Dataset

witfoo/precinct6-cybersecurity

Text classification, Graph ml1M<n<10M rowsLicense: apache-2.0

attack_reports · train graph_edges · train graph_nodes · train incident_signals · train signals · train

First 50 rows of train

timestampfloat64	event_timefloat64	timestamp_sourcestring	originstring	org_idstring	artifact_idstring	message_typestring	stream_namestring	pipelinestring	src_ipstring	dst_ipstring	src_portstring	dst_portstring	protocolstring	src_hoststring	dst_hoststring

1676027026

lead.observed_at

incident_lead

ORG-0005

02454c90-a92a-11ed-bfbd-e939837cfde3

firewall_action

cisco_asa

syslog

100.64.39.155

10.187.253.125

40666

3870

10.108.101.52

block

warning

ASA-4-106023

<164>Feb 10 2023 03:28:21: %ASA-4-106023: Deny tcp src outside:100.64.39.155/40666 dst dmz-1:10.187.253.125/3870 by access-group "outside_access_in" [0x0, 0x0]

malicious

0.6

["T1041", "T1190", "T1567"]

["TA0001", "TA0002", "TA0009", "TA0010"]

[]

Data Theft

0.25

complete-mission

Unprocessed

automated

false

Unprocessed

["97d12b00-a932-11ed-a973-7df772fdd65e"]

[]

["Exploiting Host", "Exploiting Target"]

ASA Firewall

Cisco

1676027026

lead.observed_at

incident_lead

ORG-0005

fa978260-a929-11ed-bfbd-e939837cfde3

firewall_action

cisco_asa

syslog

100.64.39.157

10.187.253.125

54622

3478

10.108.101.52

block

warning

ASA-4-106023

<164>Feb 10 2023 03:28:10: %ASA-4-106023: Deny udp src outside:100.64.39.157/54622 dst dmz-1:10.187.253.125/3478 by access-group "outside_access_in" [0x0, 0x0]

malicious

0.6

["T1041", "T1190", "T1567"]

1676027026

lead.observed_at

incident_lead

ORG-0005

063e7330-a92a-11ed-bfbd-e939837cfde3

firewall_action

cisco_asa

syslog

10.187.253.125

100.64.39.158

52143

43395

10.108.101.52

block

warning

ASA-4-106023

<164>Feb 10 2023 03:28:29: %ASA-4-106023: Deny tcp src outside:100.64.39.158/43395 dst dmz-1:10.187.253.125/52143 by access-group "outside_access_in" [0x0, 0x0]

malicious

0.6

["T1041", "T1190", "T1567"]

1656083515

lead.observed_at

incident_lead

ORG-0003

3b469430-f305-11ec-a0ca-214da56cc5fc

flow

meraki

syslog

100.64.39.159

100.64.39.160

13645

192.168.18.25

block

<134>Original Address=192.168.92.29 1 1655996328.567132511 NORDC_MX400_1 flows src=100.64.39.159 dst=100.64.39.160 protocol=tcp sport=13645 dport=25 pattern: 1 dst 100.64.39.160

malicious

0.6

["T1041", "T1190", "T1567"]

1656083515

lead.observed_at

incident_lead

ORG-0003

3a9f7ec0-f305-11ec-a0ca-214da56cc5fc

flow

meraki

syslog

100.64.39.161

100.64.39.160

61782

192.168.18.25

block

<134>Original Address=192.168.92.29 1 1655996327.935037221 NORDC_MX400_1 flows src=100.64.39.161 dst=100.64.39.160 protocol=tcp sport=61782 dport=80 pattern: 1 dst 100.64.39.160

malicious

0.6

["T1041", "T1190", "T1567"]

1656083515

lead.observed_at

incident_lead

ORG-0003

3aec6640-f305-11ec-a0ca-214da56cc5fc

flow

meraki

syslog

100.64.39.162

100.64.39.160

33632

192.168.18.25

block

<134>Original Address=192.168.92.29 1 1655996328.152665571 NORDC_MX400_1 flows src=100.64.39.162 dst=100.64.39.160 protocol=tcp sport=33632 dport=25 pattern: 1 dst 100.64.39.160

malicious

0.6

["T1041", "T1190", "T1567"]

1656083515

lead.observed_at

incident_lead

ORG-0003

3b17e313-f305-11ec-a0ca-214da56cc5fc

flow

meraki

syslog

100.64.39.163

100.64.39.160

6580

192.168.18.25

block

<134>Original Address=192.168.92.29 1 1655996328.203282538 NORDC_MX400_1 flows src=100.64.39.163 dst=100.64.39.160 protocol=tcp sport=6580 dport=25 pattern: 1 dst 100.64.39.160

malicious

0.6

["T1041", "T1190", "T1567"]

1656083515

lead.observed_at

incident_lead

ORG-0003

3b9354a0-f305-11ec-a0ca-214da56cc5fc

flow

meraki

syslog

100.64.39.164

100.64.39.160

5856

192.168.18.25

block

<134>Original Address=192.168.92.29 1 1655996328.738193573 NORDC_MX400_1 flows src=100.64.39.164 dst=100.64.39.160 protocol=tcp sport=5856 dport=25 pattern: 1 dst 100.64.39.160

malicious

0.6

["T1041", "T1190", "T1567"]

1656083515

lead.observed_at

incident_lead

ORG-0003

3c152ed1-f305-11ec-a0ca-214da56cc5fc

flow

meraki

syslog

100.64.39.165

100.64.39.160

16001

192.168.18.25

block

<134>Original Address=192.168.92.29 1 1655996328.386690033 NORDC_MX400_1 flows src=100.64.39.165 dst=100.64.39.160 protocol=tcp sport=16001 dport=25 pattern: 1 dst 100.64.39.160

malicious

0.6

["T1041", "T1190", "T1567"]

1681613619

lead.observed_at

incident_lead

ORG-0002

a5f2e1a0-dc3c-11ed-8803-ff285cc49679

traffic_drop

pan_firewall

syslog

100.64.39.166

100.64.39.167

35890

10.246.106.248

block

informational

<14>Apr 16 02:53:39 HOST-0103 1,2023/04/16 02:53:39,016201032964,TRAFFIC,drop,2560,2023/04/16 02:53:39,100.64.39.166,100.64.39.167,0.0.0.0,0.0.0.0,Geo Block Inbound,,,not-applicable,vsys1,Untrust,Untrust,ethernet1/2,,Witfoo Log Forward Only,2023/04/16 02:53:39,0,1,35890,23,0,0,0x…

malicious

0.6

1681613619

lead.observed_at

incident_lead

ORG-0002

a5fe7a60-dc3c-11ed-8803-ff285cc49679

traffic_drop

pan_firewall

syslog

100.64.39.166

100.64.39.167

35890

10.246.106.248

block

informational

malicious

0.6

1670021898

lead.observed_at

incident_lead

ORG-0003

a91045f0-728b-11ed-9902-2980a756d44c

flow

meraki

syslog

100.64.39.168

100.64.39.169

58677

11211

192.168.18.25

block

<134>Original Address=10.50.25.114 1 1670017894.936737630 M22_MX67C_Marietta flows src=100.64.39.168 dst=100.64.39.169 protocol=tcp sport=58677 dport=11211 pattern: 1 all

malicious

0.6

["T1041", "T1190", "T1567"]

1675263818

lead.observed_at

incident_lead

ORG-0005

4113a1a0-a237-11ed-9f4c-d92981438e4c

firewall_action

cisco_asa

syslog

100.64.31.125

10.187.253.125

44858

10324

10.108.101.52

block

warning

ASA-4-106023

<164>Feb 01 2023 07:14:56: %ASA-4-106023: Deny tcp src outside:100.64.31.125/44858 dst dmz-1:10.187.253.125/10324 by access-group "outside_access_in" [0x0, 0x0]

malicious

0.6

["T1041", "T1190", "T1567"]

1675263818

lead.observed_at

incident_lead

ORG-0005

43499470-a237-11ed-9f4c-d92981438e4c

firewall_action

cisco_asa

syslog

100.64.39.170

10.187.253.125

54154

7778

10.108.101.52

block

warning

ASA-4-106023

<164>Feb 01 2023 07:15:00: %ASA-4-106023: Deny tcp src outside:100.64.39.170/54154 dst dmz-1:10.187.253.125/7778 by access-group "outside_access_in" [0x0, 0x0]

malicious

0.6

["T1041", "T1190", "T1567"]

1675263818

lead.observed_at

incident_lead

ORG-0005

43da89d0-a237-11ed-9f4c-d92981438e4c

firewall_action

cisco_asa

syslog

100.64.39.171

10.187.253.125

60237

10.108.101.52

block

warning

ASA-4-106023

<164>Feb 01 2023 07:14:59: %ASA-4-106023: Deny tcp src outside:100.64.39.171/60237 dst dmz-1:10.187.253.125/23 by access-group "outside_access_in" [0x0, 0x0]

malicious

0.6

["T1041", "T1190", "T1567"]

1659455389

lead.observed_at

incident_lead

ORG-0003

2e560d10-11a9-11ed-ad5e-9b7c40b93c4a

flow

meraki

syslog

100.64.39.172

100.64.39.160

65504

192.168.18.25

block

<134>Original Address=192.168.92.29 1 1659365261.120528559 NORDC_MX400_1 flows src=100.64.39.172 dst=100.64.39.160 protocol=tcp sport=65504 dport=25 pattern: 1 dst 100.64.39.160

malicious

0.6

["T1041", "T1190", "T1567"]

1659455389

lead.observed_at

incident_lead

ORG-0003

2dfa0a61-11a9-11ed-ad5e-9b7c40b93c4a

flow

meraki

syslog

100.64.39.173

100.64.39.160

6376

192.168.18.25

block

<134>Original Address=192.168.92.29 1 1659365260.455745303 NORDC_MX400_1 flows src=100.64.39.173 dst=100.64.39.160 protocol=tcp sport=6376 dport=25 pattern: 1 dst 100.64.39.160

malicious

0.6

["T1041", "T1190", "T1567"]

1659455389

lead.observed_at

incident_lead

ORG-0003

2e244eb3-11a9-11ed-ad5e-9b7c40b93c4a

flow

meraki

syslog

100.64.39.174

100.64.39.160

52385

192.168.18.25

block

<134>Original Address=192.168.92.29 1 1659365261.018650621 NORDC_MX400_1 flows src=100.64.39.174 dst=100.64.39.160 protocol=tcp sport=52385 dport=25 pattern: 1 dst 100.64.39.160

malicious

0.6

["T1041", "T1190", "T1567"]

1659455389

lead.observed_at

incident_lead

ORG-0003

2e314703-11a9-11ed-ad5e-9b7c40b93c4a

flow

meraki

syslog

100.64.39.175

100.64.39.160

6092

192.168.18.25

block

<134>Original Address=192.168.92.29 1 1659365261.089820612 NORDC_MX400_1 flows src=100.64.39.175 dst=100.64.39.160 protocol=tcp sport=6092 dport=25 pattern: 1 dst 100.64.39.160

malicious

0.6

["T1041", "T1190", "T1567"]

1659449507

lead.observed_at

incident_lead

ORG-0003

2dbf6c00-11a1-11ed-ad5e-9b7c40b93c4a

flow

meraki

syslog

100.64.39.176

100.64.39.160

50272

192.168.18.25

block

<134>Original Address=192.168.92.29 1 1659361955.807886735 NORDC_MX400_1 flows src=100.64.39.176 dst=100.64.39.160 protocol=tcp sport=50272 dport=25 pattern: 1 dst 100.64.39.160

malicious

0.6

["T1041", "T1190", "T1567"]

1659449507

lead.observed_at

incident_lead

ORG-0003

2ec0d670-11a1-11ed-ad5e-9b7c40b93c4a

flow

meraki

syslog

100.64.39.177

100.64.39.160

38177

192.168.18.25

block

<134>Original Address=192.168.92.29 1 1659361956.341677521 NORDC_MX400_1 flows src=100.64.39.177 dst=100.64.39.160 protocol=tcp sport=38177 dport=25 pattern: 1 dst 100.64.39.160

malicious

0.6

["T1041", "T1190", "T1567"]

1659449507

lead.observed_at

incident_lead

ORG-0003

2eca4c54-11a1-11ed-ad5e-9b7c40b93c4a

flow

meraki

syslog

100.64.39.178

100.64.39.160

46688

192.168.18.25

block

<134>Original Address=192.168.92.29 1 1659361956.341688219 NORDC_MX400_1 flows src=100.64.39.178 dst=100.64.39.160 protocol=tcp sport=46688 dport=25 pattern: 1 dst 100.64.39.160

malicious

0.6

["T1041", "T1190", "T1567"]

1659449507

lead.observed_at

incident_lead

ORG-0003

2ed41050-11a1-11ed-ad5e-9b7c40b93c4a

flow

meraki

syslog

100.64.39.179

100.64.39.160

35084

192.168.18.25

block

<134>Original Address=192.168.92.29 1 1659361956.346982259 NORDC_MX400_1 flows src=100.64.39.179 dst=100.64.39.160 protocol=tcp sport=35084 dport=25 pattern: 1 dst 100.64.39.160

malicious

0.6

["T1041", "T1190", "T1567"]

1659449507

lead.observed_at

incident_lead

ORG-0003

2ed85610-11a1-11ed-ad5e-9b7c40b93c4a

flow

meraki

syslog

100.64.39.180

100.64.39.160

49312

192.168.18.25

block

<134>Original Address=192.168.92.29 1 1659361956.349731307 NORDC_MX400_1 flows src=100.64.39.180 dst=100.64.39.160 protocol=tcp sport=49312 dport=25 pattern: 1 dst 100.64.39.160

malicious

0.6

["T1041", "T1190", "T1567"]

1659449507

lead.observed_at

incident_lead

ORG-0003

2f25d9d0-11a1-11ed-ad5e-9b7c40b93c4a

flow

meraki

syslog

100.64.39.181

100.64.39.160

37395

192.168.18.25

block

<134>Original Address=192.168.92.29 1 1659361956.393028642 NORDC_MX400_1 flows src=100.64.39.181 dst=100.64.39.160 protocol=tcp sport=37395 dport=25 pattern: 1 dst 100.64.39.160

malicious

0.6

["T1041", "T1190", "T1567"]

1666410603

lead.observed_at

incident_lead

ORG-0005

e7565a80-51b5-11ed-a993-45afbbdb8b61

firewall_action

cisco_asa

syslog

100.64.39.182

10.147.100.191

55763

3306

10.108.101.52

block

warning

ASA-4-106023

<164>Oct 21 2022 20:23:11: %ASA-4-106023: Deny tcp src outside:100.64.39.182/55763 dst dmz-1:10.147.100.191/3306 by access-group "outside_access_in" [0x0, 0x0]

malicious

0.6

["T1041", "T1190", "T1567"]

1666410603

lead.observed_at

incident_lead

ORG-0005

f1438d60-51b5-11ed-a993-45afbbdb8b61

firewall_action

cisco_asa

syslog

10.147.100.191

100.64.39.183

52609

40784

10.108.101.52

block

warning

ASA-4-106023

<164>Oct 21 2022 20:23:27: %ASA-4-106023: Deny tcp src outside:100.64.39.183/40784 dst dmz-1:10.147.100.191/52609 by access-group "outside_access_in" [0x0, 0x0]

malicious

0.6

["T1041", "T1190", "T1567"]

1666410701

lead.observed_at

incident_lead

ORG-0005

3e2d7e60-51b6-11ed-a779-437e8d1a2042

firewall_action

cisco_asa

syslog

100.64.39.182

10.0.139.216

55763

3306

10.108.101.52

block

warning

ASA-4-106023

<164>Oct 21 2022 20:25:57: %ASA-4-106023: Deny tcp src outside:100.64.39.182/55763 dst dmz-1:10.0.139.216/3306 by access-group "outside_access_in" [0x0, 0x0]

malicious

0.6

["T1041", "T1190", "T1567"]

1660466769

lead.observed_at

incident_lead

ORG-0005

1d865c70-1b03-11ed-b71f-0364827bcf51

firewall_action

cisco_asa

syslog

100.64.39.184

10.71.234.214

18517

10.108.101.52

block

warning

ASA-4-106023

<164>Aug 13 2022 05:44:54: %ASA-4-106023: Deny tcp src outside:100.64.39.184/18517 dst dmz-1:10.71.234.214/23 by access-group "outside_access_in" [0x0, 0x0]

malicious

0.6

["T1041", "T1190", "T1567"]

1660466769

lead.observed_at

incident_lead

ORG-0005

02911db2-1b03-11ed-b71f-0364827bcf51

firewall_action

cisco_asa

syslog

100.64.39.185

10.71.234.214

17268

175

10.108.101.52

block

warning

ASA-4-106023

<164>Aug 13 2022 05:44:09: %ASA-4-106023: Deny tcp src outside:100.64.39.185/17268 dst dmz-1:10.71.234.214/175 by access-group "outside_access_in" [0x0, 0x0]

malicious

0.6

["T1041", "T1190", "T1567"]

1660466769

lead.observed_at

incident_lead

ORG-0005

34436fc0-1b03-11ed-b71f-0364827bcf51

firewall_action

cisco_asa

syslog

100.64.39.186

10.71.234.214

51817

10073

10.108.101.52

block

warning

ASA-4-106023

<164>Aug 13 2022 05:45:32: %ASA-4-106023: Deny tcp src outside:100.64.39.186/51817 dst dmz-1:10.71.234.214/10073 by access-group "outside_access_in" [0x0, 0x0]

malicious

0.6

["T1041", "T1190", "T1567"]

1660466769

lead.observed_at

incident_lead

ORG-0005

40c46ce0-1b03-11ed-b71f-0364827bcf51

firewall_action

cisco_asa

syslog

100.64.34.174

10.71.234.214

46077

5985

10.108.101.52

block

warning

ASA-4-106023

<164>Aug 13 2022 05:45:53: %ASA-4-106023: Deny tcp src outside:100.64.34.174/46077 dst dmz-1:10.71.234.214/5985 by access-group "outside_access_in" [0x0, 0x0]

malicious

0.6

["T1041", "T1190", "T1567"]

1660466769

lead.observed_at

incident_lead

ORG-0005

5269f140-1b03-11ed-b71f-0364827bcf51

firewall_action

cisco_asa

syslog

100.64.39.187

10.71.234.214

51599

10.108.101.52

block

warning

ASA-4-106023

<164>Aug 13 2022 05:46:21: %ASA-4-106023: Deny tcp src outside:100.64.39.187/51599 dst dmz-1:10.71.234.214/25 by access-group "outside_access_in" [0x0, 0x0]

malicious

0.6

["T1041", "T1190", "T1567"]

1656556847

lead.observed_at

incident_lead

ORG-0003

1b751755-f722-11ec-a0ca-214da56cc5fc

flow

meraki

syslog

100.64.39.189

100.64.39.188

52968

32127

192.168.18.25

block

<134>Original Address=100.64.40.28 1 1656448430.776097520 M34_MX67C_Atlanta flows src=100.64.39.189 dst=100.64.39.188 protocol=tcp sport=52968 dport=32127 pattern: 1 all

malicious

0.6

["T1041", "T1190", "T1567"]

1656578220

lead.observed_at

incident_lead

ORG-0003

01090420-f782-11ec-a0ca-214da56cc5fc

flow

meraki

syslog

100.64.39.190

100.64.39.191

52721

192.168.18.25

block

<134>Original Address=192.168.92.29 1 1656489800.491526715 NORDC_MX400_1 flows src=100.64.39.190 dst=100.64.39.191 protocol=tcp sport=52721 dport=23 pattern: 1 all

malicious

0.6

["T1041", "T1190", "T1567"]

1656414574

lead.observed_at

incident_lead

ORG-0003

fcb98140-f5ee-11ec-a0ca-214da56cc5fc

flow

meraki

syslog

100.64.39.192

100.64.39.193

59362

192.168.18.25

block

<134>Original Address=100.64.39.161 1 1656316704.731221245 M52_MX67C_Loxley flows src=100.64.39.192 dst=100.64.39.193 protocol=tcp sport=59362 dport=23 pattern: 1 all

malicious

0.6

["T1041", "T1190", "T1567"]

1663691233

lead.observed_at

incident_lead

ORG-0003

5c27a0b0-38f4-11ed-872d-55977242b480

flow

meraki

syslog

100.64.39.195

100.64.39.160

6688

192.168.18.25

block

<134>Original Address=192.168.92.29 1 1663685767.313451814 NORDC_MX400_1 flows src=100.64.39.195 dst=100.64.39.160 protocol=tcp sport=6688 dport=25 pattern: 1 dst 100.64.39.160

malicious

0.6

["T1041", "T1190", "T1567"]

1663691233

lead.observed_at

incident_lead

ORG-0003

5c983cd0-38f4-11ed-872d-55977242b480

flow

meraki

syslog

100.64.39.194

100.64.39.160

26974

192.168.18.25

block

<134>Original Address=192.168.92.29 1 1663685767.715168658 NORDC_MX400_1 flows src=100.64.39.194 dst=100.64.39.160 protocol=tcp sport=26974 dport=25 pattern: 1 dst 100.64.39.160

malicious

0.6

["T1041", "T1190", "T1567"]

1661998930

lead.observed_at

incident_lead

ORG-0005

13c6ee31-28d6-11ed-956a-3d9aa6fa1bc8

firewall_action

cisco_asa

syslog

10.147.100.191

100.64.32.199

40063

6992

10.108.101.52

block

warning

ASA-4-106023

<164>Aug 30 2022 19:59:59: %ASA-4-106023: Deny tcp src outside:100.64.32.199/6992 dst dmz-1:10.147.100.191/40063 by access-group "outside_access_in" [0x0, 0x0]

malicious

0.6

["T1041", "T1190", "T1567"]

1661998930

lead.observed_at

incident_lead

ORG-0005

36bb4b70-28d6-11ed-956a-3d9aa6fa1bc8

firewall_action

cisco_asa

syslog

100.64.31.216

10.147.100.191

31240

514

10.108.101.52

block

warning

ASA-4-106023

<164>Aug 30 2022 20:01:00: %ASA-4-106023: Deny udp src outside:100.64.31.216/31240 dst dmz-1:10.147.100.191/514 by access-group "outside_access_in" [0x0, 0x0]

malicious

0.6

["T1041", "T1190", "T1567"]

1661998930

lead.observed_at

incident_lead

ORG-0005

36c00660-28d6-11ed-956a-3d9aa6fa1bc8

firewall_action

cisco_asa

syslog

100.64.31.216

10.147.100.191

31240

514

10.108.101.52

block

warning

ASA-4-106023

<164>Aug 30 2022 20:01:00: %ASA-4-106023: Deny udp src outside:100.64.31.216/31240 dst dmz-1:10.147.100.191/514 by access-group "outside_access_in" [0x0, 0x0]

malicious

0.6

["T1041", "T1190", "T1567"]

1661998930

lead.observed_at

incident_lead

ORG-0005

4ccdedf0-28d6-11ed-956a-3d9aa6fa1bc8

firewall_action

cisco_asa

syslog

100.64.31.216

10.147.100.191

31240

514

10.108.101.52

block

warning

ASA-4-106023

<164>Aug 30 2022 20:01:37: %ASA-4-106023: Deny udp src outside:100.64.31.216/31240 dst dmz-1:10.147.100.191/514 by access-group "outside_access_in" [0x0, 0x0]

malicious

0.6

["T1041", "T1190", "T1567"]

1661998930

lead.observed_at

incident_lead

ORG-0005

4cd281d0-28d6-11ed-956a-3d9aa6fa1bc8

firewall_action

cisco_asa

syslog

100.64.31.216

10.147.100.191

31240

514

10.108.101.52

block

warning

ASA-4-106023

<164>Aug 30 2022 20:01:37: %ASA-4-106023: Deny udp src outside:100.64.31.216/31240 dst dmz-1:10.147.100.191/514 by access-group "outside_access_in" [0x0, 0x0]

malicious

0.6

["T1041", "T1190", "T1567"]

1661998930

lead.observed_at

incident_lead

ORG-0005

62bd9f20-28d6-11ed-956a-3d9aa6fa1bc8

firewall_action

cisco_asa

syslog

100.64.39.196

10.147.100.191

58848

10.108.101.52

block

warning

ASA-4-106023

<164>Aug 30 2022 20:02:14: %ASA-4-106023: Deny tcp src outside:100.64.39.196/58848 dst dmz-1:10.147.100.191/22 by access-group "outside_access_in" [0x0, 0x0]

malicious

0.6

["T1041", "T1190", "T1567"]

1661998930

lead.observed_at

incident_lead

ORG-0005

691d8c90-28d6-11ed-956a-3d9aa6fa1bc8

firewall_action

cisco_asa

syslog

100.64.33.92

10.147.100.191

38146

5242

10.108.101.52

block

warning

ASA-4-106023

<164>Aug 30 2022 20:02:24: %ASA-4-106023: Deny tcp src outside:100.64.33.92/38146 dst dmz-1:10.147.100.191/5242 by access-group "outside_access_in" [0x0, 0x0]

malicious

0.6

["T1041", "T1190", "T1567"]

1659420308

lead.observed_at

incident_lead

ORG-0003

53a4be30-111e-11ed-ad5e-9b7c40b93c4a

flow

meraki

syslog

100.64.39.197

100.64.39.198

15736

12451

192.168.18.25

block

<134>Original Address=100.64.49.79 1 1659305585.245002055 M44_MX67C_WarnerRobins flows src=100.64.39.197 dst=100.64.39.198 protocol=tcp sport=15736 dport=12451 pattern: 1 all

malicious

0.6

["T1041", "T1190", "T1567"]

1659420311

lead.observed_at

incident_lead

ORG-0003

55f93580-111e-11ed-ad5e-9b7c40b93c4a

flow

meraki

syslog

100.64.39.199

100.64.39.200

60589

192.168.18.25

block

<134>Original Address=192.168.92.29 1 1659305577.442762532 NORDC_MX400_1 flows src=100.64.39.199 dst=100.64.39.200 protocol=tcp sport=60589 dport=80 pattern: 1 all

malicious

0.6

["T1041", "T1190", "T1567"]

1659420393

lead.observed_at

incident_lead

ORG-0003

742ada90-111e-11ed-ad5e-9b7c40b93c4a

flow

meraki

syslog

100.64.39.201

100.64.39.200

19919

1557

192.168.18.25

block

<134>Original Address=192.168.92.29 1 1659305829.579841616 NORDC_MX400_1 flows src=100.64.39.201 dst=100.64.39.200 protocol=tcp sport=19919 dport=1557 pattern: 1 all

malicious

0.6

["T1041", "T1190", "T1567"]

1660428991

lead.observed_at

incident_lead

ORG-0003

b3f12341-1a89-11ed-b536-c7f669dd3585

flow

meraki

syslog

100.64.39.202

100.64.39.203

14636

8082

192.168.18.25

block

<134>Original Address=100.64.39.203 1 1660341417.648877984 M38_MX67C_Conyers flows src=100.64.39.202 dst=100.64.39.203 protocol=udp sport=14636 dport=8082 pattern: 1 all

malicious

0.6

["T1041", "T1190", "T1567"]

1660436227

lead.observed_at

incident_lead

ORG-0003

e84576c1-1a91-11ed-b536-c7f669dd3585

flow

meraki

syslog

100.64.39.204

100.64.39.205

50404

5555

192.168.18.25

block

<134>Original Address=100.64.40.28 1 1660344803.000089912 M34_MX67C_Atlanta flows src=100.64.39.204 dst=100.64.39.205 protocol=tcp sport=50404 dport=5555 pattern: 1 all

malicious

0.6

["T1041", "T1190", "T1567"]