1", "dvchost": "255.255.255.1", "href": "https://255.255.255.1/detections/1900?detail_id=66777", "dd_dst_ip": "10.43.0.81", "dd_dst_port": 49668, "dd_dst_dns": "", "dd_bytes_sent": null, "dd_bytes_rcvd": null, "host_name": "IP-192.168.71.1", "host_ip": "192.168.71.1", "dd_proto": "", "vectra_timestamp": "1623742534"}

-: {"version": "6.8", "detection_id": 1900, "category": "RECONNAISSANCE", "severity": 7.0, "threat": 70, "certainty": 86, "d_type": "rpc_recon_1to1", "d_type_vname": "Port Sweep", "triaged": false, "headend_addr": "255.255.255.1", "dvchost": "255.255.255.1", "href": "https://255.255.255.1/detections/1900?detail_id=66777", "dd_dst_ip": "10.43.0.81", "dd_dst_port": 49668, "dd_dst_dns": "", "dd_bytes_sent": null, "dd_bytes_rcvd": null, "host_name": "IP-192.168.71.1", "host_ip": "192.168.71.1", "dd_proto": "", "vectra_timestamp": "1623742534"}

-: {"version": "6.8", "detection_id": 1900, "category": "RECONNAISSANCE", "severity": 7.0, "threat": 70, "certainty": 86, "d_type": "rpc_recon_1to1", "d_type_vname": "Port Scan", "triaged": false, "headend_addr": "255.255.255.1", "dvchost": "255.255.255.1", "href": "https://255.255.255.1/detections/1900?detail_id=66777", "dd_dst_ip": "10.43.0.81", "dd_dst_port": 49668, "dd_dst_dns": "", "dd_bytes_sent": null, "dd_bytes_rcvd": null, "host_name": "IP-192.168.71.1", "host_ip": "192.168.71.1", "dd_proto": "", "vectra_timestamp": "1623742534"}

-: {"version": "6.8", "detection_id": 1900, "category": "RECONNAISSANCE", "severity": 7.0, "threat": 70, "certainty": 86, "d_type": "rpc_recon_1to1", "d_type_vname": "File Share Enumeration", "triaged": false, "headend_addr": "255.255.255.1", "dvchost": "255.255.255.1", "href": "https://255.255.255.1/detections/1900?detail_id=66777", "dd_dst_ip": "10.43.0.81", "dd_dst_port": 49668, "dd_dst_dns": "", "dd_bytes_sent": null, "dd_bytes_rcvd": null, "host_name": "IP-192.168.71.1", "host_ip": "192.168.71.1", "dd_proto": "", "vectra_timestamp": "1623742534"}

-: {"version": "6.8", "detection_id": 1900, "category": "RECONNAISSANCE", "severity": 7.0, "threat": 70, "certainty": 86, "d_type": "rpc_recon_1to1", "d_type_vname": "External Remote Access", "triaged": false, "headend_addr": "255.255.255.1", "dvchost": "255.255.255.1", "href": "https://255.255.255.1/detections/1900?detail_id=66777", "dd_dst_ip": "10.43.0.81", "dd_dst_port": 49668, "dd_dst_dns": "", "dd_bytes_sent": null, "dd_bytes_rcvd": null, "host_name": "IP-192.168.71.1", "host_ip": "192.168.71.1", "dd_proto": "", "vectra_timestamp": "1623742534"}

-: {"version": "6.8", "detection_id": 1900, "category": "RECONNAISSANCE", "severity": 7.0, "threat": 70, "certainty": 86, "d_type": "rpc_recon_1to1", "d_type_vname": "Cryptocurrency Mining", "triaged": false, "headend_addr": "255.255.255.1", "dvchost": "255.255.255.1", "href": "https://255.255.255.1/detections/1900?detail_id=66777", "dd_dst_ip": "10.43.0.81", "dd_dst_port": 49668, "dd_dst_dns": "", "dd_bytes_sent": null, "dd_bytes_rcvd": null, "host_name": "IP-192.168.71.1", "host_ip": "192.168.71.1", "dd_proto": "", "vectra_timestamp": "1623742534"}

-: {"version": "6.8", "detection_id": 1900, "category": "RECONNAISSANCE", "severity": 7.0, "threat": 70, "certainty": 86, "d_type": "rpc_recon_1to1", "d_type_vname": "Hidden DNS Tunnel", "triaged": false, "headend_addr": "255.255.255.1", "dvchost": "255.255.255.1", "href": "https://255.255.255.1/detections/1900?detail_id=66777", "dd_dst_ip": "10.43.0.81", "dd_dst_port": 49668, "dd_dst_dns": "", "dd_bytes_sent": null, "dd_bytes_rcvd": null, "host_name": "IP-192.168.71.1", "host_ip": "192.168.71.1", "dd_proto": "", "vectra_timestamp": "1623742534"}

-: {"version": "6.8", "detection_id": 1900, "category": "RECONNAISSANCE", "severity": 7.0, "threat": 70, "certainty": 86, "d_type": "rpc_recon_1to1", "d_type_vname": "TOR Activity", "triaged": false, "headend_addr": "255.255.255.1", "dvchost": "255.255.255.1", "href": "https://255.255.255.1/detections/1900?detail_id=66777", "dd_dst_ip": "10.43.0.81", "dd_dst_port": 49668, "dd_dst_dns": "", "dd_bytes_sent": null, "dd_bytes_rcvd": null, "host_name": "IP-192.168.71.1", "host_ip": "192.168.71.1", "dd_proto": "", "vectra_timestamp": "1623742534"}

-: {"version": "6.8", "detection_id": 1900, "category": "RECONNAISSANCE", "severity": 7.0, "threat": 70, "certainty": 86, "d_type": "rpc_recon_1to1", "d_type_vname": "Hidden HTTPS Tunnel", "triaged": false, "headend_addr": "255.255.255.1", "dvchost": "255.255.255.1", "href": "https://255.255.255.1/detections/1900?detail_id=66777", "dd_dst_ip": "10.43.0.81", "dd_dst_port": 49668, "dd_dst_dns": "", "dd_bytes_sent": null, "dd_bytes_rcvd": null, "host_name": "IP-192.168.71.1", "host_ip": "192.168.71.1", "dd_proto": "", "vectra_timestamp": "1623742534"}

-: {"version": "6.8", "detection_id": 1900, "category": "RECONNAISSANCE", "severity": 7.0, "threat": 70, "certainty": 86, "d_type": "rpc_recon_1to1", "d_type_vname": "Threat Intelligence Match", "triaged": false, "headend_addr": "255.255.255.1", "dvchost": "255.255.255.1", "href": "https://255.255.255.1/detections/1900?detail_id=66777", "dd_dst_ip": "10.43.0.81", "dd_dst_port": 49668, "dd_dst_dns": "", "dd_bytes_sent": null, "dd_bytes_rcvd": null, "host_name": "IP-192.168.71.1", "host_ip": "192.168.71.1", "dd_proto": "", "vectra_timestamp": "1623742534"}

-: {"version": "6.8", "detection_id": 1900, "category": "RECONNAISSANCE", "severity": 7.0, "threat": 70, "certainty": 86, "d_type": "rpc_recon_1to1", "d_type_vname": "Suspicious HTTP", "triaged": false, "headend_addr": "255.255.255.1", "dvchost": "255.255.255.1", "href": "https://255.255.255.1/detections/1900?detail_id=66777", "dd_dst_ip": "10.43.0.81", "dd_dst_port": 49668, "dd_dst_dns": "", "dd_bytes_sent": null, "dd_bytes_rcvd": null, "host_name": "IP-192.168.71.1", "host_ip": "192.168.71.1", "dd_proto": "", "vectra_timestamp": "1623742534"}

-: {"version": "6.8", "detection_id": 1900, "category": "RECONNAISSANCE", "severity": 7.0, "threat": 70, "certainty": 86, "d_type": "rpc_recon_1to1", "d_type_vname": "Suspicious Relay", "triaged": false, "headend_addr": "255.255.255.1", "dvchost": "255.255.255.1", "href": "https://255.255.255.1/detections/1900?detail_id=66777", "dd_dst_ip": "10.43.0.81", "dd_dst_port": 49668, "dd_dst_dns": "", "dd_bytes_sent": null, "dd_bytes_rcvd": null, "host_name": "IP-192.168.71.1", "host_ip": "192.168.71.1", "dd_proto": "", "vectra_timestamp": "1623742534"}

-: {"version": "6.8", "detection_id": 1900, "category": "RECONNAISSANCE", "severity": 7.0, "threat": 70, "certainty": 86, "d_type": "rpc_recon_1to1", "d_type_vname": "Outbound Dos", "triaged": false, "headend_addr": "255.255.255.1", "dvchost": "255.255.255.1", "href": "https://255.255.255.1/detections/1900?detail_id=66777", "dd_dst_ip": "10.43.0.81", "dd_dst_port": 49668, "dd_dst_dns": "", "dd_bytes_sent": null, "dd_bytes_rcvd": null, "host_name": "IP-192.168.71.1", "host_ip": "192.168.71.1", "dd_proto": "", "vectra_timestamp": "1623742534"}

-: {"version": "6.8", "detection_id": 1900, "category": "RECONNAISSANCE", "severity": 7.0, "threat": 70, "certainty": 86, "d_type": "rpc_recon_1to1", "d_type_vname": "Outbound Port Sweep", "triaged": false, "headend_addr": "255.255.255.1", "dvchost": "255.255.255.1", "href": "https://255.255.255.1/detections/1900?detail_id=66777", "dd_dst_ip": "10.43.0.81", "dd_dst_port": 49668, "dd_dst_dns": "", "dd_bytes_sent": null, "dd_bytes_rcvd": null, "host_name": "IP-192.168.71.1", "host_ip": "192.168.71.1", "dd_proto": "", "vectra_timestamp": "1623742534"}

-: {"version": "6.8", "detection_id": 1900, "category": "RECONNAISSANCE", "severity": 7.0, "threat": 70, "certainty": 86, "d_type": "rpc_recon_1to1", "d_type_vname": "Brute-Force", "triaged": false, "headend_addr": "255.255.255.1", "dvchost": "255.255.255.1", "href": "https://255.255.255.1/detections/1900?detail_id=66777", "dd_dst_ip": "10.43.0.81", "dd_dst_port": 49668, "dd_dst_dns": "", "dd_bytes_sent": null, "dd_bytes_rcvd": null, "host_name": "IP-192.168.71.1", "host_ip": "192.168.71.1", "dd_proto": "", "vectra_timestamp": "1623742534"}

-: {"version": "6.8", "detection_id": 1900, "category": "RECONNAISSANCE", "severity": 7.0, "threat": 70, "certainty": 86, "d_type": "rpc_recon_1to1", "d_type_vname": "Ransomware File Activity", "triaged": false, "headend_addr": "255.255.255.1", "dvchost": "255.255.255.1", "href": "https://255.255.255.1/detections/1900?detail_id=66777", "dd_dst_ip": "10.43.0.81", "dd_dst_port": 49668, "dd_dst_dns": "", "dd_bytes_sent": null, "dd_bytes_rcvd": null, "host_name": "IP-192.168.71.1", "host_ip": "192.168.71.1", "dd_proto": "", "vectra_timestamp": "1623742534"}

-: {"version": "6.8", "detection_id": 1900, "category": "RECONNAISSANCE", "severity": 7.0, "threat": 70, "certainty": 86, "d_type": "rpc_recon_1to1", "d_type_vname": "Shell Knocker Client", "triaged": false, "headend_addr": "255.255.255.1", "dvchost": "255.255.255.1", "href": "https://255.255.255.1/detections/1900?detail_id=66777", "dd_dst_ip": "10.43.0.81", "dd_dst_port": 49668, "dd_dst_dns": "", "dd_bytes_sent": null, "dd_bytes_rcvd": null, "host_name": "IP-192.168.71.1", "host_ip": "192.168.71.1", "dd_proto": "", "vectra_timestamp": "1623742534"}

-: {"version": "6.8", "detection_id": 1900, "category": "RECONNAISSANCE", "severity": 7.0, "threat": 70, "certainty": 86, "d_type": "rpc_recon_1to1", "d_type_vname": "SQL Injection Activity", "triaged": false, "headend_addr": "255.255.255.1", "dvchost": "255.255.255.1", "href": "https://255.255.255.1/detections/1900?detail_id=66777", "dd_dst_ip": "10.43.0.81", "dd_dst_port": 49668, "dd_dst_dns": "", "dd_bytes_sent": null, "dd_bytes_rcvd": null, "host_name": "IP-192.168.71.1", "host_ip": "192.168.71.1", "dd_proto": "", "vectra_timestamp": "1623742534"}

-: {"version": "6.8", "detection_id": 1900, "category": "RECONNAISSANCE", "severity": 7.0, "threat": 70, "certainty": 86, "d_type": "rpc_recon_1to1", "d_type_vname": "Suspicious Admin", "triaged": false, "headend_addr": "255.255.255.1", "dvchost": "255.255.255.1", "href": "https://255.255.255.1/detections/1900?detail_id=66777", "dd_dst_ip": "10.43.0.81", "dd_dst_port": 49668, "dd_dst_dns": "", "dd_bytes_sent": null, "dd_bytes_rcvd": null, "host_name": "IP-192.168.71.1", "host_ip": "192.168.71.1", "dd_proto": "", "vectra_timestamp": "1623742534"}

:- {"user":"admin","role":"Super Admin","source_ip":"1.2.3.4","headend_addr":"1.2.3.1","dvchost":"1.2.3.254","version":"7.6","result":"success","message":"create triage filter {\"Type\":\"Alban\",\"enabled\":true,\"context\":{\"host_match_count\":1,\"critical_host_count\":0},\"Detection Category\":\"EXFILTRATION\",\"Detection Type\":\"Smash and Grab\",\"sourceConditions\":{\"OR\":[{\"AND\":[{\"ANY_OF\":{\"label\":\"Host\",\"field\":\"host\",\"values\":[{\"value\":8389,\"label\":\"SOC\"}],\"groups\":[]}}]}]},\"additionalConditions\":{\"OR\":[{\"AND\":[{\"ANY_OF\":{\"label\":\"Destination Domain\",\"field\":\"remote1_dns\",\"values\":[{\"value\":\"dmz.example.org\",\"label\":\"dmz.example.org\"},{\"value\":\"app.sekoia.io\",\"label\":\"app.sekoia.io\"}],\"groups\":[]}}]}]},\"ID\":137,\"Hosts\":[\"SOC\"]}","vectra_timestamp":"1683633677"}

:- {"user":"admin","role":"Super Admin","source_ip":"1.2.3.4","headend_addr":"1.2.3.1","dvchost":"1.2.3.254","version":"7.6","result":"success","message":"create triage filter {\"Type\":\"Proxy\",\"enabled\":true,\"context\":{\"host_match_count\":1,\"critical_host_count\":0},\"Detection Category\":\"COMMAND & CONTROL\",\"Detection Type\":\"Hidden HTTPS Tunnel\",\"sourceConditions\":{\"OR\":[{\"AND\":[{\"ANY_OF\":{\"label\":\"Host\",\"field\":\"host\",\"values\":[{\"value\":8389,\"label\":\"SOC\"}],\"groups\":[]}}]}]},\"additionalConditions\":{\"OR\":[{\"AND\":[{\"ANY_OF\":{\"label\":\"C&CA Server Domain\",\"field\":\"remote1_dns\",\"values\":[{\"value\":\"sedb.example.org\",\"label\":\"sedb.example.org\"}],\"groups\":[]}},{\"ANY_OF\":{\"label\":\"Destination Port\",\"field\":\"remote1_port\",\"values\":[{\"value\":\"443\",\"label\":\"443\"}],\"groups\":[]}}]}]},\"ID\":136,\"Hosts\":[\"SOC\"]}","vectra_timestamp":"1683633677"}

:- {"user":"admin","role":"Super Admin","source_ip":"1.2.3.4","headend_addr":"1.2.3.1","dvchost":"1.2.3.254","version":"7.6","result":"success","message":"edit triage filter \"Alban\" - id 11 Smash and Gab - context changed from \"{'host_match_count': 1, 'critical_host_count': 0}\" to \"{'host_match_count': 2, 'critical_host_count': 0}\"","vectra_timestamp":"1683633677"}

Detection section

The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.

Related Built-in Rules

The following Sekoia.io built-in rules match the intake Vectra Cognito Detect. This documentation is updated automatically and is based solely on the fields used by the intake which are checked against our rules. This means that some rules will be listed but might not be relevant with the intake.

SEKOIA.IO x Vectra Cognito Detect on ATT&CK Navigator

Burp Suite Tool Detected

Burp Suite is a cybersecurity tool. When used as a proxy service, its purpose is to intercept packets and modify them to send them to the server. Burp Collaborator is a network service that Burp Suite uses to help discover many kinds of vulnerabilities (vulnerabilities scanner).

• Effort: intermediate

Correlation Potential DNS Tunnel

Detects domain name which is longer than 95 characters. Long domain names are distinctive of DNS tunnels.

• Effort: advanced

Cryptomining

Detection of domain names potentially related to cryptomining activities.

• Effort: master

Dynamic DNS Contacted

Detect communication with dynamic dns domain. This kind of domain is often used by attackers. This rule can trigger false positive in non-controlled environment because dynamic dns is not always malicious.

• Effort: master

EvilProxy Phishing Domain

Detects subdomains potentially generated by the EvilProxy adversary-in-the-middle phishing platform. Inspect the other subdomains of the domain to identify the landing page, and determine if the user submitted credentials. This rule has a small percentage of false positives on legitimate domains.

• Effort: intermediate

Exfiltration Domain

Detects traffic toward a domain flagged as a possible exfiltration vector.

• Effort: master

Potential DNS Tunnel

Detects domain name which is longer than 95 characters. Long domain names are distinctive of DNS tunnels.

• Effort: advanced

RSA SecurID Failed Authentification

Detects many failed attempts to authenticate followed by a successfull login for a super admin account.

• Effort: advanced

Remote Access Tool Domain

Detects traffic toward a domain flagged as a Remote Administration Tool (RAT).

• Effort: master

Remote Monitoring and Management Software - AnyDesk

Detect artifacts related to the installation or execution of the Remote Monitoring and Management tool AnyDesk.

• Effort: master

Remote Monitoring and Management Software - Atera

Detect artifacts related to the installation or execution of the Remote Monitoring and Management tool Atera.

• Effort: master

SEKOIA.IO Intelligence Feed

Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.

• Effort: elementary

Sekoia.io EICAR Detection

Detects observables in Sekoia.io CTI tagged as EICAR, which are fake samples meant to test detection.

• Effort: master

Suspicious TOR Gateway

Detects suspicious TOR gateways. Gateways are often used by the victim to pay and decrypt the encrypted files without installing TOR. Tor intercepts the network traffic from one or more apps on user’s computer, usually the user web browser, and shuffles it through a number of randomly-chosen computers before passing it on to its destination. This disguises user location, and makes it harder for servers to pick him/her out on repeat visits, or to tie together separate visits to different sites, this making tracking and surveillance more difficult. Before a network packet starts its journey, user’s computer chooses a random list of relays and repeatedly encrypts the data in multiple layers, like an onion. Each relay knows only enough to strip off the outermost layer of encryption, before passing what’s left on to the next relay in the list.

• Effort: advanced

TOR Usage Generic Rule

Detects TOR usage globally, whether the IP is a destination or source. TOR is short for The Onion Router, and it gets its name from how it works. TOR intercepts the network traffic from one or more apps on user’s computer, usually the user web browser, and shuffles it through a number of randomly-chosen computers before passing it on to its destination. This disguises user location, and makes it harder for servers to pick him/her out on repeat visits, or to tie together separate visits to different sites, this making tracking and surveillance more difficult. Before a network packet starts its journey, user’s computer chooses a random list of relays and repeatedly encrypts the data in multiple layers, like an onion. Each relay knows only enough to strip off the outermost layer of encryption, before passing what’s left on to the next relay in the list.

• Effort: master

Telegram Bot API Request

Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind

• Effort: advanced

Vectra General Threat Detection

Vectra Cognito detected a potential threat. This is a very generic rule to raise as much alerts as possible from Vectra detections however RECONNAISSANCE and INFO categories have been removed to avoid spamming.

• Effort: master

Event Categories

The following table lists the data source offered by this integration.

Data Source	Description
Authentication logs	Audit logs are generated for login events,logout events, as well as other user actions that can impact the security posture of the product.

Transformed Events Samples after Ingestion

This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.

vectra_account_scoring.jsonvectra_campaign.jsonvectra_command_control.jsonvectra_host_lockdown.jsonvectra_host_scoring.jsonvectra_info.jsonvectra_lateral_movement.jsonvectra_lockdown.jsonvectra_several_ports_scanned_01.jsonvectra_several_ports_scanned_02.jsonvectra_threat1.jsonvectra_threat1_10.jsonvectra_threat1_11.jsonvectra_threat1_12.jsonvectra_threat1_13.jsonvectra_threat1_14.jsonvectra_threat1_15.jsonvectra_threat1_16.jsonvectra_threat1_17.jsonvectra_threat1_18.jsonvectra_threat1_19.jsonvectra_threat1_2.jsonvectra_threat1_20.jsonvectra_threat1_21.jsonvectra_threat1_22.jsonvectra_threat1_23.jsonvectra_threat1_24.jsonvectra_threat1_25.jsonvectra_threat1_3.jsonvectra_threat1_4.jsonvectra_threat1_5.jsonvectra_threat1_6.jsonvectra_threat1_7.jsonvectra_threat1_8.jsonvectra_threat1_9.jsonvectra_threat2.jsonvectra_threat3.jsonvectra_threat4.json

{
    "message": "- :{\"version\":\"6.12\",\"account_id\":123456,\"headend_addr\":\"198.51.100.94\",\"account_uid\":\"admin-prtg@company.local\",\"threat\":0,\"certainty\":0,\"score_decreases\":true,\"privilege\":4,\"href\":\"https:/198.51.100.94/accounts/522\",\"category\":\"ACCOUNT SCORING\",\"tags\":[],\"host_access_history\":[{\"id\":22235,\"name\":\"HOSTNAME.COMPANY.LOCAL\",\"privilege\":null,\"privilegeCategory\":null,\"lastSeen\":\"2021-09-30T08:06:46+00:00\"}],\"service_access_history\":[{\"id\":1470943,\"uid\":\"cifs/serssq01.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T08:06:46+00:00\"},{\"id\":5,\"uid\":\"krbtgt/company.local.company@company\",\"privilege\":null,\"privilegeCategory\":null,\"lastSeen\":\"2021-09-30T08:04:19+00:00\"},{\"id\":2614295,\"uid\":\"rpcss/host109.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T08:04:19+00:00\"},{\"id\":2614304,\"uid\":\"rpcss/host2db01.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T08:04:04+00:00\"},{\"id\":2614297,\"uid\":\"rpcss/host110.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T07:57:44+00:00\"},{\"id\":990,\"uid\":\"rpcss/srv-appli02.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T07:54:04+00:00\"},{\"id\":2614303,\"uid\":\"rpcss/host201.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T07:37:28+00:00\"},{\"id\":4214403,\"uid\":\"http/alm.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T07:21:04+00:00\"},{\"id\":4186134,\"uid\":\"http/host109.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T07:20:50+00:00\"},{\"id\":3693289,\"uid\":\"http/host110.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T07:20:38+00:00\"}],\"last_detection_type\":\"Privilege Anomaly: Unusual Service - Insider\",\"vectra_timestamp\":\"1633338457\"}",
    "event": {
        "action": "ACCOUNT SCORING",
        "url": "https:/198.51.100.94/accounts/522"
    },
    "observer": {
        "ip": "198.51.100.94",
        "version": "6.12"
    },
    "related": {
        "ip": [
            "198.51.100.94"
        ]
    },
    "vectra": {
        "account": {
            "id": 123456,
            "uid": "admin-prtg@company.local"
        },
        "certainty": 0,
        "detection": {
            "last_type": "Privilege Anomaly: Unusual Service - Insider",
            "score_decreases": true,
            "tags": []
        },
        "history": {
            "host_access": [
                {
                    "id": 22235,
                    "lastSeen": "2021-09-30T08:06:46+00:00",
                    "name": "HOSTNAME.COMPANY.LOCAL",
                    "privilege": null,
                    "privilegeCategory": null
                }
            ],
            "host_access_hostname": [
                "HOSTNAME.COMPANY.LOCAL"
            ],
            "service_access": [
                {
                    "id": 1470943,
                    "lastSeen": "2021-09-30T08:06:46+00:00",
                    "privilege": 4,
                    "privilegeCategory": "Medium",
                    "uid": "cifs/serssq01.company.local@company.local"
                },
                {
                    "id": 5,
                    "lastSeen": "2021-09-30T08:04:19+00:00",
                    "privilege": null,
                    "privilegeCategory": null,
                    "uid": "krbtgt/company.local.company@company"
                },
                {
                    "id": 2614295,
                    "lastSeen": "2021-09-30T08:04:19+00:00",
                    "privilege": 4,
                    "privilegeCategory": "Medium",
                    "uid": "rpcss/host109.company.local@company.local"
                },
                {
                    "id": 2614304,
                    "lastSeen": "2021-09-30T08:04:04+00:00",
                    "privilege": 4,
                    "privilegeCategory": "Medium",
                    "uid": "rpcss/host2db01.company.local@company.local"
                },
                {
                    "id": 2614297,
                    "lastSeen": "2021-09-30T07:57:44+00:00",
                    "privilege": 4,
                    "privilegeCategory": "Medium",
                    "uid": "rpcss/host110.company.local@company.local"
                },
                {
                    "id": 990,
                    "lastSeen": "2021-09-30T07:54:04+00:00",
                    "privilege": 4,
                    "privilegeCategory": "Medium",
                    "uid": "rpcss/srv-appli02.company.local@company.local"
                },
                {
                    "id": 2614303,
                    "lastSeen": "2021-09-30T07:37:28+00:00",
                    "privilege": 4,
                    "privilegeCategory": "Medium",
                    "uid": "rpcss/host201.company.local@company.local"
                },
                {
                    "id": 4214403,
                    "lastSeen": "2021-09-30T07:21:04+00:00",
                    "privilege": 4,
                    "privilegeCategory": "Medium",
                    "uid": "http/alm.company.local@company.local"
                },
                {
                    "id": 4186134,
                    "lastSeen": "2021-09-30T07:20:50+00:00",
                    "privilege": 4,
                    "privilegeCategory": "Medium",
                    "uid": "http/host109.company.local@company.local"
                },
                {
                    "id": 3693289,
                    "lastSeen": "2021-09-30T07:20:38+00:00",
                    "privilege": 4,
                    "privilegeCategory": "Medium",
                    "uid": "http/host110.company.local@company.local"
                }
            ],
            "service_access_uid": {
                "host": [
                    "alm.company.local@company.local",
                    "company.local.company@company",
                    "host109.company.local@company.local",
                    "host109.company.local@company.local",
                    "host110.company.local@company.local",
                    "host110.company.local@company.local",
                    "host201.company.local@company.local",
                    "host2db01.company.local@company.local",
                    "serssq01.company.local@company.local",
                    "srv-appli02.company.local@company.local"
                ],
                "proto_host": [
                    "cifs/serssq01.company.local@company.local",
                    "http/alm.company.local@company.local",
                    "http/host109.company.local@company.local",
                    "http/host110.company.local@company.local",
                    "krbtgt/company.local.company@company",
                    "rpcss/host109.company.local@company.local",
                    "rpcss/host110.company.local@company.local",
                    "rpcss/host201.company.local@company.local",
                    "rpcss/host2db01.company.local@company.local",
                    "rpcss/srv-appli02.company.local@company.local"
                ]
            }
        },
        "risk_score_norm": 0,
        "timestamp": 1633338457,
        "user": {
            "privilege": 4
        }
    }
}

{
    "message": "-: {\"src_name\": \"IP-255.255.255.1\", \"src_ip\": \"255.255.255.1\", \"src_hid\": 11111, \"dest_name\": \"push.services.mozilla.com\", \"dest_ip\": \"255.255.255.2\", \"dest_id\": \"external\", \"timestamp\": 1111111222.0, \"campaign_name\": \"push.services.mozilla.com-13\", \"campaign_id\": 222, \"campaign_link\": \"https://255.255.255.3/campaigns/222\", \"action\": \"ADD\", \"reason\": \"Connection\", \"version\": \"6.8\", \"headend_addr\": \"255.255.255.3\", \"dvchost\": \"255.255.255.3\", \"vectra_timestamp\": \"1111111111\"}",
    "action": {
        "name": "ADD"
    },
    "destination": {
        "address": "255.255.255.2",
        "ip": "255.255.255.2"
    },
    "observer": {
        "ip": "255.255.255.3",
        "name": "255.255.255.3",
        "version": "6.8"
    },
    "related": {
        "ip": [
            "255.255.255.1",
            "255.255.255.2",
            "255.255.255.3"
        ]
    },
    "source": {
        "address": "255.255.255.1",
        "ip": "255.255.255.1"
    },
    "vectra": {
        "campaign": {
            "id": 222,
            "link": "https://255.255.255.3/campaigns/222",
            "name": "push.services.mozilla.com-13"
        },
        "destination": {
            "id": "external",
            "name": "push.services.mozilla.com"
        },
        "detection": {
            "reason": "Connection"
        },
        "source": {
            "hid": 11111,
            "name": "IP-255.255.255.1"
        },
        "timestamp": 1111111111
    }
}

{
    "message": "-: {\"version\": \"6.12\", \"detection_id\": 13281, \"category\": \"COMMAND & CONTROL\", \"severity\": 6.0, \"threat\": 60, \"certainty\": 72, \"d_type\": \"hidden_http_tunnel_cnc\", \"d_type_vname\": \"Hidden HTTP Tunnel\", \"triaged\": false, \"headend_addr\": \"198.51.100.94\", \"dvchost\": \"198.51.100.94\", \"href\": \"https://198.51.100.94/detections/13281?detail_id=94738\", \"dd_dst_ip\": \"198.51.100.1\", \"dd_dst_port\": 8002, \"dd_dst_dns\": \"mirror.centos.org\", \"dd_bytes_sent\": 1476677, \"dd_bytes_rcvd\": 8269214038, \"host_name\": \"IP-198.51.100.14\", \"host_ip\": \"198.51.100.14\", \"dd_proto\": \"tcp\", \"vectra_timestamp\": \"1633516306\"}",
    "event": {
        "action": "COMMAND & CONTROL",
        "url": "https://198.51.100.94/detections/13281?detail_id=94738"
    },
    "destination": {
        "address": "mirror.centos.org",
        "bytes": 8269214038,
        "domain": "mirror.centos.org",
        "ip": "198.51.100.1",
        "port": 8002,
        "registered_domain": "centos.org",
        "subdomain": "mirror",
        "top_level_domain": "org"
    },
    "host": {
        "ip": "198.51.100.14",
        "name": "IP-198.51.100.14"
    },
    "network": {
        "protocol": "tcp"
    },
    "observer": {
        "ip": "198.51.100.94",
        "name": "198.51.100.94",
        "version": "6.12"
    },
    "related": {
        "hosts": [
            "mirror.centos.org"
        ],
        "ip": [
            "198.51.100.1",
            "198.51.100.14",
            "198.51.100.94"
        ]
    },
    "source": {
        "bytes": 1476677
    },
    "vectra": {
        "certainty": 72,
        "detection": {
            "id": 13281,
            "name": "Hidden HTTP Tunnel",
            "type": "hidden_http_tunnel_cnc"
        },
        "risk_score_norm": 60,
        "severity": 6.0,
        "timestamp": 1633516306,
        "triaged": false
    }
}

{
    "message": "- :{\"type\":\"some-type\",\"version\":\"6.12\",\"account_id\":123456,\"headend_addr\":\"198.51.100.94\",\"account_uid\":\"admin-prtg@company.local\",\"threat\":0,\"certainty\":0,\"score_decreases\":true,\"privilege\":4,\"href\":\"https:/198.51.100.94/accounts/522\",\"category\":\"HOST_LOCKDOWN\",\"tags\":[],\"host_access_history\":[{\"id\":22235,\"name\":\"HOSTNAME.COMPANY.LOCAL\",\"privilege\":null,\"privilegeCategory\":null,\"lastSeen\":\"2021-09-30T08:06:46+00:00\"}],\"service_access_history\":[{\"id\":1470943,\"uid\":\"cifs/serssq01.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T08:06:46+00:00\"},{\"id\":5,\"uid\":\"krbtgt/company.local.company@company\",\"privilege\":null,\"privilegeCategory\":null,\"lastSeen\":\"2021-09-30T08:04:19+00:00\"},{\"id\":2614295,\"uid\":\"rpcss/host109.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T08:04:19+00:00\"},{\"id\":2614304,\"uid\":\"rpcss/host2db01.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T08:04:04+00:00\"},{\"id\":2614297,\"uid\":\"rpcss/host110.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T07:57:44+00:00\"},{\"id\":990,\"uid\":\"rpcss/srv-appli02.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T07:54:04+00:00\"},{\"id\":2614303,\"uid\":\"rpcss/host201.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T07:37:28+00:00\"},{\"id\":4214403,\"uid\":\"http/alm.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T07:21:04+00:00\"},{\"id\":4186134,\"uid\":\"http/host109.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T07:20:50+00:00\"},{\"id\":3693289,\"uid\":\"http/host110.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T07:20:38+00:00\"}],\"last_detection_type\":\"Privilege Anomaly: Unusual Service - Insider\",\"vectra_timestamp\":\"1633338457\"}",
    "event": {
        "action": "some-type",
        "url": "https:/198.51.100.94/accounts/522"
    },
    "observer": {
        "ip": "198.51.100.94",
        "version": "6.12"
    },
    "related": {
        "ip": [
            "198.51.100.94"
        ]
    },
    "vectra": {
        "timestamp": 1633338457
    }
}

{
    "message": "-: {\"version\": \"6.12\", \"host_id\": 27617, \"headend_addr\": \"198.51.100.94\", \"host_name\": \"IP-198.51.100.14\", \"dvchost\": \"198.51.100.94\", \"host_ip\": \"198.51.100.14\", \"threat\": 22, \"certainty\": 31, \"privilege\": 0, \"score_decreases\": false, \"href\": \"https://198.51.100.94/hosts/27617\", \"host_roles\": \"\", \"src_key_asset\": false, \"dst_key_asset\": false, \"category\": \"HOST SCORING\", \"sensor\": \"E123456789123456\", \"detection_profile\": {\"name\": \"saas\", \"vname\": \"Cloud Services\", \"scoringDetections\": [\"Hidden HTTP Tunnel (C&C)\"]}, \"host_groups\": [], \"tags\": [], \"account_access_history\": [], \"service_access_history\": [], \"mac_address\": null, \"mac_vendor\": null, \"last_detection_type\": \"Hidden HTTP Tunnel\", \"vectra_timestamp\": \"1633690973\"}",
    "event": {
        "action": "HOST SCORING",
        "url": "https://198.51.100.94/hosts/27617"
    },
    "host": {
        "id": "27617",
        "ip": "198.51.100.14",
        "name": "IP-198.51.100.14"
    },
    "observer": {
        "ip": "198.51.100.94",
        "name": "198.51.100.94",
        "product": "E123456789123456",
        "version": "6.12"
    },
    "related": {
        "ip": [
            "198.51.100.14",
            "198.51.100.94"
        ]
    },
    "vectra": {
        "certainty": 31,
        "destination": {
            "key_asset": false
        },
        "detection": {
            "last_type": "Hidden HTTP Tunnel",
            "profile": {
                "name": "saas",
                "scoringDetections": [
                    "Hidden HTTP Tunnel (C&C)"
                ],
                "vname": "Cloud Services"
            },
            "score_decreases": false,
            "tags": []
        },
        "history": {
            "account_access": [],
            "service_access": []
        },
        "host": {
            "group": []
        },
        "risk_score_norm": 22,
        "source": {
            "key_asset": false
        },
        "timestamp": 1633690973,
        "user": {
            "privilege": 0
        }
    }
}

{
    "message": "-: {\"category\": \"INFO\", \"certainty\": 0, \"d_type\": \"si_new_host\", \"d_type_vname\": \"New Host\", \"dd_bytes_rcvd\": null, \"dd_bytes_sent\": null, \"dd_dst_dns\": \"\", \"dd_dst_ip\": \"0.0.0.0\", \"dd_dst_port\": 80, \"dd_proto\": \"\", \"detection_id\": 9999, \"dvchost\": \"255.255.255.1\", \"headend_addr\": \"255.255.255.1\", \"host_ip\": \"10.0.0.1\", \"host_name\": \"plop-99\", \"href\": \"https://255.255.255.1/detections/9999?detail_id=11111\", \"severity\": 0, \"threat\": 0, \"triaged\": false, \"vectra_timestamp\": \"1099999999\", \"version\": \"6.7\"}",
    "event": {
        "action": "INFO",
        "url": "https://255.255.255.1/detections/9999?detail_id=11111"
    },
    "destination": {
        "address": "0.0.0.0",
        "ip": "0.0.0.0",
        "port": 80
    },
    "host": {
        "ip": "10.0.0.1",
        "name": "plop-99"
    },
    "observer": {
        "ip": "255.255.255.1",
        "name": "255.255.255.1",
        "version": "6.7"
    },
    "related": {
        "ip": [
            "0.0.0.0",
            "10.0.0.1",
            "255.255.255.1"
        ]
    },
    "vectra": {
        "certainty": 0,
        "detection": {
            "id": 9999,
            "name": "New Host",
            "type": "si_new_host"
        },
        "risk_score_norm": 0,
        "severity": 0,
        "timestamp": 1099999999,
        "triaged": false
    }
}

{
    "message": "-: {\"accounts\": \"user@company.net\", \"shares\": \"\", \"reason\": \"MORE_PROCESSING_REQUIRED\", \"count\": 295, \"version\": \"6.12\", \"detection_id\": 13295, \"category\": \"LATERAL MOVEMENT\", \"severity\": 2.0, \"threat\": 20, \"certainty\": 74, \"d_type\": \"smb_brute_force\", \"d_type_vname\": \"SMB Brute-Force\", \"triaged\": false, \"headend_addr\": \"198.51.100.94\", \"dvchost\": \"198.51.100.94\", \"href\": \"https://198.51.100.94/detections/13295?detail_id=94908\", \"dd_dst_ip\": \"198.51.100.38\", \"dd_dst_port\": 445, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": null, \"dd_bytes_rcvd\": null, \"host_name\": \"hostname\", \"host_ip\": \"198.51.100.155\", \"dd_proto\": \"\", \"vectra_timestamp\": \"1633681756\"}",
    "event": {
        "action": "LATERAL MOVEMENT",
        "url": "https://198.51.100.94/detections/13295?detail_id=94908"
    },
    "destination": {
        "address": "198.51.100.38",
        "ip": "198.51.100.38",
        "port": 445
    },
    "host": {
        "ip": "198.51.100.155",
        "name": "hostname"
    },
    "observer": {
        "ip": "198.51.100.94",
        "name": "198.51.100.94",
        "version": "6.12"
    },
    "related": {
        "ip": [
            "198.51.100.155",
            "198.51.100.38",
            "198.51.100.94"
        ]
    },
    "vectra": {
        "certainty": 74,
        "detection": {
            "accounts": "user@company.net",
            "count": "295",
            "id": 13295,
            "name": "SMB Brute-Force",
            "reason": "MORE_PROCESSING_REQUIRED",
            "type": "smb_brute_force"
        },
        "risk_score_norm": 20,
        "severity": 2.0,
        "timestamp": 1633681756,
        "triaged": false
    }
}

{
    "message": "- :{\"version\":\"6.12\",\"account_id\":123456,\"headend_addr\":\"198.51.100.94\",\"account_uid\":\"admin-prtg@company.local\",\"threat\":0,\"certainty\":0,\"score_decreases\":true,\"privilege\":4,\"href\":\"https:/198.51.100.94/accounts/522\",\"category\":\"LOCKDOWN\",\"tags\":[],\"host_access_history\":[{\"id\":22235,\"name\":\"HOSTNAME.COMPANY.LOCAL\",\"privilege\":null,\"privilegeCategory\":null,\"lastSeen\":\"2021-09-30T08:06:46+00:00\"}],\"service_access_history\":[{\"id\":1470943,\"uid\":\"cifs/serssq01.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T08:06:46+00:00\"},{\"id\":5,\"uid\":\"krbtgt/company.local.company@company\",\"privilege\":null,\"privilegeCategory\":null,\"lastSeen\":\"2021-09-30T08:04:19+00:00\"},{\"id\":2614295,\"uid\":\"rpcss/host109.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T08:04:19+00:00\"},{\"id\":2614304,\"uid\":\"rpcss/host2db01.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T08:04:04+00:00\"},{\"id\":2614297,\"uid\":\"rpcss/host110.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T07:57:44+00:00\"},{\"id\":990,\"uid\":\"rpcss/srv-appli02.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T07:54:04+00:00\"},{\"id\":2614303,\"uid\":\"rpcss/host201.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T07:37:28+00:00\"},{\"id\":4214403,\"uid\":\"http/alm.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T07:21:04+00:00\"},{\"id\":4186134,\"uid\":\"http/host109.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T07:20:50+00:00\"},{\"id\":3693289,\"uid\":\"http/host110.company.local@company.local\",\"privilege\":4,\"privilegeCategory\":\"Medium\",\"lastSeen\":\"2021-09-30T07:20:38+00:00\"}],\"last_detection_type\":\"Privilege Anomaly: Unusual Service - Insider\",\"vectra_timestamp\":\"1633338457\"}",
    "event": {
        "action": "LOCKDOWN",
        "url": "https:/198.51.100.94/accounts/522"
    },
    "observer": {
        "ip": "198.51.100.94",
        "version": "6.12"
    },
    "related": {
        "ip": [
            "198.51.100.94"
        ]
    },
    "vectra": {
        "account": {
            "id": 123456
        },
        "timestamp": 1633338457
    }
}

{
    "message": "-: {\"ports\": \"7-9,13,21-26,37,53,79-81,88,106,110-113,119,135,139-144,179,199,389,427,443-445,465,513-515,543-544,548,554,587,631,646,873,990,993-995,1025-1029,1110,1433,1720,1723,1755,1900,2000-2001,2049,2121,2717,3000,3128,3306,3389,3986,4899,5000,5009,5051,5060,5101,5190,5357,5432,5631,5666,5800,5900,6000-6001,6646,7070,8000,8008-8009,8080-8081,8443,8888,9100,9999-10000,32768,49152-49157\", \"scans\": 100, \"successes\": 0, \"version\": \"8.5\", \"detection_id\": 85003, \"category\": \"RECONNAISSANCE\", \"severity\": 0, \"threat\": 0, \"certainty\": 0, \"d_type\": \"port_scan\", \"d_type_vname\": \"Port Scan\", \"triaged\": true, \"headend_addr\": \"1.2.3.4\", \"dvchost\": \"1.2.3.4\", \"href\": \"https://1.2.3.4/detections/85003?detail_id=2029813\", \"dd_dst_ip\": \"5.6.7.8\", \"dd_dst_port\": 0, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": 0, \"dd_bytes_rcvd\": 0, \"mitre\": [\"T1046\", \"T1018\", \"T1072\"], \"host_name\": \"host\", \"host_ip\": \"3.4.5.6\", \"dd_proto\": \"tcp\", \"vectra_timestamp\": \"1721184242\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://1.2.3.4/detections/85003?detail_id=2029813"
    },
    "destination": {
        "address": "5.6.7.8",
        "ip": "5.6.7.8",
        "port": 0
    },
    "host": {
        "ip": "3.4.5.6",
        "name": "host"
    },
    "network": {
        "protocol": "tcp"
    },
    "observer": {
        "ip": "1.2.3.4",
        "name": "1.2.3.4",
        "version": "8.5"
    },
    "related": {
        "ip": [
            "1.2.3.4",
            "3.4.5.6",
            "5.6.7.8"
        ]
    },
    "vectra": {
        "certainty": 0,
        "detection": {
            "id": 85003,
            "name": "Port Scan",
            "ports": "7-9,13,21-26,37,53,79-81,88,106,110-113,119,135,139-144,179,199,389,427,443-445,465,513-515,543-544,548,554,587,631,646,873,990,993-995,1025-1029,1110,1433,1720,1723,1755,1900,2000-2001,2049,2121,2717,3000,3128,3306,3389,3986,4899,5000,5009,5051,5060,5101,5190,5357,5432,5631,5666,5800,5900,6000-6001,6646,7070,8000,8008-8009,8080-8081,8443,8888,9100,9999-10000,32768,49152-49157",
            "scans": "100",
            "successes": "0",
            "type": "port_scan"
        },
        "risk_score_norm": 0,
        "severity": 0,
        "timestamp": 1721184242,
        "triaged": true
    }
}

{
    "message": "-: {\"ports\": \"7-9,13,21-26,37,53,79-81,88,106,110-113,119,135,139-144,179,199,389,427,443-445,465,513-515,543-544,548,554,587,631,646,873,990,993-995,1025-1029,1110,1433,1720,1723,1755,1900,2000-2001,2049,2121,2717,3000,3128,3306,3389,3986,4899,5000,5009,5051,5060,5101,5190,5357,5432,5631,5666,5800,5900,6000-6001,6646,7070,8000,8008-8009,8080-8081,8443,8888,9100,9999-10000,32768,49152-49157\", \"scans\": 100, \"successes\": 0, \"version\": \"8.5\", \"detection_id\": 85003, \"category\": \"RECONNAISSANCE\", \"severity\": 0, \"threat\": 0, \"certainty\": 0, \"d_type\": \"port_scan\", \"d_type_vname\": \"Port Scan\", \"triaged\": true, \"headend_addr\": \"1.2.3.4\", \"dvchost\": \"1.2.3.4\", \"href\": \"https://1.2.3.4/detections/85003?detail_id=2029784\", \"dd_dst_ip\": \"5.6.7.8\", \"dd_dst_port\": 0, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": 0, \"dd_bytes_rcvd\": 0, \"mitre\": [\"T1046\", \"T1018\", \"T1072\"], \"host_name\": \"host\", \"host_ip\": \"3.4.5.6\", \"dd_proto\": \"tcp\", \"vectra_timestamp\": \"1721183706\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://1.2.3.4/detections/85003?detail_id=2029784"
    },
    "destination": {
        "address": "5.6.7.8",
        "ip": "5.6.7.8",
        "port": 0
    },
    "host": {
        "ip": "3.4.5.6",
        "name": "host"
    },
    "network": {
        "protocol": "tcp"
    },
    "observer": {
        "ip": "1.2.3.4",
        "name": "1.2.3.4",
        "version": "8.5"
    },
    "related": {
        "ip": [
            "1.2.3.4",
            "3.4.5.6",
            "5.6.7.8"
        ]
    },
    "vectra": {
        "certainty": 0,
        "detection": {
            "id": 85003,
            "name": "Port Scan",
            "ports": "7-9,13,21-26,37,53,79-81,88,106,110-113,119,135,139-144,179,199,389,427,443-445,465,513-515,543-544,548,554,587,631,646,873,990,993-995,1025-1029,1110,1433,1720,1723,1755,1900,2000-2001,2049,2121,2717,3000,3128,3306,3389,3986,4899,5000,5009,5051,5060,5101,5190,5357,5432,5631,5666,5800,5900,6000-6001,6646,7070,8000,8008-8009,8080-8081,8443,8888,9100,9999-10000,32768,49152-49157",
            "scans": "100",
            "successes": "0",
            "type": "port_scan"
        },
        "risk_score_norm": 0,
        "severity": 0,
        "timestamp": 1721183706,
        "triaged": true
    }
}

{
    "message": "-: {\"version\": \"6.8\", \"detection_id\": 1900, \"category\": \"RECONNAISSANCE\", \"severity\": 7.0, \"threat\": 70, \"certainty\": 86, \"d_type\": \"rpc_recon_1to1\", \"d_type_vname\": \"RPC Targeted Recon\", \"triaged\": false, \"headend_addr\": \"255.255.255.1\", \"dvchost\": \"255.255.255.1\", \"href\": \"https://255.255.255.1/detections/1900?detail_id=66777\", \"dd_dst_ip\": \"10.43.0.81\", \"dd_dst_port\": 49668, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": null, \"dd_bytes_rcvd\": null, \"host_name\": \"IP-192.168.71.1\", \"host_ip\": \"192.168.71.1\", \"dd_proto\": \"\", \"vectra_timestamp\": \"1623742534\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://255.255.255.1/detections/1900?detail_id=66777"
    },
    "destination": {
        "address": "10.43.0.81",
        "ip": "10.43.0.81",
        "port": 49668
    },
    "host": {
        "ip": "192.168.71.1",
        "name": "IP-192.168.71.1"
    },
    "observer": {
        "ip": "255.255.255.1",
        "name": "255.255.255.1",
        "version": "6.8"
    },
    "related": {
        "ip": [
            "10.43.0.81",
            "192.168.71.1",
            "255.255.255.1"
        ]
    },
    "vectra": {
        "certainty": 86,
        "detection": {
            "id": 1900,
            "name": "RPC Targeted Recon",
            "type": "rpc_recon_1to1"
        },
        "risk_score_norm": 70,
        "severity": 7.0,
        "timestamp": 1623742534,
        "triaged": false
    }
}

{
    "message": "-: {\"version\": \"6.8\", \"detection_id\": 1900, \"category\": \"RECONNAISSANCE\", \"severity\": 7.0, \"threat\": 70, \"certainty\": 86, \"d_type\": \"rpc_recon_1to1\", \"d_type_vname\": \"Suspicious Remote Desktop\", \"triaged\": false, \"headend_addr\": \"255.255.255.1\", \"dvchost\": \"255.255.255.1\", \"href\": \"https://255.255.255.1/detections/1900?detail_id=66777\", \"dd_dst_ip\": \"10.43.0.81\", \"dd_dst_port\": 49668, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": null, \"dd_bytes_rcvd\": null, \"host_name\": \"IP-192.168.71.1\", \"host_ip\": \"192.168.71.1\", \"dd_proto\": \"\", \"vectra_timestamp\": \"1623742534\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://255.255.255.1/detections/1900?detail_id=66777"
    },
    "destination": {
        "address": "10.43.0.81",
        "ip": "10.43.0.81",
        "port": 49668
    },
    "host": {
        "ip": "192.168.71.1",
        "name": "IP-192.168.71.1"
    },
    "observer": {
        "ip": "255.255.255.1",
        "name": "255.255.255.1",
        "version": "6.8"
    },
    "related": {
        "ip": [
            "10.43.0.81",
            "192.168.71.1",
            "255.255.255.1"
        ]
    },
    "vectra": {
        "certainty": 86,
        "detection": {
            "id": 1900,
            "name": "Suspicious Remote Desktop",
            "type": "rpc_recon_1to1"
        },
        "risk_score_norm": 70,
        "severity": 7.0,
        "timestamp": 1623742534,
        "triaged": false
    }
}

{
    "message": "-: {\"version\": \"6.8\", \"detection_id\": 1900, \"category\": \"RECONNAISSANCE\", \"severity\": 7.0, \"threat\": 70, \"certainty\": 86, \"d_type\": \"rpc_recon_1to1\", \"d_type_vname\": \"Suspicious Remote Execution\", \"triaged\": false, \"headend_addr\": \"255.255.255.1\", \"dvchost\": \"255.255.255.1\", \"href\": \"https://255.255.255.1/detections/1900?detail_id=66777\", \"dd_dst_ip\": \"10.43.0.81\", \"dd_dst_port\": 49668, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": null, \"dd_bytes_rcvd\": null, \"host_name\": \"IP-192.168.71.1\", \"host_ip\": \"192.168.71.1\", \"dd_proto\": \"\", \"vectra_timestamp\": \"1623742534\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://255.255.255.1/detections/1900?detail_id=66777"
    },
    "destination": {
        "address": "10.43.0.81",
        "ip": "10.43.0.81",
        "port": 49668
    },
    "host": {
        "ip": "192.168.71.1",
        "name": "IP-192.168.71.1"
    },
    "observer": {
        "ip": "255.255.255.1",
        "name": "255.255.255.1",
        "version": "6.8"
    },
    "related": {
        "ip": [
            "10.43.0.81",
            "192.168.71.1",
            "255.255.255.1"
        ]
    },
    "vectra": {
        "certainty": 86,
        "detection": {
            "id": 1900,
            "name": "Suspicious Remote Execution",
            "type": "rpc_recon_1to1"
        },
        "risk_score_norm": 70,
        "severity": 7.0,
        "timestamp": 1623742534,
        "triaged": false
    }
}

{
    "message": "-: {\"version\": \"6.8\", \"detection_id\": 1900, \"category\": \"RECONNAISSANCE\", \"severity\": 7.0, \"threat\": 70, \"certainty\": 86, \"d_type\": \"rpc_recon_1to1\", \"d_type_vname\": \"Internal Stage Loader\", \"triaged\": false, \"headend_addr\": \"255.255.255.1\", \"dvchost\": \"255.255.255.1\", \"href\": \"https://255.255.255.1/detections/1900?detail_id=66777\", \"dd_dst_ip\": \"10.43.0.81\", \"dd_dst_port\": 49668, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": null, \"dd_bytes_rcvd\": null, \"host_name\": \"IP-192.168.71.1\", \"host_ip\": \"192.168.71.1\", \"dd_proto\": \"\", \"vectra_timestamp\": \"1623742534\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://255.255.255.1/detections/1900?detail_id=66777"
    },
    "destination": {
        "address": "10.43.0.81",
        "ip": "10.43.0.81",
        "port": 49668
    },
    "host": {
        "ip": "192.168.71.1",
        "name": "IP-192.168.71.1"
    },
    "observer": {
        "ip": "255.255.255.1",
        "name": "255.255.255.1",
        "version": "6.8"
    },
    "related": {
        "ip": [
            "10.43.0.81",
            "192.168.71.1",
            "255.255.255.1"
        ]
    },
    "vectra": {
        "certainty": 86,
        "detection": {
            "id": 1900,
            "name": "Internal Stage Loader",
            "type": "rpc_recon_1to1"
        },
        "risk_score_norm": 70,
        "severity": 7.0,
        "timestamp": 1623742534,
        "triaged": false
    }
}

{
    "message": "-: {\"version\": \"6.8\", \"detection_id\": 1900, \"category\": \"RECONNAISSANCE\", \"severity\": 7.0, \"threat\": 70, \"certainty\": 86, \"d_type\": \"rpc_recon_1to1\", \"d_type_vname\": \"Suspicious LDAP Query\", \"triaged\": false, \"headend_addr\": \"255.255.255.1\", \"dvchost\": \"255.255.255.1\", \"href\": \"https://255.255.255.1/detections/1900?detail_id=66777\", \"dd_dst_ip\": \"10.43.0.81\", \"dd_dst_port\": 49668, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": null, \"dd_bytes_rcvd\": null, \"host_name\": \"IP-192.168.71.1\", \"host_ip\": \"192.168.71.1\", \"dd_proto\": \"\", \"vectra_timestamp\": \"1623742534\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://255.255.255.1/detections/1900?detail_id=66777"
    },
    "destination": {
        "address": "10.43.0.81",
        "ip": "10.43.0.81",
        "port": 49668
    },
    "host": {
        "ip": "192.168.71.1",
        "name": "IP-192.168.71.1"
    },
    "observer": {
        "ip": "255.255.255.1",
        "name": "255.255.255.1",
        "version": "6.8"
    },
    "related": {
        "ip": [
            "10.43.0.81",
            "192.168.71.1",
            "255.255.255.1"
        ]
    },
    "vectra": {
        "certainty": 86,
        "detection": {
            "id": 1900,
            "name": "Suspicious LDAP Query",
            "type": "rpc_recon_1to1"
        },
        "risk_score_norm": 70,
        "severity": 7.0,
        "timestamp": 1623742534,
        "triaged": false
    }
}

{
    "message": "-: {\"version\": \"6.8\", \"detection_id\": 1900, \"category\": \"RECONNAISSANCE\", \"severity\": 7.0, \"threat\": 70, \"certainty\": 86, \"d_type\": \"rpc_recon_1to1\", \"d_type_vname\": \"RPC Recon\", \"triaged\": false, \"headend_addr\": \"255.255.255.1\", \"dvchost\": \"255.255.255.1\", \"href\": \"https://255.255.255.1/detections/1900?detail_id=66777\", \"dd_dst_ip\": \"10.43.0.81\", \"dd_dst_port\": 49668, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": null, \"dd_bytes_rcvd\": null, \"host_name\": \"IP-192.168.71.1\", \"host_ip\": \"192.168.71.1\", \"dd_proto\": \"\", \"vectra_timestamp\": \"1623742534\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://255.255.255.1/detections/1900?detail_id=66777"
    },
    "destination": {
        "address": "10.43.0.81",
        "ip": "10.43.0.81",
        "port": 49668
    },
    "host": {
        "ip": "192.168.71.1",
        "name": "IP-192.168.71.1"
    },
    "observer": {
        "ip": "255.255.255.1",
        "name": "255.255.255.1",
        "version": "6.8"
    },
    "related": {
        "ip": [
            "10.43.0.81",
            "192.168.71.1",
            "255.255.255.1"
        ]
    },
    "vectra": {
        "certainty": 86,
        "detection": {
            "id": 1900,
            "name": "RPC Recon",
            "type": "rpc_recon_1to1"
        },
        "risk_score_norm": 70,
        "severity": 7.0,
        "timestamp": 1623742534,
        "triaged": false
    }
}

{
    "message": "-: {\"version\": \"6.8\", \"detection_id\": 1900, \"category\": \"RECONNAISSANCE\", \"severity\": 7.0, \"threat\": 70, \"certainty\": 86, \"d_type\": \"rpc_recon_1to1\", \"d_type_vname\": \"RDP Recon\", \"triaged\": false, \"headend_addr\": \"255.255.255.1\", \"dvchost\": \"255.255.255.1\", \"href\": \"https://255.255.255.1/detections/1900?detail_id=66777\", \"dd_dst_ip\": \"10.43.0.81\", \"dd_dst_port\": 49668, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": null, \"dd_bytes_rcvd\": null, \"host_name\": \"IP-192.168.71.1\", \"host_ip\": \"192.168.71.1\", \"dd_proto\": \"\", \"vectra_timestamp\": \"1623742534\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://255.255.255.1/detections/1900?detail_id=66777"
    },
    "destination": {
        "address": "10.43.0.81",
        "ip": "10.43.0.81",
        "port": 49668
    },
    "host": {
        "ip": "192.168.71.1",
        "name": "IP-192.168.71.1"
    },
    "observer": {
        "ip": "255.255.255.1",
        "name": "255.255.255.1",
        "version": "6.8"
    },
    "related": {
        "ip": [
            "10.43.0.81",
            "192.168.71.1",
            "255.255.255.1"
        ]
    },
    "vectra": {
        "certainty": 86,
        "detection": {
            "id": 1900,
            "name": "RDP Recon",
            "type": "rpc_recon_1to1"
        },
        "risk_score_norm": 70,
        "severity": 7.0,
        "timestamp": 1623742534,
        "triaged": false
    }
}

{
    "message": "-: {\"version\": \"6.8\", \"detection_id\": 1900, \"category\": \"RECONNAISSANCE\", \"severity\": 7.0, \"threat\": 70, \"certainty\": 86, \"d_type\": \"rpc_recon_1to1\", \"d_type_vname\": \"Port Sweep\", \"triaged\": false, \"headend_addr\": \"255.255.255.1\", \"dvchost\": \"255.255.255.1\", \"href\": \"https://255.255.255.1/detections/1900?detail_id=66777\", \"dd_dst_ip\": \"10.43.0.81\", \"dd_dst_port\": 49668, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": null, \"dd_bytes_rcvd\": null, \"host_name\": \"IP-192.168.71.1\", \"host_ip\": \"192.168.71.1\", \"dd_proto\": \"\", \"vectra_timestamp\": \"1623742534\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://255.255.255.1/detections/1900?detail_id=66777"
    },
    "destination": {
        "address": "10.43.0.81",
        "ip": "10.43.0.81",
        "port": 49668
    },
    "host": {
        "ip": "192.168.71.1",
        "name": "IP-192.168.71.1"
    },
    "observer": {
        "ip": "255.255.255.1",
        "name": "255.255.255.1",
        "version": "6.8"
    },
    "related": {
        "ip": [
            "10.43.0.81",
            "192.168.71.1",
            "255.255.255.1"
        ]
    },
    "vectra": {
        "certainty": 86,
        "detection": {
            "id": 1900,
            "name": "Port Sweep",
            "type": "rpc_recon_1to1"
        },
        "risk_score_norm": 70,
        "severity": 7.0,
        "timestamp": 1623742534,
        "triaged": false
    }
}

{
    "message": "-: {\"version\": \"6.8\", \"detection_id\": 1900, \"category\": \"RECONNAISSANCE\", \"severity\": 7.0, \"threat\": 70, \"certainty\": 86, \"d_type\": \"rpc_recon_1to1\", \"d_type_vname\": \"Port Scan\", \"triaged\": false, \"headend_addr\": \"255.255.255.1\", \"dvchost\": \"255.255.255.1\", \"href\": \"https://255.255.255.1/detections/1900?detail_id=66777\", \"dd_dst_ip\": \"10.43.0.81\", \"dd_dst_port\": 49668, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": null, \"dd_bytes_rcvd\": null, \"host_name\": \"IP-192.168.71.1\", \"host_ip\": \"192.168.71.1\", \"dd_proto\": \"\", \"vectra_timestamp\": \"1623742534\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://255.255.255.1/detections/1900?detail_id=66777"
    },
    "destination": {
        "address": "10.43.0.81",
        "ip": "10.43.0.81",
        "port": 49668
    },
    "host": {
        "ip": "192.168.71.1",
        "name": "IP-192.168.71.1"
    },
    "observer": {
        "ip": "255.255.255.1",
        "name": "255.255.255.1",
        "version": "6.8"
    },
    "related": {
        "ip": [
            "10.43.0.81",
            "192.168.71.1",
            "255.255.255.1"
        ]
    },
    "vectra": {
        "certainty": 86,
        "detection": {
            "id": 1900,
            "name": "Port Scan",
            "type": "rpc_recon_1to1"
        },
        "risk_score_norm": 70,
        "severity": 7.0,
        "timestamp": 1623742534,
        "triaged": false
    }
}

{
    "message": "-: {\"version\": \"6.8\", \"detection_id\": 1900, \"category\": \"RECONNAISSANCE\", \"severity\": 7.0, \"threat\": 70, \"certainty\": 86, \"d_type\": \"rpc_recon_1to1\", \"d_type_vname\": \"File Share Enumeration\", \"triaged\": false, \"headend_addr\": \"255.255.255.1\", \"dvchost\": \"255.255.255.1\", \"href\": \"https://255.255.255.1/detections/1900?detail_id=66777\", \"dd_dst_ip\": \"10.43.0.81\", \"dd_dst_port\": 49668, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": null, \"dd_bytes_rcvd\": null, \"host_name\": \"IP-192.168.71.1\", \"host_ip\": \"192.168.71.1\", \"dd_proto\": \"\", \"vectra_timestamp\": \"1623742534\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://255.255.255.1/detections/1900?detail_id=66777"
    },
    "destination": {
        "address": "10.43.0.81",
        "ip": "10.43.0.81",
        "port": 49668
    },
    "host": {
        "ip": "192.168.71.1",
        "name": "IP-192.168.71.1"
    },
    "observer": {
        "ip": "255.255.255.1",
        "name": "255.255.255.1",
        "version": "6.8"
    },
    "related": {
        "ip": [
            "10.43.0.81",
            "192.168.71.1",
            "255.255.255.1"
        ]
    },
    "vectra": {
        "certainty": 86,
        "detection": {
            "id": 1900,
            "name": "File Share Enumeration",
            "type": "rpc_recon_1to1"
        },
        "risk_score_norm": 70,
        "severity": 7.0,
        "timestamp": 1623742534,
        "triaged": false
    }
}

{
    "message": "-: {\"version\": \"6.8\", \"detection_id\": 1900, \"category\": \"RECONNAISSANCE\", \"severity\": 7.0, \"threat\": 70, \"certainty\": 86, \"d_type\": \"rpc_recon_1to1\", \"d_type_vname\": \"External Remote Access\", \"triaged\": false, \"headend_addr\": \"255.255.255.1\", \"dvchost\": \"255.255.255.1\", \"href\": \"https://255.255.255.1/detections/1900?detail_id=66777\", \"dd_dst_ip\": \"10.43.0.81\", \"dd_dst_port\": 49668, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": null, \"dd_bytes_rcvd\": null, \"host_name\": \"IP-192.168.71.1\", \"host_ip\": \"192.168.71.1\", \"dd_proto\": \"\", \"vectra_timestamp\": \"1623742534\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://255.255.255.1/detections/1900?detail_id=66777"
    },
    "destination": {
        "address": "10.43.0.81",
        "ip": "10.43.0.81",
        "port": 49668
    },
    "host": {
        "ip": "192.168.71.1",
        "name": "IP-192.168.71.1"
    },
    "observer": {
        "ip": "255.255.255.1",
        "name": "255.255.255.1",
        "version": "6.8"
    },
    "related": {
        "ip": [
            "10.43.0.81",
            "192.168.71.1",
            "255.255.255.1"
        ]
    },
    "vectra": {
        "certainty": 86,
        "detection": {
            "id": 1900,
            "name": "External Remote Access",
            "type": "rpc_recon_1to1"
        },
        "risk_score_norm": 70,
        "severity": 7.0,
        "timestamp": 1623742534,
        "triaged": false
    }
}

{
    "message": "-: {\"version\": \"6.8\", \"detection_id\": 1900, \"category\": \"RECONNAISSANCE\", \"severity\": 7.0, \"threat\": 70, \"certainty\": 86, \"d_type\": \"rpc_recon_1to1\", \"d_type_vname\": \"Cryptocurrency Mining\", \"triaged\": false, \"headend_addr\": \"255.255.255.1\", \"dvchost\": \"255.255.255.1\", \"href\": \"https://255.255.255.1/detections/1900?detail_id=66777\", \"dd_dst_ip\": \"10.43.0.81\", \"dd_dst_port\": 49668, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": null, \"dd_bytes_rcvd\": null, \"host_name\": \"IP-192.168.71.1\", \"host_ip\": \"192.168.71.1\", \"dd_proto\": \"\", \"vectra_timestamp\": \"1623742534\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://255.255.255.1/detections/1900?detail_id=66777"
    },
    "destination": {
        "address": "10.43.0.81",
        "ip": "10.43.0.81",
        "port": 49668
    },
    "host": {
        "ip": "192.168.71.1",
        "name": "IP-192.168.71.1"
    },
    "observer": {
        "ip": "255.255.255.1",
        "name": "255.255.255.1",
        "version": "6.8"
    },
    "related": {
        "ip": [
            "10.43.0.81",
            "192.168.71.1",
            "255.255.255.1"
        ]
    },
    "vectra": {
        "certainty": 86,
        "detection": {
            "id": 1900,
            "name": "Cryptocurrency Mining",
            "type": "rpc_recon_1to1"
        },
        "risk_score_norm": 70,
        "severity": 7.0,
        "timestamp": 1623742534,
        "triaged": false
    }
}

{
    "message": "-: {\"version\": \"6.8\", \"detection_id\": 1900, \"category\": \"RECONNAISSANCE\", \"severity\": 7.0, \"threat\": 70, \"certainty\": 86, \"d_type\": \"rpc_recon_1to1\", \"d_type_vname\": \"Hidden DNS Tunnel\", \"triaged\": false, \"headend_addr\": \"255.255.255.1\", \"dvchost\": \"255.255.255.1\", \"href\": \"https://255.255.255.1/detections/1900?detail_id=66777\", \"dd_dst_ip\": \"10.43.0.81\", \"dd_dst_port\": 49668, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": null, \"dd_bytes_rcvd\": null, \"host_name\": \"IP-192.168.71.1\", \"host_ip\": \"192.168.71.1\", \"dd_proto\": \"\", \"vectra_timestamp\": \"1623742534\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://255.255.255.1/detections/1900?detail_id=66777"
    },
    "destination": {
        "address": "10.43.0.81",
        "ip": "10.43.0.81",
        "port": 49668
    },
    "host": {
        "ip": "192.168.71.1",
        "name": "IP-192.168.71.1"
    },
    "observer": {
        "ip": "255.255.255.1",
        "name": "255.255.255.1",
        "version": "6.8"
    },
    "related": {
        "ip": [
            "10.43.0.81",
            "192.168.71.1",
            "255.255.255.1"
        ]
    },
    "vectra": {
        "certainty": 86,
        "detection": {
            "id": 1900,
            "name": "Hidden DNS Tunnel",
            "type": "rpc_recon_1to1"
        },
        "risk_score_norm": 70,
        "severity": 7.0,
        "timestamp": 1623742534,
        "triaged": false
    }
}

{
    "message": "-: {\"version\": \"6.8\", \"detection_id\": 1900, \"category\": \"RECONNAISSANCE\", \"severity\": 7.0, \"threat\": 70, \"certainty\": 86, \"d_type\": \"rpc_recon_1to1\", \"d_type_vname\": \"TOR Activity\", \"triaged\": false, \"headend_addr\": \"255.255.255.1\", \"dvchost\": \"255.255.255.1\", \"href\": \"https://255.255.255.1/detections/1900?detail_id=66777\", \"dd_dst_ip\": \"10.43.0.81\", \"dd_dst_port\": 49668, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": null, \"dd_bytes_rcvd\": null, \"host_name\": \"IP-192.168.71.1\", \"host_ip\": \"192.168.71.1\", \"dd_proto\": \"\", \"vectra_timestamp\": \"1623742534\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://255.255.255.1/detections/1900?detail_id=66777"
    },
    "destination": {
        "address": "10.43.0.81",
        "ip": "10.43.0.81",
        "port": 49668
    },
    "host": {
        "ip": "192.168.71.1",
        "name": "IP-192.168.71.1"
    },
    "observer": {
        "ip": "255.255.255.1",
        "name": "255.255.255.1",
        "version": "6.8"
    },
    "related": {
        "ip": [
            "10.43.0.81",
            "192.168.71.1",
            "255.255.255.1"
        ]
    },
    "vectra": {
        "certainty": 86,
        "detection": {
            "id": 1900,
            "name": "TOR Activity",
            "type": "rpc_recon_1to1"
        },
        "risk_score_norm": 70,
        "severity": 7.0,
        "timestamp": 1623742534,
        "triaged": false
    }
}

{
    "message": "-: {\"version\": \"6.8\", \"detection_id\": 1900, \"category\": \"RECONNAISSANCE\", \"severity\": 7.0, \"threat\": 70, \"certainty\": 86, \"d_type\": \"rpc_recon_1to1\", \"d_type_vname\": \"Hidden HTTPS Tunnel\", \"triaged\": false, \"headend_addr\": \"255.255.255.1\", \"dvchost\": \"255.255.255.1\", \"href\": \"https://255.255.255.1/detections/1900?detail_id=66777\", \"dd_dst_ip\": \"10.43.0.81\", \"dd_dst_port\": 49668, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": null, \"dd_bytes_rcvd\": null, \"host_name\": \"IP-192.168.71.1\", \"host_ip\": \"192.168.71.1\", \"dd_proto\": \"\", \"vectra_timestamp\": \"1623742534\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://255.255.255.1/detections/1900?detail_id=66777"
    },
    "destination": {
        "address": "10.43.0.81",
        "ip": "10.43.0.81",
        "port": 49668
    },
    "host": {
        "ip": "192.168.71.1",
        "name": "IP-192.168.71.1"
    },
    "observer": {
        "ip": "255.255.255.1",
        "name": "255.255.255.1",
        "version": "6.8"
    },
    "related": {
        "ip": [
            "10.43.0.81",
            "192.168.71.1",
            "255.255.255.1"
        ]
    },
    "vectra": {
        "certainty": 86,
        "detection": {
            "id": 1900,
            "name": "Hidden HTTPS Tunnel",
            "type": "rpc_recon_1to1"
        },
        "risk_score_norm": 70,
        "severity": 7.0,
        "timestamp": 1623742534,
        "triaged": false
    }
}

{
    "message": "-: {\"version\": \"6.8\", \"detection_id\": 1900, \"category\": \"RECONNAISSANCE\", \"severity\": 7.0, \"threat\": 70, \"certainty\": 86, \"d_type\": \"rpc_recon_1to1\", \"d_type_vname\": \"Threat Intelligence Match\", \"triaged\": false, \"headend_addr\": \"255.255.255.1\", \"dvchost\": \"255.255.255.1\", \"href\": \"https://255.255.255.1/detections/1900?detail_id=66777\", \"dd_dst_ip\": \"10.43.0.81\", \"dd_dst_port\": 49668, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": null, \"dd_bytes_rcvd\": null, \"host_name\": \"IP-192.168.71.1\", \"host_ip\": \"192.168.71.1\", \"dd_proto\": \"\", \"vectra_timestamp\": \"1623742534\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://255.255.255.1/detections/1900?detail_id=66777"
    },
    "destination": {
        "address": "10.43.0.81",
        "ip": "10.43.0.81",
        "port": 49668
    },
    "host": {
        "ip": "192.168.71.1",
        "name": "IP-192.168.71.1"
    },
    "observer": {
        "ip": "255.255.255.1",
        "name": "255.255.255.1",
        "version": "6.8"
    },
    "related": {
        "ip": [
            "10.43.0.81",
            "192.168.71.1",
            "255.255.255.1"
        ]
    },
    "vectra": {
        "certainty": 86,
        "detection": {
            "id": 1900,
            "name": "Threat Intelligence Match",
            "type": "rpc_recon_1to1"
        },
        "risk_score_norm": 70,
        "severity": 7.0,
        "timestamp": 1623742534,
        "triaged": false
    }
}

{
    "message": "-: {\"version\": \"6.8\", \"detection_id\": 1900, \"category\": \"RECONNAISSANCE\", \"severity\": 7.0, \"threat\": 70, \"certainty\": 86, \"d_type\": \"rpc_recon_1to1\", \"d_type_vname\": \"Suspicious HTTP\", \"triaged\": false, \"headend_addr\": \"255.255.255.1\", \"dvchost\": \"255.255.255.1\", \"href\": \"https://255.255.255.1/detections/1900?detail_id=66777\", \"dd_dst_ip\": \"10.43.0.81\", \"dd_dst_port\": 49668, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": null, \"dd_bytes_rcvd\": null, \"host_name\": \"IP-192.168.71.1\", \"host_ip\": \"192.168.71.1\", \"dd_proto\": \"\", \"vectra_timestamp\": \"1623742534\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://255.255.255.1/detections/1900?detail_id=66777"
    },
    "destination": {
        "address": "10.43.0.81",
        "ip": "10.43.0.81",
        "port": 49668
    },
    "host": {
        "ip": "192.168.71.1",
        "name": "IP-192.168.71.1"
    },
    "observer": {
        "ip": "255.255.255.1",
        "name": "255.255.255.1",
        "version": "6.8"
    },
    "related": {
        "ip": [
            "10.43.0.81",
            "192.168.71.1",
            "255.255.255.1"
        ]
    },
    "vectra": {
        "certainty": 86,
        "detection": {
            "id": 1900,
            "name": "Suspicious HTTP",
            "type": "rpc_recon_1to1"
        },
        "risk_score_norm": 70,
        "severity": 7.0,
        "timestamp": 1623742534,
        "triaged": false
    }
}

{
    "message": "-: {\"version\": \"6.8\", \"detection_id\": 1900, \"category\": \"RECONNAISSANCE\", \"severity\": 7.0, \"threat\": 70, \"certainty\": 86, \"d_type\": \"rpc_recon_1to1\", \"d_type_vname\": \"Suspicious Relay\", \"triaged\": false, \"headend_addr\": \"255.255.255.1\", \"dvchost\": \"255.255.255.1\", \"href\": \"https://255.255.255.1/detections/1900?detail_id=66777\", \"dd_dst_ip\": \"10.43.0.81\", \"dd_dst_port\": 49668, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": null, \"dd_bytes_rcvd\": null, \"host_name\": \"IP-192.168.71.1\", \"host_ip\": \"192.168.71.1\", \"dd_proto\": \"\", \"vectra_timestamp\": \"1623742534\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://255.255.255.1/detections/1900?detail_id=66777"
    },
    "destination": {
        "address": "10.43.0.81",
        "ip": "10.43.0.81",
        "port": 49668
    },
    "host": {
        "ip": "192.168.71.1",
        "name": "IP-192.168.71.1"
    },
    "observer": {
        "ip": "255.255.255.1",
        "name": "255.255.255.1",
        "version": "6.8"
    },
    "related": {
        "ip": [
            "10.43.0.81",
            "192.168.71.1",
            "255.255.255.1"
        ]
    },
    "vectra": {
        "certainty": 86,
        "detection": {
            "id": 1900,
            "name": "Suspicious Relay",
            "type": "rpc_recon_1to1"
        },
        "risk_score_norm": 70,
        "severity": 7.0,
        "timestamp": 1623742534,
        "triaged": false
    }
}

{
    "message": "-: {\"version\": \"6.8\", \"detection_id\": 1900, \"category\": \"RECONNAISSANCE\", \"severity\": 7.0, \"threat\": 70, \"certainty\": 86, \"d_type\": \"rpc_recon_1to1\", \"d_type_vname\": \"Outbound Dos\", \"triaged\": false, \"headend_addr\": \"255.255.255.1\", \"dvchost\": \"255.255.255.1\", \"href\": \"https://255.255.255.1/detections/1900?detail_id=66777\", \"dd_dst_ip\": \"10.43.0.81\", \"dd_dst_port\": 49668, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": null, \"dd_bytes_rcvd\": null, \"host_name\": \"IP-192.168.71.1\", \"host_ip\": \"192.168.71.1\", \"dd_proto\": \"\", \"vectra_timestamp\": \"1623742534\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://255.255.255.1/detections/1900?detail_id=66777"
    },
    "destination": {
        "address": "10.43.0.81",
        "ip": "10.43.0.81",
        "port": 49668
    },
    "host": {
        "ip": "192.168.71.1",
        "name": "IP-192.168.71.1"
    },
    "observer": {
        "ip": "255.255.255.1",
        "name": "255.255.255.1",
        "version": "6.8"
    },
    "related": {
        "ip": [
            "10.43.0.81",
            "192.168.71.1",
            "255.255.255.1"
        ]
    },
    "vectra": {
        "certainty": 86,
        "detection": {
            "id": 1900,
            "name": "Outbound Dos",
            "type": "rpc_recon_1to1"
        },
        "risk_score_norm": 70,
        "severity": 7.0,
        "timestamp": 1623742534,
        "triaged": false
    }
}

{
    "message": "-: {\"version\": \"6.8\", \"detection_id\": 1900, \"category\": \"RECONNAISSANCE\", \"severity\": 7.0, \"threat\": 70, \"certainty\": 86, \"d_type\": \"rpc_recon_1to1\", \"d_type_vname\": \"Outbound Port Sweep\", \"triaged\": false, \"headend_addr\": \"255.255.255.1\", \"dvchost\": \"255.255.255.1\", \"href\": \"https://255.255.255.1/detections/1900?detail_id=66777\", \"dd_dst_ip\": \"10.43.0.81\", \"dd_dst_port\": 49668, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": null, \"dd_bytes_rcvd\": null, \"host_name\": \"IP-192.168.71.1\", \"host_ip\": \"192.168.71.1\", \"dd_proto\": \"\", \"vectra_timestamp\": \"1623742534\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://255.255.255.1/detections/1900?detail_id=66777"
    },
    "destination": {
        "address": "10.43.0.81",
        "ip": "10.43.0.81",
        "port": 49668
    },
    "host": {
        "ip": "192.168.71.1",
        "name": "IP-192.168.71.1"
    },
    "observer": {
        "ip": "255.255.255.1",
        "name": "255.255.255.1",
        "version": "6.8"
    },
    "related": {
        "ip": [
            "10.43.0.81",
            "192.168.71.1",
            "255.255.255.1"
        ]
    },
    "vectra": {
        "certainty": 86,
        "detection": {
            "id": 1900,
            "name": "Outbound Port Sweep",
            "type": "rpc_recon_1to1"
        },
        "risk_score_norm": 70,
        "severity": 7.0,
        "timestamp": 1623742534,
        "triaged": false
    }
}

{
    "message": "-: {\"version\": \"6.8\", \"detection_id\": 1900, \"category\": \"RECONNAISSANCE\", \"severity\": 7.0, \"threat\": 70, \"certainty\": 86, \"d_type\": \"rpc_recon_1to1\", \"d_type_vname\": \"Brute-Force\", \"triaged\": false, \"headend_addr\": \"255.255.255.1\", \"dvchost\": \"255.255.255.1\", \"href\": \"https://255.255.255.1/detections/1900?detail_id=66777\", \"dd_dst_ip\": \"10.43.0.81\", \"dd_dst_port\": 49668, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": null, \"dd_bytes_rcvd\": null, \"host_name\": \"IP-192.168.71.1\", \"host_ip\": \"192.168.71.1\", \"dd_proto\": \"\", \"vectra_timestamp\": \"1623742534\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://255.255.255.1/detections/1900?detail_id=66777"
    },
    "destination": {
        "address": "10.43.0.81",
        "ip": "10.43.0.81",
        "port": 49668
    },
    "host": {
        "ip": "192.168.71.1",
        "name": "IP-192.168.71.1"
    },
    "observer": {
        "ip": "255.255.255.1",
        "name": "255.255.255.1",
        "version": "6.8"
    },
    "related": {
        "ip": [
            "10.43.0.81",
            "192.168.71.1",
            "255.255.255.1"
        ]
    },
    "vectra": {
        "certainty": 86,
        "detection": {
            "id": 1900,
            "name": "Brute-Force",
            "type": "rpc_recon_1to1"
        },
        "risk_score_norm": 70,
        "severity": 7.0,
        "timestamp": 1623742534,
        "triaged": false
    }
}

{
    "message": "-: {\"version\": \"6.8\", \"detection_id\": 1900, \"category\": \"RECONNAISSANCE\", \"severity\": 7.0, \"threat\": 70, \"certainty\": 86, \"d_type\": \"rpc_recon_1to1\", \"d_type_vname\": \"Ransomware File Activity\", \"triaged\": false, \"headend_addr\": \"255.255.255.1\", \"dvchost\": \"255.255.255.1\", \"href\": \"https://255.255.255.1/detections/1900?detail_id=66777\", \"dd_dst_ip\": \"10.43.0.81\", \"dd_dst_port\": 49668, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": null, \"dd_bytes_rcvd\": null, \"host_name\": \"IP-192.168.71.1\", \"host_ip\": \"192.168.71.1\", \"dd_proto\": \"\", \"vectra_timestamp\": \"1623742534\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://255.255.255.1/detections/1900?detail_id=66777"
    },
    "destination": {
        "address": "10.43.0.81",
        "ip": "10.43.0.81",
        "port": 49668
    },
    "host": {
        "ip": "192.168.71.1",
        "name": "IP-192.168.71.1"
    },
    "observer": {
        "ip": "255.255.255.1",
        "name": "255.255.255.1",
        "version": "6.8"
    },
    "related": {
        "ip": [
            "10.43.0.81",
            "192.168.71.1",
            "255.255.255.1"
        ]
    },
    "vectra": {
        "certainty": 86,
        "detection": {
            "id": 1900,
            "name": "Ransomware File Activity",
            "type": "rpc_recon_1to1"
        },
        "risk_score_norm": 70,
        "severity": 7.0,
        "timestamp": 1623742534,
        "triaged": false
    }
}

{
    "message": "-: {\"version\": \"6.8\", \"detection_id\": 1900, \"category\": \"RECONNAISSANCE\", \"severity\": 7.0, \"threat\": 70, \"certainty\": 86, \"d_type\": \"rpc_recon_1to1\", \"d_type_vname\": \"Shell Knocker Client\", \"triaged\": false, \"headend_addr\": \"255.255.255.1\", \"dvchost\": \"255.255.255.1\", \"href\": \"https://255.255.255.1/detections/1900?detail_id=66777\", \"dd_dst_ip\": \"10.43.0.81\", \"dd_dst_port\": 49668, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": null, \"dd_bytes_rcvd\": null, \"host_name\": \"IP-192.168.71.1\", \"host_ip\": \"192.168.71.1\", \"dd_proto\": \"\", \"vectra_timestamp\": \"1623742534\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://255.255.255.1/detections/1900?detail_id=66777"
    },
    "destination": {
        "address": "10.43.0.81",
        "ip": "10.43.0.81",
        "port": 49668
    },
    "host": {
        "ip": "192.168.71.1",
        "name": "IP-192.168.71.1"
    },
    "observer": {
        "ip": "255.255.255.1",
        "name": "255.255.255.1",
        "version": "6.8"
    },
    "related": {
        "ip": [
            "10.43.0.81",
            "192.168.71.1",
            "255.255.255.1"
        ]
    },
    "vectra": {
        "certainty": 86,
        "detection": {
            "id": 1900,
            "name": "Shell Knocker Client",
            "type": "rpc_recon_1to1"
        },
        "risk_score_norm": 70,
        "severity": 7.0,
        "timestamp": 1623742534,
        "triaged": false
    }
}

{
    "message": "-: {\"version\": \"6.8\", \"detection_id\": 1900, \"category\": \"RECONNAISSANCE\", \"severity\": 7.0, \"threat\": 70, \"certainty\": 86, \"d_type\": \"rpc_recon_1to1\", \"d_type_vname\": \"SQL Injection Activity\", \"triaged\": false, \"headend_addr\": \"255.255.255.1\", \"dvchost\": \"255.255.255.1\", \"href\": \"https://255.255.255.1/detections/1900?detail_id=66777\", \"dd_dst_ip\": \"10.43.0.81\", \"dd_dst_port\": 49668, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": null, \"dd_bytes_rcvd\": null, \"host_name\": \"IP-192.168.71.1\", \"host_ip\": \"192.168.71.1\", \"dd_proto\": \"\", \"vectra_timestamp\": \"1623742534\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://255.255.255.1/detections/1900?detail_id=66777"
    },
    "destination": {
        "address": "10.43.0.81",
        "ip": "10.43.0.81",
        "port": 49668
    },
    "host": {
        "ip": "192.168.71.1",
        "name": "IP-192.168.71.1"
    },
    "observer": {
        "ip": "255.255.255.1",
        "name": "255.255.255.1",
        "version": "6.8"
    },
    "related": {
        "ip": [
            "10.43.0.81",
            "192.168.71.1",
            "255.255.255.1"
        ]
    },
    "vectra": {
        "certainty": 86,
        "detection": {
            "id": 1900,
            "name": "SQL Injection Activity",
            "type": "rpc_recon_1to1"
        },
        "risk_score_norm": 70,
        "severity": 7.0,
        "timestamp": 1623742534,
        "triaged": false
    }
}

{
    "message": "-: {\"version\": \"6.8\", \"detection_id\": 1900, \"category\": \"RECONNAISSANCE\", \"severity\": 7.0, \"threat\": 70, \"certainty\": 86, \"d_type\": \"rpc_recon_1to1\", \"d_type_vname\": \"Suspicious Admin\", \"triaged\": false, \"headend_addr\": \"255.255.255.1\", \"dvchost\": \"255.255.255.1\", \"href\": \"https://255.255.255.1/detections/1900?detail_id=66777\", \"dd_dst_ip\": \"10.43.0.81\", \"dd_dst_port\": 49668, \"dd_dst_dns\": \"\", \"dd_bytes_sent\": null, \"dd_bytes_rcvd\": null, \"host_name\": \"IP-192.168.71.1\", \"host_ip\": \"192.168.71.1\", \"dd_proto\": \"\", \"vectra_timestamp\": \"1623742534\"}",
    "event": {
        "action": "RECONNAISSANCE",
        "url": "https://255.255.255.1/detections/1900?detail_id=66777"
    },
    "destination": {
        "address": "10.43.0.81",
        "ip": "10.43.0.81",
        "port": 49668
    },
    "host": {
        "ip": "192.168.71.1",
        "name": "IP-192.168.71.1"
    },
    "observer": {
        "ip": "255.255.255.1",
        "name": "255.255.255.1",
        "version": "6.8"
    },
    "related": {
        "ip": [
            "10.43.0.81",
            "192.168.71.1",
            "255.255.255.1"
        ]
    },
    "vectra": {
        "certainty": 86,
        "detection": {
            "id": 1900,
            "name": "Suspicious Admin",
            "type": "rpc_recon_1to1"
        },
        "risk_score_norm": 70,
        "severity": 7.0,
        "timestamp": 1623742534,
        "triaged": false
    }
}

{
    "message": ":- {\"user\":\"admin\",\"role\":\"Super Admin\",\"source_ip\":\"1.2.3.4\",\"headend_addr\":\"1.2.3.1\",\"dvchost\":\"1.2.3.254\",\"version\":\"7.6\",\"result\":\"success\",\"message\":\"create triage filter {\\\"Type\\\":\\\"Alban\\\",\\\"enabled\\\":true,\\\"context\\\":{\\\"host_match_count\\\":1,\\\"critical_host_count\\\":0},\\\"Detection Category\\\":\\\"EXFILTRATION\\\",\\\"Detection Type\\\":\\\"Smash and Grab\\\",\\\"sourceConditions\\\":{\\\"OR\\\":[{\\\"AND\\\":[{\\\"ANY_OF\\\":{\\\"label\\\":\\\"Host\\\",\\\"field\\\":\\\"host\\\",\\\"values\\\":[{\\\"value\\\":8389,\\\"label\\\":\\\"SOC\\\"}],\\\"groups\\\":[]}}]}]},\\\"additionalConditions\\\":{\\\"OR\\\":[{\\\"AND\\\":[{\\\"ANY_OF\\\":{\\\"label\\\":\\\"Destination Domain\\\",\\\"field\\\":\\\"remote1_dns\\\",\\\"values\\\":[{\\\"value\\\":\\\"dmz.example.org\\\",\\\"label\\\":\\\"dmz.example.org\\\"},{\\\"value\\\":\\\"app.sekoia.io\\\",\\\"label\\\":\\\"app.sekoia.io\\\"}],\\\"groups\\\":[]}}]}]},\\\"ID\\\":137,\\\"Hosts\\\":[\\\"SOC\\\"]}\",\"vectra_timestamp\":\"1683633677\"}",
    "event": {
        "outcome": "success",
        "reason": "create triage filter"
    },
    "observer": {
        "ip": "1.2.3.1",
        "name": "1.2.3.254",
        "version": "7.6"
    },
    "related": {
        "ip": [
            "1.2.3.1",
            "1.2.3.4"
        ],
        "user": [
            "admin"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4"
    },
    "user": {
        "name": "admin"
    },
    "vectra": {
        "audit": {
            "message": "create triage filter {\"Type\":\"Alban\",\"enabled\":true,\"context\":{\"host_match_count\":1,\"critical_host_count\":0},\"Detection Category\":\"EXFILTRATION\",\"Detection Type\":\"Smash and Grab\",\"sourceConditions\":{\"OR\":[{\"AND\":[{\"ANY_OF\":{\"label\":\"Host\",\"field\":\"host\",\"values\":[{\"value\":8389,\"label\":\"SOC\"}],\"groups\":[]}}]}]},\"additionalConditions\":{\"OR\":[{\"AND\":[{\"ANY_OF\":{\"label\":\"Destination Domain\",\"field\":\"remote1_dns\",\"values\":[{\"value\":\"dmz.example.org\",\"label\":\"dmz.example.org\"},{\"value\":\"app.sekoia.io\",\"label\":\"app.sekoia.io\"}],\"groups\":[]}}]}]},\"ID\":137,\"Hosts\":[\"SOC\"]}"
        },
        "detection": {
            "category": "EXFILTRATION",
            "type": "Smash and Grab"
        },
        "health": {
            "message": "create triage filter {\"Type\":\"Alban\",\"enabled\":true,\"context\":{\"host_match_count\":1,\"critical_host_count\":0},\"Detection Category\":\"EXFILTRATION\",\"Detection Type\":\"Smash and Grab\",\"sourceConditions\":{\"OR\":[{\"AND\":[{\"ANY_OF\":{\"label\":\"Host\",\"field\":\"host\",\"values\":[{\"value\":8389,\"label\":\"SOC\"}],\"groups\":[]}}]}]},\"additionalConditions\":{\"OR\":[{\"AND\":[{\"ANY_OF\":{\"label\":\"Destination Domain\",\"field\":\"remote1_dns\",\"values\":[{\"value\":\"dmz.example.org\",\"label\":\"dmz.example.org\"},{\"value\":\"app.sekoia.io\",\"label\":\"app.sekoia.io\"}],\"groups\":[]}}]}]},\"ID\":137,\"Hosts\":[\"SOC\"]}"
        },
        "timestamp": 1683633677,
        "user": {
            "role": "Super Admin"
        }
    }
}

{
    "message": ":- {\"user\":\"admin\",\"role\":\"Super Admin\",\"source_ip\":\"1.2.3.4\",\"headend_addr\":\"1.2.3.1\",\"dvchost\":\"1.2.3.254\",\"version\":\"7.6\",\"result\":\"success\",\"message\":\"create triage filter {\\\"Type\\\":\\\"Proxy\\\",\\\"enabled\\\":true,\\\"context\\\":{\\\"host_match_count\\\":1,\\\"critical_host_count\\\":0},\\\"Detection Category\\\":\\\"COMMAND & CONTROL\\\",\\\"Detection Type\\\":\\\"Hidden HTTPS Tunnel\\\",\\\"sourceConditions\\\":{\\\"OR\\\":[{\\\"AND\\\":[{\\\"ANY_OF\\\":{\\\"label\\\":\\\"Host\\\",\\\"field\\\":\\\"host\\\",\\\"values\\\":[{\\\"value\\\":8389,\\\"label\\\":\\\"SOC\\\"}],\\\"groups\\\":[]}}]}]},\\\"additionalConditions\\\":{\\\"OR\\\":[{\\\"AND\\\":[{\\\"ANY_OF\\\":{\\\"label\\\":\\\"C&CA Server Domain\\\",\\\"field\\\":\\\"remote1_dns\\\",\\\"values\\\":[{\\\"value\\\":\\\"sedb.example.org\\\",\\\"label\\\":\\\"sedb.example.org\\\"}],\\\"groups\\\":[]}},{\\\"ANY_OF\\\":{\\\"label\\\":\\\"Destination Port\\\",\\\"field\\\":\\\"remote1_port\\\",\\\"values\\\":[{\\\"value\\\":\\\"443\\\",\\\"label\\\":\\\"443\\\"}],\\\"groups\\\":[]}}]}]},\\\"ID\\\":136,\\\"Hosts\\\":[\\\"SOC\\\"]}\",\"vectra_timestamp\":\"1683633677\"}",
    "event": {
        "outcome": "success",
        "reason": "create triage filter"
    },
    "observer": {
        "ip": "1.2.3.1",
        "name": "1.2.3.254",
        "version": "7.6"
    },
    "related": {
        "ip": [
            "1.2.3.1",
            "1.2.3.4"
        ],
        "user": [
            "admin"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4"
    },
    "user": {
        "name": "admin"
    },
    "vectra": {
        "audit": {
            "message": "create triage filter {\"Type\":\"Proxy\",\"enabled\":true,\"context\":{\"host_match_count\":1,\"critical_host_count\":0},\"Detection Category\":\"COMMAND & CONTROL\",\"Detection Type\":\"Hidden HTTPS Tunnel\",\"sourceConditions\":{\"OR\":[{\"AND\":[{\"ANY_OF\":{\"label\":\"Host\",\"field\":\"host\",\"values\":[{\"value\":8389,\"label\":\"SOC\"}],\"groups\":[]}}]}]},\"additionalConditions\":{\"OR\":[{\"AND\":[{\"ANY_OF\":{\"label\":\"C&CA Server Domain\",\"field\":\"remote1_dns\",\"values\":[{\"value\":\"sedb.example.org\",\"label\":\"sedb.example.org\"}],\"groups\":[]}},{\"ANY_OF\":{\"label\":\"Destination Port\",\"field\":\"remote1_port\",\"values\":[{\"value\":\"443\",\"label\":\"443\"}],\"groups\":[]}}]}]},\"ID\":136,\"Hosts\":[\"SOC\"]}"
        },
        "detection": {
            "category": "COMMAND & CONTROL",
            "type": "Hidden HTTPS Tunnel"
        },
        "health": {
            "message": "create triage filter {\"Type\":\"Proxy\",\"enabled\":true,\"context\":{\"host_match_count\":1,\"critical_host_count\":0},\"Detection Category\":\"COMMAND & CONTROL\",\"Detection Type\":\"Hidden HTTPS Tunnel\",\"sourceConditions\":{\"OR\":[{\"AND\":[{\"ANY_OF\":{\"label\":\"Host\",\"field\":\"host\",\"values\":[{\"value\":8389,\"label\":\"SOC\"}],\"groups\":[]}}]}]},\"additionalConditions\":{\"OR\":[{\"AND\":[{\"ANY_OF\":{\"label\":\"C&CA Server Domain\",\"field\":\"remote1_dns\",\"values\":[{\"value\":\"sedb.example.org\",\"label\":\"sedb.example.org\"}],\"groups\":[]}},{\"ANY_OF\":{\"label\":\"Destination Port\",\"field\":\"remote1_port\",\"values\":[{\"value\":\"443\",\"label\":\"443\"}],\"groups\":[]}}]}]},\"ID\":136,\"Hosts\":[\"SOC\"]}"
        },
        "timestamp": 1683633677,
        "user": {
            "role": "Super Admin"
        }
    }
}

{
    "message": ":- {\"user\":\"admin\",\"role\":\"Super Admin\",\"source_ip\":\"1.2.3.4\",\"headend_addr\":\"1.2.3.1\",\"dvchost\":\"1.2.3.254\",\"version\":\"7.6\",\"result\":\"success\",\"message\":\"edit triage filter \\\"Alban\\\" - id 11 Smash and Gab - context changed from \\\"{'host_match_count': 1, 'critical_host_count': 0}\\\" to \\\"{'host_match_count': 2, 'critical_host_count': 0}\\\"\",\"vectra_timestamp\":\"1683633677\"}",
    "event": {
        "outcome": "success",
        "reason": "edit triage filter"
    },
    "observer": {
        "ip": "1.2.3.1",
        "name": "1.2.3.254",
        "version": "7.6"
    },
    "related": {
        "ip": [
            "1.2.3.1",
            "1.2.3.4"
        ],
        "user": [
            "admin"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4"
    },
    "user": {
        "name": "admin"
    },
    "vectra": {
        "audit": {
            "message": "edit triage filter \"Alban\" - id 11 Smash and Gab - context changed from \"{'host_match_count': 1, 'critical_host_count': 0}\" to \"{'host_match_count': 2, 'critical_host_count': 0}\""
        },
        "detection": {
            "type": "Smash and Gab"
        },
        "filter": {
            "type": "Alban"
        },
        "health": {
            "message": "edit triage filter \"Alban\" - id 11 Smash and Gab - context changed from \"{'host_match_count': 1, 'critical_host_count': 0}\" to \"{'host_match_count': 2, 'critical_host_count': 0}\""
        },
        "timestamp": 1683633677,
        "user": {
            "role": "Super Admin"
        }
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name	Type	Description
destination.bytes	long	Bytes sent from the destination to the source.
destination.domain	keyword	The domain name of the destination.
destination.ip	ip	IP address of the destination.
destination.port	long	Port of the destination.
event.action	keyword	The action captured by the event.
event.outcome	keyword	The outcome of the event. The lowest level categorization field in the hierarchy.
event.reason	keyword	Reason why this event happened, according to the source
event.url	keyword	Event investigation URL
host.id	keyword	Unique host id.
host.ip	ip	Host ip addresses.
host.mac	keyword	Host MAC addresses.
host.name	keyword	Name of the host.
network.protocol	keyword	Application protocol name.
observer.ip	ip	IP addresses of the observer.
observer.name	keyword	Custom name of the observer.
observer.product	keyword	The product name of the observer.
observer.version	keyword	Observer version.
source.bytes	long	Bytes sent from the source to the destination.
source.ip	ip	IP address of the source.
user.name	keyword	Short name or login of the user.
vectra.account.id	long	The ID of the account
vectra.account.name	keyword	The account name.
vectra.account.uid	keyword	The user ID of the account
vectra.audit.message	text	A message explains the cause/nature of the log
vectra.campaign.id	long	The id of the campaign
vectra.campaign.link	keyword	The link to the campaign in the UI
vectra.campaign.name	keyword	The name of the campaign
vectra.certainty	long	The certainty of the score assigned to this host
vectra.destination.id	keyword	The destination of the campaign. Defaults to 'external'
vectra.destination.key_asset	bool	Whether there is a detection that is targeting this host and this host is a key asset.
vectra.destination.name	keyword	The external domain of the campaign destination
vectra.detection.account	keyword	The related user account.
vectra.detection.accounts	keyword	The related accounts.
vectra.detection.base_object	keyword	The base distinguished name.
vectra.detection.bytes_received	keyword	The bytes of data received.
vectra.detection.bytes_sent	keyword	The bytes of data sent.
vectra.detection.category	keyword	Detection Category.
vectra.detection.client_name	keyword	The RDP client name.
vectra.detection.client_token	keyword	The RDP client token.
vectra.detection.cookie	keyword	The RDP client token.
vectra.detection.count	keyword	The number of attempts
vectra.detection.dos_type	keyword	The DOS type.
vectra.detection.dst_ips	keyword	The target subnets.
vectra.detection.extensions	keyword	File extensions used.
vectra.detection.function	keyword	The executed function.
vectra.detection.host	keyword	The suspicous host.
vectra.detection.http_method	keyword	The HTTP method.
vectra.detection.http_segment	keyword	The HTTP segment.
vectra.detection.id	long	The detection profile associated with this host.
vectra.detection.ip	keyword	The keywordernal target host.
vectra.detection.keyboard_id	keyword	They keyboard layout ID.
vectra.detection.keyboard_name	keyword	They keyboard layout name.
vectra.detection.last_type	keyword	The most recent type of detection associated with this host.
vectra.detection.matched_domain	keyword	The matched domain.
vectra.detection.matched_ip	keyword	The matched IP.
vectra.detection.matched_user_agent	keyword	The matched user-agent.
vectra.detection.name	keyword	The name of the detection
vectra.detection.namedpipe	keyword	The named pipe.
vectra.detection.networks	keyword	The target subnets.
vectra.detection.normal_admins	keyword	The normal admins observed.
vectra.detection.normal_servers	keyword	The normal servers observed.
vectra.detection.num_attempts	keyword	The number of attempts
vectra.detection.port	keyword	The external port used.
vectra.detection.ports	keyword	Ports scanned.
vectra.detection.product_id	keyword	The unusual product ID.
vectra.detection.profile	object	The detection profile associated with this host.
vectra.detection.protocol	keyword	The external protocol used.
vectra.detection.ransom_notes	keyword	Ransome notes found.
vectra.detection.reason	keyword	Event name of the campaign or reason this is suspicious or error code or indicating reason.
vectra.detection.received_normal_pattern	keyword	Example received normal pattern.
vectra.detection.received_pattern	keyword	The received pattern.
vectra.detection.referer	keyword	The referer.
vectra.detection.reply_cache_control	keyword	The replay cache control setting.
vectra.detection.request	keyword	The LDAP request.
vectra.detection.response_code	keyword	The response code.
vectra.detection.scans	keyword	The number of attempts.
vectra.detection.score_decreases	boolean	Indicates whether both Threat and Certakeywordy scores are decreasing.
vectra.detection.sent_normal_pattern	keyword	Example sent normal pattern.
vectra.detection.sent_pattern	keyword	The sent pattern.
vectra.detection.shares	keyword	The related files shares.
vectra.detection.sql_fragment	keyword	The SQL fragment.
vectra.detection.successes	keyword	The number of successes.
vectra.detection.tags	array	A text of tags applied to the host.
vectra.detection.threat_feeds	keyword	The name of the threat feed.
vectra.detection.tunnel_type	keyword	The type of hidden tunnel.
vectra.detection.type	keyword	keyword
vectra.detection.url	keyword	The suspicous URL.
vectra.detection.uuid	keyword	The RPC UUID.
vectra.filter.type	keyword	The type of filter
vectra.health.message	text	A message explains the cause/nature of the log
vectra.history.account_access	array	The account access history associated with this host.
vectra.history.host_access	object	The host access history associated with this account.
vectra.history.host_access_hostname	keyword	The host access history associated with this account (hostname).
vectra.history.service_access	array	The service access history associated with this host.
vectra.history.service_access_uid.host	keyword	The service access history associated with this account (hostname).
vectra.history.service_access_uid.proto_host	keyword	The service access history associated with this account (protocol + hostname).
vectra.host.group	keyword	To be defined
vectra.host.vendor	keyword	The vendor of the MAC address of this host.
vectra.lockdown.retry	boolean	When a Lockdown action has failed, this indicates whether the system will retry the action.
vectra.risk_score_norm	long	Newly calculated account threat
vectra.severity	long	A score proportional to threat
vectra.source.hid	long	The original host ID of the member host in this campaign
vectra.source.key_asset	boolean	Whether the host being scored is marked as a key asset
vectra.source.name	keyword	The host name of the source host
vectra.timestamp	long	Timestamp in seconds since epoch
vectra.triaged	boolean	Whether the detection has been triaged yet or not
vectra.user.agent	keyword	User agent
vectra.user.privilege	long	The observed privilege level of the host.
vectra.user.role	keyword	Role of the user who caused the log (e.g., admin, super admin, etc.)

For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.