Soc alerts delete (#116)
* Add delete_alert_route to alerts.py and implement delete_alert function in services.py * Add delete_multiple_alerts_route to alerts.py * Rearranged bookmark and delete functionality for alerts Increase per_page limit for bookmarked alerts * Add delete_integration endpoint to routes.py * Refactor integration deletion code * added soc alert delete apis * updated soc case delete handler * added soc alerts mock * added soc alerts actions * updated agent flow tabs * added soc alert purge action * removed chrome-network-overrides folder * added soc alert deleteMultiple action * updated indeterminate pagination component * improved soc alerts bookmark sync * fixed soc alert purge --------- Co-authored-by: Davide Di Modica <webmaster.ddm@gmail.com>
taylor_socfortress committed
Jan 16, 2024 at 13:12 UTC
29fbfb55583d7277da47c75f487bafe729eba77c
18 files changed
+10111
-136
backend/app/connectors/dfir_iris/routes/alerts.py
+64
-4
@@ -7,12 +7,12 @@ from loguru import logger
7
from app.auth.utils import AuthHandler
8
from app.connectors.dfir_iris.schema.alerts import AlertResponse
9
from app.connectors.dfir_iris.schema.alerts import AlertsResponse
10
-from app.connectors.dfir_iris.schema.alerts import BookmarkedAlertsResponse, FilterAlertsRequest, CaseCreationResponse
10
+from app.connectors.dfir_iris.schema.alerts import BookmarkedAlertsResponse, FilterAlertsRequest, CaseCreationResponse, DeleteAlertResponse, DeleteMultipleAlertsRequest
11
from app.connectors.dfir_iris.services.alerts import bookmark_alert
12
from app.connectors.dfir_iris.services.alerts import get_alert
13
from app.connectors.dfir_iris.services.alerts import get_alerts
14
from app.connectors.dfir_iris.services.alerts import create_case
15
-from app.connectors.dfir_iris.services.alerts import get_bookmarked_alerts
15
+from app.connectors.dfir_iris.services.alerts import get_bookmarked_alerts, delete_alert
16
from app.connectors.dfir_iris.utils.universal import check_alert_exists
17
18
# App specific imports
@@ -154,12 +154,11 @@ async def bookmark_alert_route(alert_id: str = Depends(verify_alert_exists)) ->
154
alert_id (str): The ID of the alert to be bookmarked.
155
156
Returns:
157
- AlertResponse: The response containing the bookmarked alert.
157
+ DeleteAlertResponse: The response containing the bookmarked alert.
158
"""
159
logger.info(f"Bookmarking alert {alert_id}")
160
return await bookmark_alert(alert_id, bookmarked=True)
161
162
-
162
@dfir_iris_alerts_router.delete(
163
"/bookmark/{alert_id}",
164
response_model=AlertResponse,
@@ -178,3 +177,64 @@ async def unbookmark_alert_route(alert_id: str = Depends(verify_alert_exists)) -
177
"""
178
logger.info(f"Unbookmarking alert {alert_id}")
179
return await bookmark_alert(alert_id, bookmarked=False)
180
+
181
+
182
+@dfir_iris_alerts_router.post(
183
+ "/delete_multiple",
184
+ response_model=DeleteAlertResponse,
185
+ description="Delete multiple alerts",
186
+ dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
187
+)
188
+async def delete_multiple_alerts_route(request: DeleteMultipleAlertsRequest) -> DeleteAlertResponse:
189
+ """
190
+ Delete multiple alerts.
191
+
192
+ Args:
193
+ request (DeleteMultipleAlertsRequest): The request containing the IDs of the alerts to delete.
194
+
195
+ Returns:
196
+ DeleteAlertResponse: The response containing the deleted alerts.
197
+ """
198
+ logger.info(f"Deleting alerts {request.alert_ids}")
199
+ for alert_id in request.alert_ids:
200
+ await verify_alert_exists(alert_id)
201
+ await delete_alert(int(alert_id))
202
+ return DeleteAlertResponse(success=True, message="Successfully deleted alerts.")
203
+
204
+@dfir_iris_alerts_router.delete(
205
+ "/purge",
206
+ response_model=DeleteAlertResponse,
207
+ description="Delete all alerts",
208
+ dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
209
+)
210
+async def purge_alerts_route() -> DeleteAlertResponse:
211
+ """
212
+ Delete all alerts.
213
+
214
+ Returns:
215
+ AlertResponse: The response containing the deleted alerts.
216
+ """
217
+ logger.info(f"Purging all alerts, up to 1000")
218
+ alerts = (await get_alerts(request=FilterAlertsRequest(per_page=1000))).alerts
219
+ for alert in alerts:
220
+ await delete_alert(int(alert["alert_id"]))
221
+ return DeleteAlertResponse(success=True, message="Successfully deleted alerts.")
222
+
223
+@dfir_iris_alerts_router.delete(
224
+ "/{alert_id}",
225
+ response_model=DeleteAlertResponse,
226
+ description="Delete an alert",
227
+ dependencies=[Security(AuthHandler().require_any_scope("admin", "analyst"))],
228
+)
229
+async def delete_alert_route(alert_id: str = Depends(verify_alert_exists)) -> DeleteAlertResponse:
230
+ """
231
+ Delete an alert.
232
+
233
+ Args:
234
+ alert_id (str): The ID of the alert to delete.
235
+
236
+ Returns:
237
+ AlertResponse: The response containing the deleted alert.
238
+ """
239
+ logger.info(f"Deleting alert {alert_id}")
240
+ return await delete_alert(int(alert_id))
backend/app/connectors/dfir_iris/schema/alerts.py
+7
@@ -25,6 +25,13 @@ class BookmarkedAlertsResponse(BaseModel):
25
message: str
26
success: bool
27
28
+class DeleteMultipleAlertsRequest(BaseModel):
29
+ alert_ids: List[str] = Field([], description="The IDs of the alerts to delete.")
30
+
31
+class DeleteAlertResponse(BaseModel):
32
+ message: str
33
+ success: bool
34
+
35
class SortOrder(Enum):
36
desc = "desc"
37
asc = "asc"
backend/app/connectors/dfir_iris/services/alerts.py
+17
-2
@@ -1,6 +1,6 @@
1
from app.connectors.dfir_iris.schema.alerts import AlertResponse
2
from app.connectors.dfir_iris.schema.alerts import AlertsResponse
3
-from app.connectors.dfir_iris.schema.alerts import BookmarkedAlertsResponse, FilterAlertsRequest, CaseCreationResponse
3
+from app.connectors.dfir_iris.schema.alerts import BookmarkedAlertsResponse, FilterAlertsRequest, CaseCreationResponse, DeleteAlertResponse
4
from app.connectors.dfir_iris.utils.universal import fetch_and_validate_data
5
from app.connectors.dfir_iris.utils.universal import initialize_client_and_alert
6
from loguru import logger
@@ -134,7 +134,7 @@ async def get_bookmarked_alerts() -> BookmarkedAlertsResponse:
134
Returns:
135
BookmarkedAlertsResponse: The response object containing the bookmarked alerts.
136
"""
137
- alerts = await get_alerts(request=FilterAlertsRequest(per_page=1000))
137
+ alerts = await get_alerts(request=FilterAlertsRequest(per_page=10000))
138
alerts = alerts.alerts
139
bookmarked_alerts = []
140
for alert in alerts:
@@ -142,3 +142,18 @@ async def get_bookmarked_alerts() -> BookmarkedAlertsResponse:
142
bookmarked_alerts.append(alert)
143
144
return BookmarkedAlertsResponse(success=True, message="Successfully fetched bookmarked alerts", bookmarked_alerts=bookmarked_alerts)
145
+
146
+
147
+async def delete_alert(alert_id: int) -> DeleteAlertResponse:
148
+ """
149
+ Deletes an alert.
150
+
151
+ Args:
152
+ alert_id (int): The ID of the alert to delete.
153
+
154
+ Returns:
155
+ DeleteAlertResponse: The response object containing the success status, message, and deleted alert.
156
+ """
157
+ client, alert = await initialize_client_and_alert("DFIR-IRIS")
158
+ result = await fetch_and_validate_data(client, alert.delete_alert, alert_id)
159
+ return DeleteAlertResponse(success=True, message="Successfully deleted alert", alert=result["data"])
backend/app/integrations/routes.py
+102
-2
@@ -7,6 +7,8 @@ from loguru import logger
7
from sqlalchemy.ext.asyncio import AsyncSession
8
from sqlalchemy.future import select
9
from sqlalchemy.orm import joinedload
10
+from sqlalchemy.exc import NoResultFound
11
+from sqlalchemy import delete
12
13
from app.db.db_session import get_db
14
from app.integrations.models.customer_integration_settings import (
@@ -25,7 +27,7 @@ from app.integrations.models.customer_integration_settings import (
27
IntegrationMetadata, AvailableIntegrations
28
)
29
from app.db.universal_models import Customers
28
-from app.integrations.schema import AvailableIntegrationsResponse, CustomerIntegrationCreate, CreateIntegrationService, CreateIntegrationMetadata, CustomerIntegrationCreateResponse, CustomerIntegrationsResponse
30
+from app.integrations.schema import AvailableIntegrationsResponse, CustomerIntegrationCreate, CreateIntegrationService, CreateIntegrationMetadata, CustomerIntegrationCreateResponse, CustomerIntegrationsResponse, DeleteCustomerIntegration, CustomerIntegrationDeleteResponse
31
32
integration_settings_router = APIRouter()
33
@@ -110,6 +112,69 @@ async def create_integration_subscription(customer_integrations: CustomerIntegra
112
session.add(new_integration_subscription)
113
await session.commit()
114
115
+async def get_customer_and_service_ids(session, customer_code, integration_name):
116
+ try:
117
+ result = await session.execute(
118
+ select(CustomerIntegrations.id, IntegrationService.id)
119
+ .join(IntegrationSubscription, CustomerIntegrations.id == IntegrationSubscription.customer_id)
120
+ .join(IntegrationService, IntegrationSubscription.integration_service_id == IntegrationService.id)
121
+ .where(CustomerIntegrations.customer_code == customer_code,
122
+ IntegrationService.service_name == integration_name)
123
+ )
124
+ return result.one()
125
+ except NoResultFound:
126
+ raise HTTPException(status_code=404, detail="Customer integration not found")
127
+
128
+async def get_subscription_ids(session, customer_id, integration_service_id):
129
+ result = await session.execute(
130
+ select(IntegrationSubscription.id)
131
+ .where(IntegrationSubscription.customer_id == customer_id,
132
+ IntegrationSubscription.integration_service_id == integration_service_id)
133
+ )
134
+ # Fetch all results
135
+ subscription_ids_raw = result.scalars().all()
136
+
137
+ # Process the results
138
+ # If the result is a list of tuples (even with one element), extract the first element
139
+ if subscription_ids_raw and isinstance(subscription_ids_raw[0], tuple):
140
+ return [id_tuple[0] for id_tuple in subscription_ids_raw]
141
+ # If the result is a list of integers
142
+ elif subscription_ids_raw and isinstance(subscription_ids_raw[0], int):
143
+ return subscription_ids_raw
144
+ # If there are no results
145
+ else:
146
+ return []
147
+
148
+async def delete_metadata(session, subscription_ids):
149
+ await session.execute(
150
+ delete(IntegrationMetadata)
151
+ .where(IntegrationMetadata.subscription_id.in_(subscription_ids))
152
+ )
153
+
154
+async def delete_subscriptions(session, subscription_ids):
155
+ await session.execute(
156
+ delete(IntegrationSubscription)
157
+ .where(IntegrationSubscription.id.in_(subscription_ids))
158
+ )
159
+
160
+async def delete_configs(session, integration_service_id):
161
+ await session.execute(
162
+ delete(IntegrationConfig)
163
+ .where(IntegrationConfig.integration_service_id == integration_service_id)
164
+ )
165
+
166
+async def delete_integration_service(session, integration_service_id):
167
+ await session.execute(
168
+ delete(IntegrationService)
169
+ .where(IntegrationService.id == integration_service_id)
170
+ )
171
+
172
+async def delete_customer_integration_record(session, customer_id):
173
+ await session.execute(
174
+ delete(CustomerIntegrations)
175
+ .where(CustomerIntegrations.id == customer_id)
176
+ )
177
+
178
@integration_settings_router.get(
179
"/available_integrations",
180
response_model=AvailableIntegrationsResponse,
@@ -204,7 +269,7 @@ async def create_integration(
269
await validate_customer_code(customer_integration_create.customer_code, session)
270
await check_existing_customer_integration(customer_integration_create.customer_code, customer_integration_create.integration_name, session)
271
207
- integration_service = await create_integration_service(customer_integration_create.integration_name, settings=customer_integration_create.integration_details, session=session)
272
+ integration_service = await create_integration_service(customer_integration_create.integration_name, settings=customer_integration_create.integration_config, session=session)
273
customer_integrations = await create_customer_integrations(customer_integration_create.customer_code, customer_integration_create.customer_name, session)
274
await create_integration_subscription(customer_integrations, integration_service, integration_metadata=customer_integration_create.integration_metadata, session=session)
275
@@ -212,3 +277,38 @@ async def create_integration(
277
message=f"Customer integration {customer_integration_create.customer_code} {customer_integration_create.integration_name} successfully created.",
278
success=True,
279
)
280
+
281
+
282
+@integration_settings_router.delete(
283
+ "/delete_integration",
284
+ response_model=CustomerIntegrationDeleteResponse,
285
+ description="Delete a customer integration."
286
+)
287
+async def delete_integration(
288
+ delete_customer_integration: DeleteCustomerIntegration,
289
+ session: AsyncSession = Depends(get_db),
290
+):
291
+ customer_code = delete_customer_integration.customer_code
292
+ integration_name = delete_customer_integration.integration_name
293
+
294
+ customer_id, integration_service_id = await get_customer_and_service_ids(
295
+ session, customer_code, integration_name
296
+ )
297
+
298
+ subscription_ids = await get_subscription_ids(session, customer_id, integration_service_id)
299
+ if not subscription_ids:
300
+ raise HTTPException(status_code=404, detail="No subscriptions found for customer integration")
301
+
302
+ await delete_metadata(session, subscription_ids)
303
+ await delete_subscriptions(session, subscription_ids)
304
+ await delete_configs(session, integration_service_id)
305
+ await delete_integration_service(session, integration_service_id)
306
+ await delete_customer_integration_record(session, customer_id)
307
+
308
+ await session.commit()
309
+
310
+ return CustomerIntegrationDeleteResponse(
311
+ message=f"Customer integration {customer_code} {integration_name} successfully deleted.",
312
+ success=True,
313
+ )
314
+
backend/app/integrations/schema.py
+24
-2
@@ -63,9 +63,9 @@ class CustomerIntegrationCreate(BaseModel):
63
integration_name: str = Field(
64
...,
65
description="The integration name.",
66
- examples=["mimecast"],
66
+ examples=["Mimecast"],
67
)
68
- integration_details: CreateIntegrationService = Field(
68
+ integration_config: CreateIntegrationService = Field(
69
...,
70
description="The integration service.",
71
)
@@ -84,6 +84,16 @@ class CustomerIntegrationCreateResponse(BaseModel):
84
description="The success status.",
85
)
86
87
+class CustomerIntegrationDeleteResponse(BaseModel):
88
+ message: str = Field(
89
+ ...,
90
+ description="The message.",
91
+ )
92
+ success: bool = Field(
93
+ ...,
94
+ description="The success status.",
95
+ )
96
+
97
# class IntegrationConfig(BaseModel):
98
# config_id: int
99
# config_value: str
@@ -140,3 +150,15 @@ class CustomerIntegrationsResponse(BaseModel):
150
available_integrations: List[CustomerIntegrations]
151
message: str
152
success: bool
153
+
154
+class DeleteCustomerIntegration(BaseModel):
155
+ customer_code: str = Field(
156
+ ...,
157
+ description="The customer code.",
158
+ examples=["00002"],
159
+ )
160
+ integration_name: str = Field(
161
+ ...,
162
+ description="The integration name.",
163
+ examples=["Mimecast"],
164
+ )
src/api/soc.ts
+12
@@ -54,6 +54,18 @@ export default {
54
removeAlertBookmark(alertId: string) {
55
return HttpClient.delete<FlaskBaseResponse & { alert: SocAlert }>(`/soc/alerts/bookmark/${alertId}`)
56
},
57
+ deleteAlert(alertId: string) {
58
+ return HttpClient.delete<FlaskBaseResponse>(`/soc/alerts/${alertId}`)
59
+ },
60
+ deleteMultipleAlerts(alertIds: string[]) {
61
+ return HttpClient.post<FlaskBaseResponse>(`/soc/alerts/delete_multiple`, {
62
+ alert_ids: alertIds
63
+ })
64
+ },
65
+ /** Delete all alerts (up to 1000 per time) */
66
+ purgeAlerts() {
67
+ return HttpClient.delete<FlaskBaseResponse>(`/soc/alerts/purge`)
68
+ },
69
createCase(alertId: string) {
70
return HttpClient.post<FlaskBaseResponse & { case: SocAlertCaseResponse }>(`/soc/alerts/create_case/${alertId}`)
71
},
src/components/agents/agentFlow/AgentFlowItem.vue
+15
-2
@@ -78,6 +78,20 @@
78
</KVCard>
79
</div>
80
</n-tab-pane>
81
+ <n-tab-pane name="Backtrace" tab="Backtrace" display-directive="show">
82
+ <div class="p-7 pt-4">
83
+ <n-input
84
+ :value="flow.backtrace"
85
+ type="textarea"
86
+ readonly
87
+ placeholder="Empty"
88
+ :autosize="{
89
+ minRows: 3,
90
+ maxRows: 18
91
+ }"
92
+ />
93
+ </div>
94
+ </n-tab-pane>
95
<n-tab-pane name="Timeline" tab="Timeline" display-directive="show:lazy">
96
<div class="p-7 pt-4">
97
<AgentFlowTimeline :flow="flow" />
@@ -135,7 +149,7 @@
149
</template>
150
151
<script setup lang="ts">
138
-import { NPopover, NModal, NTabs, NTabPane, NEmpty, NScrollbar } from "naive-ui"
152
+import { NPopover, NModal, NTabs, NTabPane, NEmpty, NScrollbar, NInput } from "naive-ui"
153
import { useSettingsStore } from "@/stores/settings"
154
import dayjs from "@/utils/dayjs"
155
import type { FlowResult } from "@/types/flow.d"
@@ -164,7 +178,6 @@ const executionDuration = computed(() => dayjs.duration(flow.execution_duration)
178
179
const properties = computed(() => {
180
return _pick(flow, [
167
- "backtrace",
181
"client_id",
182
"next_response_id",
183
"outstanding_requests",
src/components/agents/agentFlow/AgentFlowQueryStat.vue
+15
-2
@@ -68,13 +68,27 @@
68
</KVCard>
69
</div>
70
</n-tab-pane>
71
+ <n-tab-pane name="Backtrace" tab="Backtrace" display-directive="show">
72
+ <div class="p-7 pt-4">
73
+ <n-input
74
+ :value="stat.backtrace"
75
+ type="textarea"
76
+ readonly
77
+ placeholder="Empty"
78
+ :autosize="{
79
+ minRows: 3,
80
+ maxRows: 18
81
+ }"
82
+ />
83
+ </div>
84
+ </n-tab-pane>
85
</n-tabs>
86
</n-modal>
87
</div>
88
</template>
89
90
<script setup lang="ts">
77
-import { NModal, NTabs, NTabPane } from "naive-ui"
91
+import { NModal, NTabs, NTabPane, NInput } from "naive-ui"
92
import { useSettingsStore } from "@/stores/settings"
93
import dayjs from "@/utils/dayjs"
94
import type { FlowQueryStat } from "@/types/flow.d"
@@ -95,7 +109,6 @@ const duration = computed(() => dayjs.duration(stat.duration).humanize())
109
110
const properties = computed(() => {
111
return _pick(stat, [
98
- "backtrace",
112
"Artifact",
113
"log_rows",
114
"uploaded_files",
src/components/common/PaginationIndeterminate.vue
+3
-2
@@ -26,6 +26,7 @@
26
/>
27
<n-select
28
size="small"
29
+ v-if="showSort"
30
v-model:value="sort"
31
:options="sortOptions"
32
:show-checkmark="false"
@@ -46,8 +47,8 @@ const page = defineModel<number>("page", { default: 1 })
47
const pageSize = defineModel<number>("pageSize", { default: 10 })
48
const sort = defineModel<"asc" | "desc">("sort", { default: "desc" })
49
49
-const props = defineProps<{ showPageSizes?: boolean; pageSizes?: number[]; disabled?: boolean }>()
50
-const { pageSizes, disabled, showPageSizes } = toRefs(props)
50
+const props = defineProps<{ showPageSizes?: boolean; showSort?: boolean; pageSizes?: number[]; disabled?: boolean }>()
51
+const { pageSizes, disabled, showPageSizes, showSort } = toRefs(props)
52
53
const pageSizesOptions = computed(() =>
54
(pageSizes.value || [10, 25, 50, 100]).map(o => ({ label: o + " / page", value: o }))
src/components/common/SearchDialog.vue
+1
-1
@@ -88,7 +88,7 @@ const ArrowEnterIcon = "fluent:arrow-enter-left-24-regular"
88
const ArrowSortIcon = "fluent:arrow-sort-24-regular"
89
const FullScreenIcon = "fluent:full-screen-maximize-24-regular"
90
const DarkModeIcon = "ion:moon-outline"
91
-const CloseIcon = "ion:close"
91
+const CloseIcon = "carbon:close"
92
93
const ConnectorsIcon = "carbon:hybrid-networking"
94
const AlertsIcon = "carbon:warning-hex"
src/components/soc/SocAlerts/SocAlertItem.vue
+60
-89
@@ -1,13 +1,17 @@
1
<template>
2
<n-spin
3
:show="loading"
4
+ :description="loadingDelete ? 'Deleting Soc Alert' : 'Loading Soc Alert'"
5
class="soc-alert-item flex flex-col gap-0"
6
:class="{ bookmarked: isBookmark, highlight, embedded }"
7
:id="'alert-' + alert?.alert_id"
8
>
8
- <div class="soc-alert-info px-5 py-3 flex flex-col gap-2" v-if="alert">
9
+ <div class="soc-alert-info px-5 py-3 flex flex-col gap-3" v-if="alert">
10
<div class="header-box flex justify-between">
11
<div class="flex items-center gap-2 cursor-pointer">
12
+ <div v-if="showCheckbox" class="check-box mr-2">
13
+ <n-checkbox size="large" v-model:checked="checked" />
14
+ </div>
15
<div class="id flex items-center gap-2 cursor-pointer" @click="showDetails = true">
16
<span>#{{ alert.alert_id }} - {{ alert.alert_uuid }}</span>
17
<Icon :name="InfoIcon" :size="16"></Icon>
@@ -47,16 +51,15 @@
51
{{ alert.alert_description }}
52
</div>
53
</div>
50
- <div class="actions flex flex-col gap-2 justify-end" v-if="!hideSocCaseAction">
51
- <n-button v-if="caseId" type="success" secondary @click="openSocCase()">
52
- <template #icon><Icon :name="ViewIcon"></Icon></template>
53
- View SOC Case
54
- </n-button>
55
- <n-button :loading="loadingCaseCreation" type="warning" secondary @click="createCase()" v-else>
56
- <template #icon><Icon :name="DangerIcon"></Icon></template>
57
- Create SOC Case
58
- </n-button>
59
- </div>
54
+ <SocAlertItemActions
55
+ v-if="!hideSocCaseAction"
56
+ class="actions-box"
57
+ :caseId="caseId"
58
+ :alertId="alert.alert_id"
59
+ @caseCreated="caseCreated($event)"
60
+ @deleted="deleted()"
61
+ @startDeleting="loadingDelete = true"
62
+ />
63
</div>
64
65
<div>
@@ -136,23 +139,17 @@
139
</div>
140
141
<div class="footer-box flex justify-between items-center gap-4">
139
- <div class="actions" v-if="!hideSocCaseAction">
140
- <n-button v-if="caseId" type="success" secondary size="small" @click="openSocCase()">
141
- <template #icon><Icon :name="ViewIcon"></Icon></template>
142
- View SOC Case
143
- </n-button>
144
- <n-button
145
- :loading="loadingCaseCreation"
146
- size="small"
147
- type="warning"
148
- secondary
149
- @click="createCase()"
150
- v-else
151
- >
152
- <template #icon><Icon :name="DangerIcon"></Icon></template>
153
- Create SOC Case
154
- </n-button>
155
- </div>
142
+ <SocAlertItemActions
143
+ v-if="!hideSocCaseAction"
144
+ class="actions-box grow !flex-wrap !justify-start"
145
+ style="flex-direction: initial"
146
+ size="small"
147
+ :caseId="caseId"
148
+ :alertId="alert.alert_id"
149
+ @caseCreated="caseCreated($event)"
150
+ @deleted="deleted()"
151
+ @startDeleting="loadingDelete = true"
152
+ />
153
<div class="time">{{ formatDate(alert.alert_creation_time) }}</div>
154
</div>
155
</div>
@@ -170,27 +167,6 @@
167
</n-collapse-item>
168
</n-collapse>
169
173
- <n-modal
174
- v-model:show="showSocCaseDetails"
175
- preset="card"
176
- content-style="padding:0px"
177
- :style="{ maxWidth: 'min(800px, 90vw)', minHeight: 'min(250px, 90vh)', overflow: 'hidden' }"
178
- :title="`SOC Case: #${caseId}`"
179
- :bordered="false"
180
- segmented
181
- >
182
- <div class="h-full w-full flex items-center justify-center">
183
- <SocCaseItem
184
- v-if="caseId"
185
- :caseId="caseId"
186
- embedded
187
- hideSocAlertLink
188
- hide-soc-case-action
189
- class="w-full"
190
- />
191
- </div>
192
- </n-modal>
193
-
170
<n-modal
171
v-model:show="showDetails"
172
preset="card"
@@ -296,24 +272,24 @@ import type { SocAlert } from "@/types/soc/alert.d"
272
import type { Alert } from "@/types/alerts.d"
273
import Icon from "@/components/common/Icon.vue"
274
import Badge from "@/components/common/Badge.vue"
299
-import { computed, onBeforeMount, ref, toRefs } from "vue"
275
+import { computed, onBeforeMount, ref, toRefs, watch } from "vue"
276
import { SimpleJsonViewer } from "vue-sjv"
277
import KVCard from "@/components/common/KVCard.vue"
278
import SocAlertTimeline from "./SocAlertTimeline.vue"
303
-import SocCaseItem from "../SocCases/SocCaseItem.vue"
279
import SocAssignUser from "./SocAssignUser.vue"
280
+import SocAlertItemActions from "./SocAlertItemActions.vue"
281
import "@/assets/scss/vuesjv-override.scss"
282
import Api from "@/api"
283
import {
284
NCollapse,
285
useMessage,
310
- NButton,
286
NCollapseItem,
287
NPopover,
288
NModal,
289
NTabs,
290
NTabPane,
291
NSpin,
292
+ NCheckbox,
293
NTooltip,
294
NCollapseTransition
295
} from "naive-ui"
@@ -322,8 +298,14 @@ import dayjs from "@/utils/dayjs"
298
import type { SocUser } from "@/types/soc/user.d"
299
import { useRouter } from "vue-router"
300
301
+const checked = defineModel<boolean>("checked", { default: false })
302
+
303
const emit = defineEmits<{
304
(e: "bookmark", value: boolean): void
305
+ (e: "deleted"): void
306
+ (e: "checked"): void
307
+ (e: "unchecked"): void
308
+ (e: "check", value: boolean): void
309
}>()
310
311
const props = defineProps<{
@@ -336,6 +318,7 @@ const props = defineProps<{
318
hideSocCaseAction?: boolean
319
hideBookmarkAction?: boolean
320
showBadgesToggle?: boolean
321
+ showCheckbox?: boolean
322
}>()
323
const { alertData, alertId, isBookmark, highlight, users, embedded, hideSocCaseAction, hideBookmarkAction } =
324
toRefs(props)
@@ -352,16 +335,13 @@ const StarActiveIcon = "carbon:star-filled"
335
const OwnerIcon = "carbon:user-military"
336
const StarIcon = "carbon:star"
337
const EditIcon = "uil:edit-alt"
355
-const DangerIcon = "majesticons:exclamation-line"
338
const LoadingIcon = "eos-icons:loading"
357
-const ViewIcon = "iconoir:eye-alt"
339
340
const showDetails = ref(false)
341
const showBadges = ref(false)
361
-const showSocCaseDetails = ref(false)
342
+const loadingDelete = ref(false)
343
const loadingData = ref(false)
344
const loadingBookmark = ref(false)
364
-const loadingCaseCreation = ref(false)
345
const router = useRouter()
346
const message = useMessage()
347
@@ -369,7 +349,7 @@ const alert = ref(alertData.value || null)
349
350
const alertObject = ref<Alert>({} as Alert)
351
372
-const loading = computed(() => loadingBookmark.value || loadingCaseCreation.value || loadingData.value)
352
+const loading = computed(() => loadingBookmark.value || loadingData.value || loadingDelete.value)
353
const ownerName = computed(() => alert.value?.owner?.user_login)
354
const ownerId = computed(() => alert.value?.owner?.id)
355
const caseId = computed<number | null>(() => (alert.value?.cases?.length ? alert.value?.cases[0] : null))
@@ -417,31 +397,6 @@ function toggleBookmark() {
397
}
398
}
399
420
-function createCase() {
421
- if (alert.value?.alert_id) {
422
- loadingCaseCreation.value = true
423
-
424
- Api.soc
425
- .createCase(alert.value.alert_id.toString())
426
- .then(res => {
427
- if (res.data.success) {
428
- if (alert.value) {
429
- alert.value.cases = [res.data.case.case_id]
430
- }
431
- message.success(res.data?.message || "SOC Case created.")
432
- } else {
433
- message.warning(res.data?.message || "An error occurred. Please try again later.")
434
- }
435
- })
436
- .catch(err => {
437
- message.error(err.response?.data?.message || "An error occurred. Please try again later.")
438
- })
439
- .finally(() => {
440
- loadingCaseCreation.value = false
441
- })
442
- }
443
-}
444
-
400
function updateAlert(alertUpdated: SocAlert) {
401
const ownerObject = alertUpdated.owner
402
const modificationHistory = alertUpdated.modification_history
@@ -456,10 +411,6 @@ function gotoUsersPage(userId?: string | number) {
411
router.push({ name: "Soc-Users", query: userId ? { user_id: userId } : {} })
412
}
413
459
-function openSocCase() {
460
- showSocCaseDetails.value = true
461
-}
462
-
414
function getAlert(id: string | number, cb?: () => void) {
415
loadingData.value = true
416
@@ -489,6 +440,26 @@ function createAlertObject() {
440
} as Alert
441
}
442
443
+function caseCreated(caseId: string | number) {
444
+ if (alert.value) {
445
+ alert.value.cases = [caseId]
446
+ }
447
+}
448
+
449
+function deleted() {
450
+ loadingDelete.value = false
451
+ emit("deleted")
452
+}
453
+
454
+watch(checked, val => {
455
+ emit("check", val)
456
+ if (val) {
457
+ emit("checked")
458
+ } else {
459
+ emit("unchecked")
460
+ }
461
+})
462
+
463
onBeforeMount(() => {
464
createAlertObject()
465
@@ -578,13 +549,13 @@ onBeforeMount(() => {
549
550
&.bookmarked {
551
background-color: var(--primary-005-color);
581
- box-shadow: 0px 0px 0px 1px inset var(--primary-030-color);
552
+ border-color: var(--primary-030-color);
553
}
554
555
&:not(.embedded) {
556
&:hover,
557
&.highlight {
587
- box-shadow: 0px 0px 0px 1px inset var(--primary-color);
558
+ border-color: var(--primary-color);
559
}
560
}
561
@@ -597,7 +568,7 @@ onBeforeMount(() => {
568
}
569
570
.main-box {
600
- .actions {
571
+ .actions-box {
572
display: none;
573
}
574
.badges-box {
src/components/soc/SocAlerts/SocAlertItemActions.vue
new
+157
@@ -0,0 +1,157 @@
1
+<template>
2
+ <div class="soc-alert-actions flex flex-col gap-2 justify-center">
3
+ <n-button v-if="existCase" type="success" secondary @click="openSocCase()" :size="size">
4
+ <template #icon><Icon :name="ViewIcon"></Icon></template>
5
+ View SOC Case
6
+ </n-button>
7
+ <n-button
8
+ :loading="loadingCaseCreation"
9
+ type="warning"
10
+ secondary
11
+ @click="createCase()"
12
+ :size="size"
13
+ v-else-if="alertId"
14
+ >
15
+ <template #icon><Icon :name="DangerIcon"></Icon></template>
16
+ Create SOC Case
17
+ </n-button>
18
+ <n-button
19
+ :loading="loadingAlertDelete"
20
+ :size="size"
21
+ type="error"
22
+ secondary
23
+ @click="handleDelete()"
24
+ v-if="alertId"
25
+ >
26
+ <template #icon><Icon :name="DeleteIcon"></Icon></template>
27
+ Delete
28
+ </n-button>
29
+
30
+ <n-modal
31
+ v-model:show="showSocCaseDetails"
32
+ preset="card"
33
+ content-style="padding:0px"
34
+ :style="{ maxWidth: 'min(800px, 90vw)', minHeight: 'min(250px, 90vh)', overflow: 'hidden' }"
35
+ :title="`SOC Case: #${caseId}`"
36
+ :bordered="false"
37
+ segmented
38
+ >
39
+ <div class="h-full w-full flex items-center justify-center">
40
+ <SocCaseItem
41
+ v-if="caseId"
42
+ :caseId="caseId"
43
+ embedded
44
+ hideSocAlertLink
45
+ hide-soc-case-action
46
+ class="w-full"
47
+ />
48
+ </div>
49
+ </n-modal>
50
+ </div>
51
+</template>
52
+
53
+<script setup lang="ts">
54
+import { NButton, useDialog, useMessage, NModal } from "naive-ui"
55
+import Icon from "@/components/common/Icon.vue"
56
+import Api from "@/api"
57
+import { computed, ref, watch } from "vue"
58
+import SocCaseItem from "../SocCases/SocCaseItem.vue"
59
+
60
+const emit = defineEmits<{
61
+ (e: "startLoading"): void
62
+ (e: "stopLoading"): void
63
+ (e: "caseCreated", value: string | number): void
64
+ (e: "deleted"): void
65
+ (e: "startDeleting"): void
66
+}>()
67
+
68
+const { alertId, caseId, size } = defineProps<{
69
+ alertId?: string | number | null
70
+ caseId?: string | number | null
71
+ size?: "tiny" | "small" | "medium" | "large"
72
+}>()
73
+
74
+const DeleteIcon = "ph:trash"
75
+const DangerIcon = "majesticons:exclamation-line"
76
+const ViewIcon = "iconoir:eye-alt"
77
+
78
+const dialog = useDialog()
79
+const message = useMessage()
80
+const showSocCaseDetails = ref(false)
81
+const loadingCaseCreation = ref(false)
82
+const loadingAlertDelete = ref(false)
83
+const loading = computed(() => loadingCaseCreation.value || loadingAlertDelete.value)
84
+
85
+const existCase = ref(!!caseId)
86
+
87
+watch(loading, val => {
88
+ emit(val ? "startLoading" : "startLoading")
89
+})
90
+
91
+function openSocCase() {
92
+ showSocCaseDetails.value = true
93
+}
94
+
95
+function createCase() {
96
+ if (alertId) {
97
+ loadingCaseCreation.value = true
98
+
99
+ Api.soc
100
+ .createCase(alertId.toString())
101
+ .then(res => {
102
+ if (res.data.success) {
103
+ existCase.value = true
104
+ emit("caseCreated", res.data.case.case_id)
105
+ message.success(res.data?.message || "SOC Case created.")
106
+ } else {
107
+ message.warning(res.data?.message || "An error occurred. Please try again later.")
108
+ }
109
+ })
110
+ .catch(err => {
111
+ message.error(err.response?.data?.message || "An error occurred. Please try again later.")
112
+ })
113
+ .finally(() => {
114
+ loadingCaseCreation.value = false
115
+ })
116
+ }
117
+}
118
+
119
+function handleDelete() {
120
+ dialog.warning({
121
+ title: "Confirm",
122
+ content: "This will delete the alert are you sure you want to proceed?",
123
+ positiveText: "Yes I'm sure",
124
+ negativeText: "Cancel",
125
+ onPositiveClick: () => {
126
+ deleteAlert()
127
+ },
128
+ onNegativeClick: () => {
129
+ message.info("Delete canceled")
130
+ }
131
+ })
132
+}
133
+
134
+function deleteAlert() {
135
+ if (alertId) {
136
+ loadingAlertDelete.value = true
137
+ emit("startDeleting")
138
+
139
+ Api.soc
140
+ .deleteAlert(alertId.toString())
141
+ .then(res => {
142
+ if (res.data.success) {
143
+ message.success(res.data?.message || "SOC Alert deleted.")
144
+ } else {
145
+ message.warning(res.data?.message || "An error occurred. Please try again later.")
146
+ }
147
+ })
148
+ .catch(err => {
149
+ message.error(err.response?.data?.message || "An error occurred. Please try again later.")
150
+ })
151
+ .finally(() => {
152
+ emit("deleted")
153
+ loadingAlertDelete.value = false
154
+ })
155
+ }
156
+}
157
+</script>
src/components/soc/SocAlerts/SocAlertsBookmarks.vue
+7
@@ -20,6 +20,7 @@
20
:is-bookmark="true"
21
:users="usersList"
22
@bookmark="bookmark()"
23
+ @deleted="itemDeleted(alert.alert_id)"
24
/>
25
</template>
26
<template v-else>
@@ -46,6 +47,7 @@ const { usersList } = toRefs(props)
47
48
const emit = defineEmits<{
49
(e: "bookmark"): void
50
+ (e: "deleted", value?: string): void
51
(e: "loaded", value: SocAlert[]): void
52
(
53
e: "mounted",
@@ -104,6 +106,11 @@ function safeReload() {
106
}, 200)
107
}
108
109
+function itemDeleted(alertId: string | number) {
110
+ getBookmarks()
111
+ emit("deleted", alertId.toString())
112
+}
113
+
114
onBeforeMount(() => {
115
getBookmarks()
116
})
src/components/soc/SocAlerts/SocAlertsFullList.vue
+12
-1
@@ -12,6 +12,7 @@
12
<SocAlertsBookmarks
13
:usersList="usersList"
14
@bookmark="reloadAlerts()"
15
+ @deleted="itemDeleted($event)"
16
@loaded="bookmarksList = $event"
17
@mounted="socAlertsBookmarksCTX = $event"
18
/>
@@ -22,6 +23,7 @@
23
:bookmarksList="bookmarksList"
24
:usersList="usersList"
25
@bookmark="reloadBookmarks()"
26
+ @deleted="reloadBookmarks()"
27
@mounted="socAlertsCTX = $event"
28
/>
29
</template>
@@ -40,6 +42,7 @@
42
:bookmarksList="bookmarksList"
43
:usersList="usersList"
44
@bookmark="reloadBookmarks()"
45
+ @deleted="reloadBookmarks()"
46
@mounted="socAlertsCTX = $event"
47
>
48
<template #header>
@@ -63,6 +66,7 @@
66
<SocAlertsBookmarks
67
:usersList="usersList"
68
@bookmark="reloadAlerts()"
69
+ @deleted="itemDeleted($event)"
70
@loaded="bookmarksList = $event"
71
@mounted="socAlertsBookmarksCTX = $event"
72
/>
@@ -95,7 +99,7 @@ const message = useMessage()
99
const bookmarksList = ref<SocAlert[]>([])
100
const usersList = ref<SocUser[]>([])
101
const socAlertsBookmarksCTX = ref<{ reload: () => void } | null>(null)
98
-const socAlertsCTX = ref<{ reload: () => void } | null>(null)
102
+const socAlertsCTX = ref<{ reload: () => void; itemDeleted: (alertId: string, noEmit?: boolean) => void } | null>(null)
103
104
const list = ref(null)
105
const showBookmarkedDrawer = ref(false)
@@ -107,10 +111,17 @@ const splitDefault = ref(0.3)
111
function reloadBookmarks() {
112
socAlertsBookmarksCTX.value?.reload()
113
}
114
+
115
function reloadAlerts() {
116
socAlertsCTX.value?.reload()
117
}
118
119
+function itemDeleted(alertId?: string) {
120
+ if (alertId) {
121
+ socAlertsCTX.value?.itemDeleted(alertId, true)
122
+ }
123
+}
124
+
125
function getUsers() {
126
Api.soc
127
.getUsers()
src/components/soc/SocAlerts/SocAlertsList.vue
+209
-24
@@ -5,28 +5,79 @@
5
<div class="grow">
6
<n-input v-model:value="alertTitle" size="small" placeholder="Search by title..." clearable />
7
</div>
8
+ <div class="delete-box">
9
+ <n-popover :width="200" placement="bottom" style="max-height: 240px" scrollable v-if="checkedCount">
10
+ <template #trigger>
11
+ <n-button
12
+ size="small"
13
+ type="error"
14
+ ghost
15
+ @click="handleDelete()"
16
+ :loading="loadingPurge"
17
+ :disabled="loadingAlerts"
18
+ >
19
+ <div class="flex items-center gap-2">
20
+ <Icon :name="TrashIcon" :size="16"></Icon>
21
+ <span class="flex items-center gap-2">
22
+ <span v-if="!compactMode">Delete Alerts:</span>
23
+ <span class="font-mono">
24
+ {{ checkedCount }}
25
+ </span>
26
+ </span>
27
+ </div>
28
+ </n-button>
29
+ </template>
30
+ <template #header>Selected Alerts</template>
31
+ <template #footer>
32
+ <div class="flex justify-end">
33
+ <n-button size="tiny" @click="clearChecked()">Clear selection</n-button>
34
+ </div>
35
+ </template>
36
+ <div class="checked-list flex flex-col gap-2">
37
+ <div v-for="alertId of checkedList" :key="alertId" class="w-full">
38
+ <n-button size="small" @click="clearChecked(alertId)" class="!w-full !justify-start">
39
+ <template #icon>
40
+ <Icon :name="CloseIcon" :size="18"></Icon>
41
+ </template>
42
+ <span class="font-mono">#{{ alertId }}</span>
43
+ </n-button>
44
+ </div>
45
+ </div>
46
+ </n-popover>
47
+ <n-button size="small" type="error" ghost @click="handlePurge()" :loading="loadingPurge" v-else>
48
+ <div class="flex items-center gap-2">
49
+ <Icon :name="TrashIcon" :size="16"></Icon>
50
+ <span class="hidden xs:block">Purge</span>
51
+ </div>
52
+ </n-button>
53
+ </div>
54
<PaginationIndeterminate
55
v-model:page="page"
56
v-model:pageSize="pageSize"
57
v-model:sort="sort"
58
:pageSizes="pageSizes"
59
:showPageSizes="!compactMode"
60
+ :showSort="!smallDeviceMode"
61
/>
62
</div>
63
17
- <n-spin :show="loadingAlerts">
64
+ <n-spin :show="loadingAlerts || loadingPurge">
65
<div class="list">
66
<template v-if="alertsList.length">
67
<SocAlertItem
68
v-for="alert of alertsList"
22
- :key="alert.alert_id"
23
- :alertData="alert"
69
+ :key="alert.id"
70
+ :alertData="alert.data"
71
class="item-appear item-appear-bottom item-appear-005 mb-2"
25
- :is-bookmark="isBookmarked(alert)"
72
+ :is-bookmark="isBookmarked(alert.data)"
73
:users="usersList"
27
- :highlight="alert.alert_id.toString() === highlight"
74
+ :highlight="alert.id === highlight"
75
show-badges-toggle
76
+ show-checkbox
77
+ @check="toggleCheckedList(alert.id, $event)"
78
+ v-model:checked="alert.checked"
79
@bookmark="bookmark()"
80
+ @deleted="itemDeleted(alert.id)"
81
/>
82
</template>
83
<template v-else>
@@ -38,8 +89,8 @@
89
</template>
90
91
<script setup lang="ts">
41
-import { ref, onBeforeMount, watch, toRefs, nextTick, onBeforeUnmount, onMounted } from "vue"
42
-import { useMessage, NSpin, NEmpty, NInput } from "naive-ui"
92
+import { ref, onBeforeMount, watch, toRefs, nextTick, onBeforeUnmount, onMounted, computed } from "vue"
93
+import { useMessage, NSpin, NEmpty, NInput, useDialog, NButton, NPopover } from "naive-ui"
94
import Api from "@/api"
95
import SocAlertItem from "./SocAlertItem.vue"
96
import type { SocAlert } from "@/types/soc/alert.d"
@@ -47,7 +98,10 @@ import type { SocUser } from "@/types/soc/user.d"
98
import type { AlertsFilter } from "@/api/soc"
99
import { useResizeObserver, watchDebounced } from "@vueuse/core"
100
import PaginationIndeterminate from "@/components/common/PaginationIndeterminate.vue"
101
+import Icon from "@/components/common/Icon.vue"
102
import axios from "axios"
103
+// MOCK
104
+// import { alerts as alertsMock } from "./mock"
105
106
const props = defineProps<{
107
highlight: string | null | undefined
@@ -58,18 +112,26 @@ const { highlight, bookmarksList, usersList } = toRefs(props)
112
113
const emit = defineEmits<{
114
(e: "bookmark"): void
115
+ (e: "deleted", value?: string): void
116
(
117
e: "mounted",
118
value: {
119
reload: () => void
120
+ itemDeleted: (alertId: string, noEmit?: boolean) => void
121
}
122
): void
123
}>()
124
125
+const TrashIcon = "carbon:trash-can"
126
+const CloseIcon = "carbon:close"
127
+
128
let reloadTimeout: NodeJS.Timeout | null = null
129
+const dialog = useDialog()
130
const message = useMessage()
131
+const loadingPurge = ref(false)
132
const loadingAlerts = ref(false)
72
-const alertsList = ref<SocAlert[]>([])
133
+const alertsList = ref<{ checked: boolean; id: string; data: SocAlert }[]>([])
134
+const checkedList = ref<string[]>([])
135
136
const pageSize = ref(50)
137
const pageSizes = [25, 50, 100, 150, 200]
@@ -78,9 +140,12 @@ const sort = ref<"desc" | "asc">("desc")
140
const alertTitle = ref("")
141
const header = ref()
142
const compactMode = ref(false)
143
+const smallDeviceMode = ref(false)
144
145
let abortController: AbortController | null = null
146
147
+const checkedCount = computed(() => checkedList.value.length)
148
+
149
function isBookmarked(alert: SocAlert): boolean {
150
return !!(bookmarksList.value || []).filter(o => o.alert_id === alert.alert_id).length
151
}
@@ -113,7 +178,11 @@ function getAlerts() {
178
.getAlerts(filter, abortController.signal)
179
.then(res => {
180
if (res.data.success) {
116
- alertsList.value = res.data?.alerts || []
181
+ alertsList.value = (res.data?.alerts || []).map(o => ({
182
+ checked: isChecked(o.alert_id.toString()),
183
+ data: o,
184
+ id: o.alert_id.toString()
185
+ }))
186
} else {
187
message.warning(res.data?.message || "An error occurred. Please try again later.")
188
}
@@ -139,6 +208,129 @@ function scrollToAlert(id: string) {
208
}
209
}
210
211
+function safeReload() {
212
+ abortController?.abort()
213
+
214
+ if (reloadTimeout) {
215
+ clearTimeout(reloadTimeout)
216
+ }
217
+
218
+ reloadTimeout = setTimeout(() => {
219
+ getAlerts()
220
+ }, 200)
221
+}
222
+
223
+function handleDelete() {
224
+ dialog.warning({
225
+ title: "Confirm",
226
+ content: "This will remove latest 1000 Soc Alerts, are you sure you want to proceed?",
227
+ positiveText: "Yes I'm sure",
228
+ negativeText: "Cancel",
229
+ onPositiveClick: () => {
230
+ deleteMultipleAlerts()
231
+ },
232
+ onNegativeClick: () => {
233
+ message.info("Purge canceled")
234
+ }
235
+ })
236
+}
237
+
238
+function handlePurge() {
239
+ dialog.warning({
240
+ title: "Confirm",
241
+ content: "This will remove 1000 Soc Alerts, are you sure you want to proceed?",
242
+ positiveText: "Yes I'm sure",
243
+ negativeText: "Cancel",
244
+ onPositiveClick: () => {
245
+ purge()
246
+ },
247
+ onNegativeClick: () => {
248
+ message.info("Purge canceled")
249
+ }
250
+ })
251
+}
252
+
253
+function deleteMultipleAlerts() {
254
+ loadingPurge.value = true
255
+
256
+ Api.soc
257
+ .deleteMultipleAlerts(checkedList.value)
258
+ .then(res => {
259
+ if (res.data.success) {
260
+ clearChecked()
261
+ getAlerts()
262
+ emit("deleted")
263
+ message.success(res.data?.message || "SOC Alerts purged successfully")
264
+ } else {
265
+ message.warning(res.data?.message || "An error occurred. Please try again later.")
266
+ }
267
+ })
268
+ .catch(err => {
269
+ message.error(err.response?.data?.message || "An error occurred. Please try again later.")
270
+ })
271
+ .finally(() => {
272
+ loadingPurge.value = false
273
+ })
274
+}
275
+
276
+function purge() {
277
+ loadingPurge.value = true
278
+
279
+ Api.soc
280
+ .purgeAlerts()
281
+ .then(res => {
282
+ if (res.data.success) {
283
+ getAlerts()
284
+ emit("deleted")
285
+ message.success(res.data?.message || "SOC Alerts purged successfully")
286
+ } else {
287
+ message.warning(res.data?.message || "An error occurred. Please try again later.")
288
+ }
289
+ })
290
+ .catch(err => {
291
+ message.error(err.response?.data?.message || "An error occurred. Please try again later.")
292
+ })
293
+ .finally(() => {
294
+ loadingPurge.value = false
295
+ })
296
+}
297
+
298
+function itemDeleted(alertId: string, noEmit = false) {
299
+ console.log("itemDeleted", alertId, noEmit)
300
+ clearChecked(alertId)
301
+ getAlerts()
302
+ if (!noEmit) {
303
+ emit("deleted", alertId)
304
+ }
305
+}
306
+
307
+function toggleCheckedList(alertId: string, value: boolean) {
308
+ if (value) {
309
+ checkedList.value.push(alertId)
310
+ } else {
311
+ checkedList.value = checkedList.value.filter(o => o !== alertId)
312
+ }
313
+}
314
+
315
+function isChecked(alertId: string) {
316
+ return checkedList.value.filter(o => o === alertId).length !== 0
317
+}
318
+
319
+function clearChecked(alertId?: string) {
320
+ if (alertId) {
321
+ const alert = alertsList.value.find(o => o.id === alertId)
322
+ if (alert) {
323
+ alert.checked = false
324
+ }
325
+ checkedList.value = checkedList.value.filter(o => o !== alertId)
326
+ } else {
327
+ for (const alert of alertsList.value) {
328
+ alert.checked = false
329
+ }
330
+ checkedList.value = []
331
+ }
332
+}
333
+
334
watch(loadingAlerts, val => {
335
if (!val) {
336
nextTick(() => {
@@ -166,34 +358,26 @@ watchDebounced(
358
() => {
359
safeReload()
360
},
169
- { debounce: 500 }
361
+ { debounce: 300 }
362
)
363
364
useResizeObserver(header, entries => {
365
const entry = entries[0]
366
const { width } = entry.contentRect
367
176
- if (width < 500) {
368
+ if (width < 600) {
369
compactMode.value = true
370
pageSize.value = pageSizes[0]
371
} else {
372
compactMode.value = false
373
}
182
-})
183
-
184
-function safeReload() {
185
- abortController?.abort()
186
-
187
- if (reloadTimeout) {
188
- clearTimeout(reloadTimeout)
189
- }
374
191
- reloadTimeout = setTimeout(() => {
192
- getAlerts()
193
- }, 200)
194
-}
375
+ smallDeviceMode.value = width < 450
376
+})
377
378
onBeforeMount(() => {
379
+ // MOCK
380
+ //alertsList.value = alertsMock as unknown as SocAlert[]
381
getAlerts()
382
})
383
@@ -201,7 +385,8 @@ onMounted(() => {
385
emit("mounted", {
386
reload: () => {
387
safeReload()
204
- }
388
+ },
389
+ itemDeleted
390
})
391
})
392
src/components/soc/SocAlerts/mock.ts
new
+9402
@@ -0,0 +1,9402 @@
1
+export const alerts = [
2
+ {
3
+ alert_owner_id: 1,
4
+ alert_uuid: "2cbefa4b-b123-451f-be5b-408511d64e5a",
5
+ alert_creation_time: "2024-01-13T17:56:19.768920",
6
+ comments: [],
7
+ assets: [
8
+ {
9
+ asset_name: "ANSYDWDC01",
10
+ asset_description: "Microsoft Windows Server 2016 Standard",
11
+ asset_type: {
12
+ asset_id: 9,
13
+ asset_icon_compromised: "ioc_windows_desktop.png",
14
+ asset_name: "Windows - Computer",
15
+ asset_icon_not_compromised: "windows_desktop.png",
16
+ asset_description: "Standard Windows Computer"
17
+ },
18
+ custom_attributes: null,
19
+ asset_tags: "agent_id:102",
20
+ asset_compromise_status_id: null,
21
+ date_update: null,
22
+ asset_enrichment: null,
23
+ case_id: null,
24
+ user_id: null,
25
+ asset_type_id: 9,
26
+ asset_id: 12500,
27
+ asset_ip: "139.180.134.102",
28
+ asset_domain: null,
29
+ asset_uuid: "738893be-89ef-4bf5-a762-99cdf34fe2a4",
30
+ analysis_status_id: null,
31
+ asset_info: null,
32
+ date_added: null
33
+ }
34
+ ],
35
+ alert_classification_id: null,
36
+ alert_status_id: 3,
37
+ alert_severity_id: 5,
38
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
39
+ alert_source_content: {
40
+ index: "wazuh_00002_268",
41
+ id: "1705000849.1377555541",
42
+ agent_name: "ANSYDWDC01",
43
+ agent_ip: "139.180.134.102",
44
+ agent_id: "102",
45
+ agent_labels_customer: "00002",
46
+ rule_id: "92207",
47
+ rule_level: 12,
48
+ rule_description: "Executable file dropped in Users\\Public folder",
49
+ timestamp: "2024-01-11 19:20:52.106",
50
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
51
+ time_field: "2024-01-11T19:20:48.181Z",
52
+ asset_type_id: 9,
53
+ gl2_source_input: "6459151dea00fd5d3da2df91",
54
+ data_win_system_level: "4",
55
+ data_win_system_processID: "2144",
56
+ rule_mitre_technique: "Ingress Tool Transfer",
57
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
58
+ rule_group1: "sysmon",
59
+ rule_mail: true,
60
+ decoder_name: "windows_eventchannel",
61
+ syslog_level: "ALERT",
62
+ data_win_system_threadID: "3140",
63
+ data_win_system_eventRecordID: "18951669",
64
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
65
+ data_win_eventdata_processId: "3608",
66
+ streams: [
67
+ "658d6cec5e9a2d550c8354c1",
68
+ "659f47da5e9a2d550cac9a40",
69
+ "659f485b5e9a2d550cac9b85",
70
+ "645a3a6123e5cc30bbc0e5dc",
71
+ "658d6d435e9a2d550c83558a"
72
+ ],
73
+ gl2_remote_ip: "10.255.255.13",
74
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
75
+ agent_ip_geolocation: "1.3078,103.6818",
76
+ message:
77
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
78
+ true: 1705000849.314127,
79
+ rule_firedtimes: 1,
80
+ data_win_eventdata_image:
81
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
82
+ source_reserved_ip: true,
83
+ agent_ip_city_name: "Singapore",
84
+ num_hits: 1,
85
+ manager_name: "ASHWZHMA",
86
+ agent_ip_country_code: "SG",
87
+ syslog_type: "wazuh",
88
+ data_win_system_eventID: "11",
89
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
90
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
91
+ gl2_accounted_message_size: 4116,
92
+ data_win_system_message:
93
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
94
+ process_id: "3608",
95
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
96
+ rule_group3: "windows",
97
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
98
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
99
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
100
+ num_matches: 1,
101
+ source: "10.255.255.13",
102
+ data_win_system_keywords: "0x8000000000000000",
103
+ gl2_processing_error:
104
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
105
+ data_win_system_task: "11",
106
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
107
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
108
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
109
+ rule_mitre_id: "T1105",
110
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
111
+ rule_group2: "sysmon_eid11_detections",
112
+ rule_mitre_tactic: "Command and Control",
113
+ location: "EventChannel",
114
+ gl2_remote_port: 58986,
115
+ data_win_eventdata_user: "NT AUTHORITY\\\\SYSTEM",
116
+ data_win_system_opcode: "0",
117
+ data_win_system_severityValue: "INFORMATION",
118
+ data_win_system_version: "2"
119
+ },
120
+ alert_title: "Executable file dropped in Users\\Public folder",
121
+ alert_customer_id: 44,
122
+ alert_resolution_status_id: null,
123
+ alert_context: {
124
+ customer_iris_id: 44,
125
+ customer_name: "test_praeco",
126
+ customer_cases_index: "dfir_iris_test_praeco",
127
+ alert_id: "1705000849.1377555541",
128
+ alert_name: "Executable file dropped in Users\\Public folder",
129
+ alert_level: 12,
130
+ rule_id: "92207",
131
+ asset_name: "ANSYDWDC01",
132
+ asset_ip: "139.180.134.102",
133
+ asset_type: 9,
134
+ process_id: "3608",
135
+ rule_mitre_id: "T1105",
136
+ rule_mitre_tactic: "Command and Control",
137
+ rule_mitre_technique: "Ingress Tool Transfer"
138
+ },
139
+ owner: {
140
+ user_login: "administrator",
141
+ user_email: "administrator@localhost",
142
+ user_name: "administrator",
143
+ id: 1
144
+ },
145
+ alert_source_ref: null,
146
+ alert_tags: null,
147
+ classification: null,
148
+ severity: {
149
+ severity_name: "High",
150
+ severity_description: "High",
151
+ severity_id: 5
152
+ },
153
+ alert_source_link:
154
+ "test.com/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22process_id:%5C%223608%5C%22%20AND%20agent_name:%5C%22ANSYDWDC01%5C%22%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D",
155
+ iocs: [],
156
+ alert_note: null,
157
+ alert_source: "SOCFORTRESS RULE",
158
+ modification_history: {
159
+ "1705168579.77425": {
160
+ user: "administrator",
161
+ user_id: 1,
162
+ action: "Alert created"
163
+ },
164
+ "1705168579.823584": {
165
+ user: "administrator",
166
+ user_id: 1,
167
+ action: "updated alert: \"assets\" from \"[]\" to \"[{'asset_name': 'ANSYDWDC01', 'asset_ip': '139.180.134.102', 'asset_description': 'Microsoft Windows Server 2016 Standard', 'asset_type_id': 9, 'asset_tags': 'agent_id:102'}]\""
168
+ }
169
+ },
170
+ status: {
171
+ status_description: "Alert is assigned to a user and pending investigation",
172
+ status_id: 3,
173
+ status_name: "Assigned"
174
+ },
175
+ cases: [],
176
+ alert_description: "Executable file dropped in Users\\Public folder",
177
+ customer: {
178
+ customer_id: 44,
179
+ customer_sla: null,
180
+ customer_name: "test_praeco",
181
+ customer_description: null,
182
+ creation_date: "2024-01-11T01:46:06.947860",
183
+ custom_attributes: {},
184
+ last_update_date: "2024-01-11T01:46:06.947860",
185
+ client_uuid: "d6d42317-f29d-4637-bfdf-31816e08d587"
186
+ },
187
+ alert_id: 12095,
188
+ resolution_status: null
189
+ },
190
+ {
191
+ alert_owner_id: 1,
192
+ alert_uuid: "7e4c39a1-a084-4479-9a12-f473efd1e84c",
193
+ alert_creation_time: "2024-01-13T18:05:19.771114",
194
+ comments: [],
195
+ assets: [
196
+ {
197
+ asset_name: "ANSYDWDC01",
198
+ asset_description: "Microsoft Windows Server 2016 Standard",
199
+ asset_type: {
200
+ asset_id: 9,
201
+ asset_icon_compromised: "ioc_windows_desktop.png",
202
+ asset_name: "Windows - Computer",
203
+ asset_icon_not_compromised: "windows_desktop.png",
204
+ asset_description: "Standard Windows Computer"
205
+ },
206
+ custom_attributes: null,
207
+ asset_tags: "agent_id:102",
208
+ asset_compromise_status_id: null,
209
+ date_update: null,
210
+ asset_enrichment: null,
211
+ case_id: null,
212
+ user_id: null,
213
+ asset_type_id: 9,
214
+ asset_id: 12536,
215
+ asset_ip: "139.180.134.102",
216
+ asset_domain: null,
217
+ asset_uuid: "344c52b3-9837-4223-a06b-c4287b4ec8f7",
218
+ analysis_status_id: null,
219
+ asset_info: null,
220
+ date_added: null
221
+ }
222
+ ],
223
+ alert_classification_id: null,
224
+ alert_status_id: 3,
225
+ alert_severity_id: 5,
226
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
227
+ alert_source_content: {
228
+ index: "wazuh_00002_268",
229
+ id: "1705000849.1377555541",
230
+ agent_name: "ANSYDWDC01",
231
+ agent_ip: "139.180.134.102",
232
+ agent_id: "102",
233
+ agent_labels_customer: "00002",
234
+ rule_id: "92207",
235
+ rule_level: 12,
236
+ rule_description: "Executable file dropped in Users\\Public folder",
237
+ timestamp: "2024-01-11 19:20:52.106",
238
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
239
+ time_field: "2024-01-11T19:20:48.181Z",
240
+ asset_type_id: 9,
241
+ gl2_source_input: "6459151dea00fd5d3da2df91",
242
+ data_win_system_level: "4",
243
+ data_win_system_processID: "2144",
244
+ rule_mitre_technique: "Ingress Tool Transfer",
245
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
246
+ rule_group1: "sysmon",
247
+ rule_mail: true,
248
+ decoder_name: "windows_eventchannel",
249
+ syslog_level: "ALERT",
250
+ data_win_system_threadID: "3140",
251
+ data_win_system_eventRecordID: "18951669",
252
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
253
+ data_win_eventdata_processId: "3608",
254
+ streams: [
255
+ "658d6cec5e9a2d550c8354c1",
256
+ "659f47da5e9a2d550cac9a40",
257
+ "659f485b5e9a2d550cac9b85",
258
+ "645a3a6123e5cc30bbc0e5dc",
259
+ "658d6d435e9a2d550c83558a"
260
+ ],
261
+ gl2_remote_ip: "10.255.255.13",
262
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
263
+ agent_ip_geolocation: "1.3078,103.6818",
264
+ message:
265
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
266
+ true: 1705000849.314127,
267
+ rule_firedtimes: 1,
268
+ data_win_eventdata_image:
269
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
270
+ source_reserved_ip: true,
271
+ agent_ip_city_name: "Singapore",
272
+ num_hits: 1,
273
+ manager_name: "ASHWZHMA",
274
+ agent_ip_country_code: "SG",
275
+ syslog_type: "wazuh",
276
+ data_win_system_eventID: "11",
277
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
278
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
279
+ gl2_accounted_message_size: 4116,
280
+ data_win_system_message:
281
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
282
+ process_id: "3608",
283
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
284
+ rule_group3: "windows",
285
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
286
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
287
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
288
+ num_matches: 1,
289
+ source: "10.255.255.13",
290
+ data_win_system_keywords: "0x8000000000000000",
291
+ gl2_processing_error:
292
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
293
+ data_win_system_task: "11",
294
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
295
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
296
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
297
+ rule_mitre_id: "T1105",
298
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
299
+ rule_group2: "sysmon_eid11_detections",
300
+ rule_mitre_tactic: "Command and Control",
301
+ location: "EventChannel",
302
+ gl2_remote_port: 58986,
303
+ data_win_eventdata_user: "NT AUTHORITY\\\\SYSTEM",
304
+ data_win_system_opcode: "0",
305
+ data_win_system_severityValue: "INFORMATION",
306
+ data_win_system_version: "2"
307
+ },
308
+ alert_title: "Executable file dropped in Users\\Public folder",
309
+ alert_customer_id: 44,
310
+ alert_resolution_status_id: null,
311
+ alert_context: {
312
+ customer_iris_id: 44,
313
+ customer_name: "test_praeco",
314
+ customer_cases_index: "dfir_iris_test_praeco",
315
+ alert_id: "1705000849.1377555541",
316
+ alert_name: "Executable file dropped in Users\\Public folder",
317
+ alert_level: 12,
318
+ rule_id: "92207",
319
+ asset_name: "ANSYDWDC01",
320
+ asset_ip: "139.180.134.102",
321
+ asset_type: 9,
322
+ process_id: "3608",
323
+ rule_mitre_id: "T1105",
324
+ rule_mitre_tactic: "Command and Control",
325
+ rule_mitre_technique: "Ingress Tool Transfer"
326
+ },
327
+ owner: {
328
+ user_login: "administrator",
329
+ user_email: "administrator@localhost",
330
+ user_name: "administrator",
331
+ id: 1
332
+ },
333
+ alert_source_ref: null,
334
+ alert_tags: null,
335
+ classification: null,
336
+ severity: {
337
+ severity_name: "High",
338
+ severity_description: "High",
339
+ severity_id: 5
340
+ },
341
+ alert_source_link:
342
+ "test.com/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22process_id:%5C%223608%5C%22%20AND%20agent_name:%5C%22ANSYDWDC01%5C%22%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D",
343
+ iocs: [],
344
+ alert_note: null,
345
+ alert_source: "SOCFORTRESS RULE",
346
+ modification_history: {
347
+ "1705169119.780053": {
348
+ user: "administrator",
349
+ user_id: 1,
350
+ action: "Alert created"
351
+ },
352
+ "1705169119.827961": {
353
+ user: "administrator",
354
+ user_id: 1,
355
+ action: "updated alert: \"assets\" from \"[]\" to \"[{'asset_name': 'ANSYDWDC01', 'asset_ip': '139.180.134.102', 'asset_description': 'Microsoft Windows Server 2016 Standard', 'asset_type_id': 9, 'asset_tags': 'agent_id:102'}]\""
356
+ }
357
+ },
358
+ status: {
359
+ status_description: "Alert is assigned to a user and pending investigation",
360
+ status_id: 3,
361
+ status_name: "Assigned"
362
+ },
363
+ cases: [],
364
+ alert_description: "Executable file dropped in Users\\Public folder",
365
+ customer: {
366
+ customer_id: 44,
367
+ customer_sla: null,
368
+ customer_name: "test_praeco",
369
+ customer_description: null,
370
+ creation_date: "2024-01-11T01:46:06.947860",
371
+ custom_attributes: {},
372
+ last_update_date: "2024-01-11T01:46:06.947860",
373
+ client_uuid: "d6d42317-f29d-4637-bfdf-31816e08d587"
374
+ },
375
+ alert_id: 12131,
376
+ resolution_status: null
377
+ },
378
+ {
379
+ alert_owner_id: 1,
380
+ alert_uuid: "81f63689-1657-4567-bf4a-b60bc96d5185",
381
+ alert_creation_time: "2024-01-13T17:46:19.763620",
382
+ comments: [],
383
+ assets: [
384
+ {
385
+ asset_name: "ANSYDWDC01",
386
+ asset_description: "Microsoft Windows Server 2016 Standard",
387
+ asset_type: {
388
+ asset_id: 9,
389
+ asset_icon_compromised: "ioc_windows_desktop.png",
390
+ asset_name: "Windows - Computer",
391
+ asset_icon_not_compromised: "windows_desktop.png",
392
+ asset_description: "Standard Windows Computer"
393
+ },
394
+ custom_attributes: null,
395
+ asset_tags: "agent_id:102",
396
+ asset_compromise_status_id: null,
397
+ date_update: null,
398
+ asset_enrichment: null,
399
+ case_id: null,
400
+ user_id: null,
401
+ asset_type_id: 9,
402
+ asset_id: 12460,
403
+ asset_ip: "139.180.134.102",
404
+ asset_domain: null,
405
+ asset_uuid: "9136cb5c-c906-43eb-88b2-d9b496b1924b",
406
+ analysis_status_id: null,
407
+ asset_info: null,
408
+ date_added: null
409
+ }
410
+ ],
411
+ alert_classification_id: null,
412
+ alert_status_id: 3,
413
+ alert_severity_id: 5,
414
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
415
+ alert_source_content: {
416
+ index: "wazuh_00002_268",
417
+ id: "1705000849.1377555541",
418
+ agent_name: "ANSYDWDC01",
419
+ agent_ip: "139.180.134.102",
420
+ agent_id: "102",
421
+ agent_labels_customer: "00002",
422
+ rule_id: "92207",
423
+ rule_level: 12,
424
+ rule_description: "Executable file dropped in Users\\Public folder",
425
+ timestamp: "2024-01-11 19:20:52.106",
426
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
427
+ time_field: "2024-01-11T19:20:48.181Z",
428
+ asset_type_id: 9,
429
+ gl2_source_input: "6459151dea00fd5d3da2df91",
430
+ data_win_system_level: "4",
431
+ data_win_system_processID: "2144",
432
+ rule_mitre_technique: "Ingress Tool Transfer",
433
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
434
+ rule_group1: "sysmon",
435
+ rule_mail: true,
436
+ decoder_name: "windows_eventchannel",
437
+ syslog_level: "ALERT",
438
+ data_win_system_threadID: "3140",
439
+ data_win_system_eventRecordID: "18951669",
440
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
441
+ data_win_eventdata_processId: "3608",
442
+ streams: [
443
+ "658d6cec5e9a2d550c8354c1",
444
+ "659f47da5e9a2d550cac9a40",
445
+ "659f485b5e9a2d550cac9b85",
446
+ "645a3a6123e5cc30bbc0e5dc",
447
+ "658d6d435e9a2d550c83558a"
448
+ ],
449
+ gl2_remote_ip: "10.255.255.13",
450
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
451
+ agent_ip_geolocation: "1.3078,103.6818",
452
+ message:
453
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
454
+ true: 1705000849.314127,
455
+ rule_firedtimes: 1,
456
+ data_win_eventdata_image:
457
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
458
+ source_reserved_ip: true,
459
+ agent_ip_city_name: "Singapore",
460
+ num_hits: 1,
461
+ manager_name: "ASHWZHMA",
462
+ agent_ip_country_code: "SG",
463
+ syslog_type: "wazuh",
464
+ data_win_system_eventID: "11",
465
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
466
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
467
+ gl2_accounted_message_size: 4116,
468
+ data_win_system_message:
469
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
470
+ process_id: "3608",
471
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
472
+ rule_group3: "windows",
473
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
474
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
475
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
476
+ num_matches: 1,
477
+ source: "10.255.255.13",
478
+ data_win_system_keywords: "0x8000000000000000",
479
+ gl2_processing_error:
480
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
481
+ data_win_system_task: "11",
482
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
483
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
484
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
485
+ rule_mitre_id: "T1105",
486
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
487
+ rule_group2: "sysmon_eid11_detections",
488
+ rule_mitre_tactic: "Command and Control",
489
+ location: "EventChannel",
490
+ gl2_remote_port: 58986,
491
+ data_win_eventdata_user: "NT AUTHORITY\\\\SYSTEM",
492
+ data_win_system_opcode: "0",
493
+ data_win_system_severityValue: "INFORMATION",
494
+ data_win_system_version: "2"
495
+ },
496
+ alert_title: "Executable file dropped in Users\\Public folder",
497
+ alert_customer_id: 44,
498
+ alert_resolution_status_id: null,
499
+ alert_context: {
500
+ customer_iris_id: 44,
501
+ customer_name: "test_praeco",
502
+ customer_cases_index: "dfir_iris_test_praeco",
503
+ alert_id: "1705000849.1377555541",
504
+ alert_name: "Executable file dropped in Users\\Public folder",
505
+ alert_level: 12,
506
+ rule_id: "92207",
507
+ asset_name: "ANSYDWDC01",
508
+ asset_ip: "139.180.134.102",
509
+ asset_type: 9,
510
+ process_id: "3608",
511
+ rule_mitre_id: "T1105",
512
+ rule_mitre_tactic: "Command and Control",
513
+ rule_mitre_technique: "Ingress Tool Transfer"
514
+ },
515
+ owner: {
516
+ user_login: "administrator",
517
+ user_email: "administrator@localhost",
518
+ user_name: "administrator",
519
+ id: 1
520
+ },
521
+ alert_source_ref: null,
522
+ alert_tags: null,
523
+ classification: null,
524
+ severity: {
525
+ severity_name: "High",
526
+ severity_description: "High",
527
+ severity_id: 5
528
+ },
529
+ alert_source_link:
530
+ "test.com/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22process_id:%5C%223608%5C%22%20AND%20agent_name:%5C%22ANSYDWDC01%5C%22%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D",
531
+ iocs: [],
532
+ alert_note: null,
533
+ alert_source: "SOCFORTRESS RULE",
534
+ modification_history: {
535
+ "1705167979.768851": {
536
+ user: "administrator",
537
+ user_id: 1,
538
+ action: "Alert created"
539
+ },
540
+ "1705167979.819793": {
541
+ user: "administrator",
542
+ user_id: 1,
543
+ action: "updated alert: \"assets\" from \"[]\" to \"[{'asset_name': 'ANSYDWDC01', 'asset_ip': '139.180.134.102', 'asset_description': 'Microsoft Windows Server 2016 Standard', 'asset_type_id': 9, 'asset_tags': 'agent_id:102'}]\""
544
+ }
545
+ },
546
+ status: {
547
+ status_description: "Alert is assigned to a user and pending investigation",
548
+ status_id: 3,
549
+ status_name: "Assigned"
550
+ },
551
+ cases: [],
552
+ alert_description: "Executable file dropped in Users\\Public folder",
553
+ customer: {
554
+ customer_id: 44,
555
+ customer_sla: null,
556
+ customer_name: "test_praeco",
557
+ customer_description: null,
558
+ creation_date: "2024-01-11T01:46:06.947860",
559
+ custom_attributes: {},
560
+ last_update_date: "2024-01-11T01:46:06.947860",
561
+ client_uuid: "d6d42317-f29d-4637-bfdf-31816e08d587"
562
+ },
563
+ alert_id: 12055,
564
+ resolution_status: null
565
+ },
566
+ {
567
+ alert_owner_id: 1,
568
+ alert_uuid: "d2203748-40e9-4ff4-9434-de692519805d",
569
+ alert_creation_time: "2024-01-13T17:53:19.769821",
570
+ comments: [],
571
+ assets: [
572
+ {
573
+ asset_name: "ANSYDWDC01",
574
+ asset_description: "Microsoft Windows Server 2016 Standard",
575
+ asset_type: {
576
+ asset_id: 9,
577
+ asset_icon_compromised: "ioc_windows_desktop.png",
578
+ asset_name: "Windows - Computer",
579
+ asset_icon_not_compromised: "windows_desktop.png",
580
+ asset_description: "Standard Windows Computer"
581
+ },
582
+ custom_attributes: null,
583
+ asset_tags: "agent_id:102",
584
+ asset_compromise_status_id: null,
585
+ date_update: null,
586
+ asset_enrichment: null,
587
+ case_id: null,
588
+ user_id: null,
589
+ asset_type_id: 9,
590
+ asset_id: 12488,
591
+ asset_ip: "139.180.134.102",
592
+ asset_domain: null,
593
+ asset_uuid: "e0000e99-738a-4041-b706-73788b86ae85",
594
+ analysis_status_id: null,
595
+ asset_info: null,
596
+ date_added: null
597
+ }
598
+ ],
599
+ alert_classification_id: null,
600
+ alert_status_id: 3,
601
+ alert_severity_id: 5,
602
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
603
+ alert_source_content: {
604
+ index: "wazuh_00002_268",
605
+ id: "1705000849.1377555541",
606
+ agent_name: "ANSYDWDC01",
607
+ agent_ip: "139.180.134.102",
608
+ agent_id: "102",
609
+ agent_labels_customer: "00002",
610
+ rule_id: "92207",
611
+ rule_level: 12,
612
+ rule_description: "Executable file dropped in Users\\Public folder",
613
+ timestamp: "2024-01-11 19:20:52.106",
614
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
615
+ time_field: "2024-01-11T19:20:48.181Z",
616
+ asset_type_id: 9,
617
+ gl2_source_input: "6459151dea00fd5d3da2df91",
618
+ data_win_system_level: "4",
619
+ data_win_system_processID: "2144",
620
+ rule_mitre_technique: "Ingress Tool Transfer",
621
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
622
+ rule_group1: "sysmon",
623
+ rule_mail: true,
624
+ decoder_name: "windows_eventchannel",
625
+ syslog_level: "ALERT",
626
+ data_win_system_threadID: "3140",
627
+ data_win_system_eventRecordID: "18951669",
628
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
629
+ data_win_eventdata_processId: "3608",
630
+ streams: [
631
+ "658d6cec5e9a2d550c8354c1",
632
+ "659f47da5e9a2d550cac9a40",
633
+ "659f485b5e9a2d550cac9b85",
634
+ "645a3a6123e5cc30bbc0e5dc",
635
+ "658d6d435e9a2d550c83558a"
636
+ ],
637
+ gl2_remote_ip: "10.255.255.13",
638
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
639
+ agent_ip_geolocation: "1.3078,103.6818",
640
+ message:
641
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
642
+ true: 1705000849.314127,
643
+ rule_firedtimes: 1,
644
+ data_win_eventdata_image:
645
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
646
+ source_reserved_ip: true,
647
+ agent_ip_city_name: "Singapore",
648
+ num_hits: 1,
649
+ manager_name: "ASHWZHMA",
650
+ agent_ip_country_code: "SG",
651
+ syslog_type: "wazuh",
652
+ data_win_system_eventID: "11",
653
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
654
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
655
+ gl2_accounted_message_size: 4116,
656
+ data_win_system_message:
657
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
658
+ process_id: "3608",
659
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
660
+ rule_group3: "windows",
661
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
662
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
663
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
664
+ num_matches: 1,
665
+ source: "10.255.255.13",
666
+ data_win_system_keywords: "0x8000000000000000",
667
+ gl2_processing_error:
668
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
669
+ data_win_system_task: "11",
670
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
671
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
672
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
673
+ rule_mitre_id: "T1105",
674
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
675
+ rule_group2: "sysmon_eid11_detections",
676
+ rule_mitre_tactic: "Command and Control",
677
+ location: "EventChannel",
678
+ gl2_remote_port: 58986,
679
+ data_win_eventdata_user: "NT AUTHORITY\\\\SYSTEM",
680
+ data_win_system_opcode: "0",
681
+ data_win_system_severityValue: "INFORMATION",
682
+ data_win_system_version: "2"
683
+ },
684
+ alert_title: "Executable file dropped in Users\\Public folder",
685
+ alert_customer_id: 44,
686
+ alert_resolution_status_id: null,
687
+ alert_context: {
688
+ customer_iris_id: 44,
689
+ customer_name: "test_praeco",
690
+ customer_cases_index: "dfir_iris_test_praeco",
691
+ alert_id: "1705000849.1377555541",
692
+ alert_name: "Executable file dropped in Users\\Public folder",
693
+ alert_level: 12,
694
+ rule_id: "92207",
695
+ asset_name: "ANSYDWDC01",
696
+ asset_ip: "139.180.134.102",
697
+ asset_type: 9,
698
+ process_id: "3608",
699
+ rule_mitre_id: "T1105",
700
+ rule_mitre_tactic: "Command and Control",
701
+ rule_mitre_technique: "Ingress Tool Transfer"
702
+ },
703
+ owner: {
704
+ user_login: "administrator",
705
+ user_email: "administrator@localhost",
706
+ user_name: "administrator",
707
+ id: 1
708
+ },
709
+ alert_source_ref: null,
710
+ alert_tags: null,
711
+ classification: null,
712
+ severity: {
713
+ severity_name: "High",
714
+ severity_description: "High",
715
+ severity_id: 5
716
+ },
717
+ alert_source_link:
718
+ "test.com/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22process_id:%5C%223608%5C%22%20AND%20agent_name:%5C%22ANSYDWDC01%5C%22%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D",
719
+ iocs: [],
720
+ alert_note: null,
721
+ alert_source: "SOCFORTRESS RULE",
722
+ modification_history: {
723
+ "1705168399.775005": {
724
+ user: "administrator",
725
+ user_id: 1,
726
+ action: "Alert created"
727
+ },
728
+ "1705168399.82801": {
729
+ user: "administrator",
730
+ user_id: 1,
731
+ action: "updated alert: \"assets\" from \"[]\" to \"[{'asset_name': 'ANSYDWDC01', 'asset_ip': '139.180.134.102', 'asset_description': 'Microsoft Windows Server 2016 Standard', 'asset_type_id': 9, 'asset_tags': 'agent_id:102'}]\""
732
+ }
733
+ },
734
+ status: {
735
+ status_description: "Alert is assigned to a user and pending investigation",
736
+ status_id: 3,
737
+ status_name: "Assigned"
738
+ },
739
+ cases: [],
740
+ alert_description: "Executable file dropped in Users\\Public folder",
741
+ customer: {
742
+ customer_id: 44,
743
+ customer_sla: null,
744
+ customer_name: "test_praeco",
745
+ customer_description: null,
746
+ creation_date: "2024-01-11T01:46:06.947860",
747
+ custom_attributes: {},
748
+ last_update_date: "2024-01-11T01:46:06.947860",
749
+ client_uuid: "d6d42317-f29d-4637-bfdf-31816e08d587"
750
+ },
751
+ alert_id: 12083,
752
+ resolution_status: null
753
+ },
754
+ {
755
+ alert_owner_id: 1,
756
+ alert_uuid: "3db24bfc-d785-4018-86fa-fe38a66e5d1e",
757
+ alert_creation_time: "2024-01-13T18:00:19.759401",
758
+ comments: [],
759
+ assets: [
760
+ {
761
+ asset_name: "ANSYDWDC01",
762
+ asset_description: "Microsoft Windows Server 2016 Standard",
763
+ asset_type: {
764
+ asset_id: 9,
765
+ asset_icon_compromised: "ioc_windows_desktop.png",
766
+ asset_name: "Windows - Computer",
767
+ asset_icon_not_compromised: "windows_desktop.png",
768
+ asset_description: "Standard Windows Computer"
769
+ },
770
+ custom_attributes: null,
771
+ asset_tags: "agent_id:102",
772
+ asset_compromise_status_id: null,
773
+ date_update: null,
774
+ asset_enrichment: null,
775
+ case_id: null,
776
+ user_id: null,
777
+ asset_type_id: 9,
778
+ asset_id: 12516,
779
+ asset_ip: "139.180.134.102",
780
+ asset_domain: null,
781
+ asset_uuid: "e14e41d5-2207-4761-8dad-61d749465a2a",
782
+ analysis_status_id: null,
783
+ asset_info: null,
784
+ date_added: null
785
+ }
786
+ ],
787
+ alert_classification_id: null,
788
+ alert_status_id: 3,
789
+ alert_severity_id: 5,
790
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
791
+ alert_source_content: {
792
+ index: "wazuh_00002_268",
793
+ id: "1705000849.1377555541",
794
+ agent_name: "ANSYDWDC01",
795
+ agent_ip: "139.180.134.102",
796
+ agent_id: "102",
797
+ agent_labels_customer: "00002",
798
+ rule_id: "92207",
799
+ rule_level: 12,
800
+ rule_description: "Executable file dropped in Users\\Public folder",
801
+ timestamp: "2024-01-11 19:20:52.106",
802
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
803
+ time_field: "2024-01-11T19:20:48.181Z",
804
+ asset_type_id: 9,
805
+ gl2_source_input: "6459151dea00fd5d3da2df91",
806
+ data_win_system_level: "4",
807
+ data_win_system_processID: "2144",
808
+ rule_mitre_technique: "Ingress Tool Transfer",
809
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
810
+ rule_group1: "sysmon",
811
+ rule_mail: true,
812
+ decoder_name: "windows_eventchannel",
813
+ syslog_level: "ALERT",
814
+ data_win_system_threadID: "3140",
815
+ data_win_system_eventRecordID: "18951669",
816
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
817
+ data_win_eventdata_processId: "3608",
818
+ streams: [
819
+ "658d6cec5e9a2d550c8354c1",
820
+ "659f47da5e9a2d550cac9a40",
821
+ "659f485b5e9a2d550cac9b85",
822
+ "645a3a6123e5cc30bbc0e5dc",
823
+ "658d6d435e9a2d550c83558a"
824
+ ],
825
+ gl2_remote_ip: "10.255.255.13",
826
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
827
+ agent_ip_geolocation: "1.3078,103.6818",
828
+ message:
829
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
830
+ true: 1705000849.314127,
831
+ rule_firedtimes: 1,
832
+ data_win_eventdata_image:
833
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
834
+ source_reserved_ip: true,
835
+ agent_ip_city_name: "Singapore",
836
+ num_hits: 1,
837
+ manager_name: "ASHWZHMA",
838
+ agent_ip_country_code: "SG",
839
+ syslog_type: "wazuh",
840
+ data_win_system_eventID: "11",
841
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
842
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
843
+ gl2_accounted_message_size: 4116,
844
+ data_win_system_message:
845
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
846
+ process_id: "3608",
847
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
848
+ rule_group3: "windows",
849
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
850
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
851
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
852
+ num_matches: 1,
853
+ source: "10.255.255.13",
854
+ data_win_system_keywords: "0x8000000000000000",
855
+ gl2_processing_error:
856
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
857
+ data_win_system_task: "11",
858
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
859
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
860
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
861
+ rule_mitre_id: "T1105",
862
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
863
+ rule_group2: "sysmon_eid11_detections",
864
+ rule_mitre_tactic: "Command and Control",
865
+ location: "EventChannel",
866
+ gl2_remote_port: 58986,
867
+ data_win_eventdata_user: "NT AUTHORITY\\\\SYSTEM",
868
+ data_win_system_opcode: "0",
869
+ data_win_system_severityValue: "INFORMATION",
870
+ data_win_system_version: "2"
871
+ },
872
+ alert_title: "Executable file dropped in Users\\Public folder",
873
+ alert_customer_id: 44,
874
+ alert_resolution_status_id: null,
875
+ alert_context: {
876
+ customer_iris_id: 44,
877
+ customer_name: "test_praeco",
878
+ customer_cases_index: "dfir_iris_test_praeco",
879
+ alert_id: "1705000849.1377555541",
880
+ alert_name: "Executable file dropped in Users\\Public folder",
881
+ alert_level: 12,
882
+ rule_id: "92207",
883
+ asset_name: "ANSYDWDC01",
884
+ asset_ip: "139.180.134.102",
885
+ asset_type: 9,
886
+ process_id: "3608",
887
+ rule_mitre_id: "T1105",
888
+ rule_mitre_tactic: "Command and Control",
889
+ rule_mitre_technique: "Ingress Tool Transfer"
890
+ },
891
+ owner: {
892
+ user_login: "administrator",
893
+ user_email: "administrator@localhost",
894
+ user_name: "administrator",
895
+ id: 1
896
+ },
897
+ alert_source_ref: null,
898
+ alert_tags: null,
899
+ classification: null,
900
+ severity: {
901
+ severity_name: "High",
902
+ severity_description: "High",
903
+ severity_id: 5
904
+ },
905
+ alert_source_link:
906
+ "test.com/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22process_id:%5C%223608%5C%22%20AND%20agent_name:%5C%22ANSYDWDC01%5C%22%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D",
907
+ iocs: [],
908
+ alert_note: null,
909
+ alert_source: "SOCFORTRESS RULE",
910
+ modification_history: {
911
+ "1705168819.76398": {
912
+ user: "administrator",
913
+ user_id: 1,
914
+ action: "Alert created"
915
+ },
916
+ "1705168819.814266": {
917
+ user: "administrator",
918
+ user_id: 1,
919
+ action: "updated alert: \"assets\" from \"[]\" to \"[{'asset_name': 'ANSYDWDC01', 'asset_ip': '139.180.134.102', 'asset_description': 'Microsoft Windows Server 2016 Standard', 'asset_type_id': 9, 'asset_tags': 'agent_id:102'}]\""
920
+ }
921
+ },
922
+ status: {
923
+ status_description: "Alert is assigned to a user and pending investigation",
924
+ status_id: 3,
925
+ status_name: "Assigned"
926
+ },
927
+ cases: [],
928
+ alert_description: "Executable file dropped in Users\\Public folder",
929
+ customer: {
930
+ customer_id: 44,
931
+ customer_sla: null,
932
+ customer_name: "test_praeco",
933
+ customer_description: null,
934
+ creation_date: "2024-01-11T01:46:06.947860",
935
+ custom_attributes: {},
936
+ last_update_date: "2024-01-11T01:46:06.947860",
937
+ client_uuid: "d6d42317-f29d-4637-bfdf-31816e08d587"
938
+ },
939
+ alert_id: 12111,
940
+ resolution_status: null
941
+ },
942
+ {
943
+ alert_owner_id: 1,
944
+ alert_uuid: "025d94ce-e94a-46f9-890c-afb5b5099fc1",
945
+ alert_creation_time: "2024-01-13T18:04:19.773218",
946
+ comments: [],
947
+ assets: [
948
+ {
949
+ asset_name: "ANSYDWDC01",
950
+ asset_description: "Microsoft Windows Server 2016 Standard",
951
+ asset_type: {
952
+ asset_id: 9,
953
+ asset_icon_compromised: "ioc_windows_desktop.png",
954
+ asset_name: "Windows - Computer",
955
+ asset_icon_not_compromised: "windows_desktop.png",
956
+ asset_description: "Standard Windows Computer"
957
+ },
958
+ custom_attributes: null,
959
+ asset_tags: "agent_id:102",
960
+ asset_compromise_status_id: null,
961
+ date_update: null,
962
+ asset_enrichment: null,
963
+ case_id: null,
964
+ user_id: null,
965
+ asset_type_id: 9,
966
+ asset_id: 12532,
967
+ asset_ip: "139.180.134.102",
968
+ asset_domain: null,
969
+ asset_uuid: "0b14dd97-fda6-4afb-95c0-c4efda766c34",
970
+ analysis_status_id: null,
971
+ asset_info: null,
972
+ date_added: null
973
+ }
974
+ ],
975
+ alert_classification_id: null,
976
+ alert_status_id: 3,
977
+ alert_severity_id: 5,
978
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
979
+ alert_source_content: {
980
+ index: "wazuh_00002_268",
981
+ id: "1705000849.1377555541",
982
+ agent_name: "ANSYDWDC01",
983
+ agent_ip: "139.180.134.102",
984
+ agent_id: "102",
985
+ agent_labels_customer: "00002",
986
+ rule_id: "92207",
987
+ rule_level: 12,
988
+ rule_description: "Executable file dropped in Users\\Public folder",
989
+ timestamp: "2024-01-11 19:20:52.106",
990
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
991
+ time_field: "2024-01-11T19:20:48.181Z",
992
+ asset_type_id: 9,
993
+ gl2_source_input: "6459151dea00fd5d3da2df91",
994
+ data_win_system_level: "4",
995
+ data_win_system_processID: "2144",
996
+ rule_mitre_technique: "Ingress Tool Transfer",
997
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
998
+ rule_group1: "sysmon",
999
+ rule_mail: true,
1000
+ decoder_name: "windows_eventchannel",
1001
+ syslog_level: "ALERT",
1002
+ data_win_system_threadID: "3140",
1003
+ data_win_system_eventRecordID: "18951669",
1004
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
1005
+ data_win_eventdata_processId: "3608",
1006
+ streams: [
1007
+ "658d6cec5e9a2d550c8354c1",
1008
+ "659f47da5e9a2d550cac9a40",
1009
+ "659f485b5e9a2d550cac9b85",
1010
+ "645a3a6123e5cc30bbc0e5dc",
1011
+ "658d6d435e9a2d550c83558a"
1012
+ ],
1013
+ gl2_remote_ip: "10.255.255.13",
1014
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
1015
+ agent_ip_geolocation: "1.3078,103.6818",
1016
+ message:
1017
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
1018
+ true: 1705000849.314127,
1019
+ rule_firedtimes: 1,
1020
+ data_win_eventdata_image:
1021
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
1022
+ source_reserved_ip: true,
1023
+ agent_ip_city_name: "Singapore",
1024
+ num_hits: 1,
1025
+ manager_name: "ASHWZHMA",
1026
+ agent_ip_country_code: "SG",
1027
+ syslog_type: "wazuh",
1028
+ data_win_system_eventID: "11",
1029
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
1030
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
1031
+ gl2_accounted_message_size: 4116,
1032
+ data_win_system_message:
1033
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
1034
+ process_id: "3608",
1035
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
1036
+ rule_group3: "windows",
1037
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
1038
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
1039
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
1040
+ num_matches: 1,
1041
+ source: "10.255.255.13",
1042
+ data_win_system_keywords: "0x8000000000000000",
1043
+ gl2_processing_error:
1044
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
1045
+ data_win_system_task: "11",
1046
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
1047
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
1048
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
1049
+ rule_mitre_id: "T1105",
1050
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
1051
+ rule_group2: "sysmon_eid11_detections",
1052
+ rule_mitre_tactic: "Command and Control",
1053
+ location: "EventChannel",
1054
+ gl2_remote_port: 58986,
1055
+ data_win_eventdata_user: "NT AUTHORITY\\\\SYSTEM",
1056
+ data_win_system_opcode: "0",
1057
+ data_win_system_severityValue: "INFORMATION",
1058
+ data_win_system_version: "2"
1059
+ },
1060
+ alert_title: "Executable file dropped in Users\\Public folder",
1061
+ alert_customer_id: 44,
1062
+ alert_resolution_status_id: null,
1063
+ alert_context: {
1064
+ customer_iris_id: 44,
1065
+ customer_name: "test_praeco",
1066
+ customer_cases_index: "dfir_iris_test_praeco",
1067
+ alert_id: "1705000849.1377555541",
1068
+ alert_name: "Executable file dropped in Users\\Public folder",
1069
+ alert_level: 12,
1070
+ rule_id: "92207",
1071
+ asset_name: "ANSYDWDC01",
1072
+ asset_ip: "139.180.134.102",
1073
+ asset_type: 9,
1074
+ process_id: "3608",
1075
+ rule_mitre_id: "T1105",
1076
+ rule_mitre_tactic: "Command and Control",
1077
+ rule_mitre_technique: "Ingress Tool Transfer"
1078
+ },
1079
+ owner: {
1080
+ user_login: "administrator",
1081
+ user_email: "administrator@localhost",
1082
+ user_name: "administrator",
1083
+ id: 1
1084
+ },
1085
+ alert_source_ref: null,
1086
+ alert_tags: null,
1087
+ classification: null,
1088
+ severity: {
1089
+ severity_name: "High",
1090
+ severity_description: "High",
1091
+ severity_id: 5
1092
+ },
1093
+ alert_source_link:
1094
+ "test.com/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22process_id:%5C%223608%5C%22%20AND%20agent_name:%5C%22ANSYDWDC01%5C%22%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D",
1095
+ iocs: [],
1096
+ alert_note: null,
1097
+ alert_source: "SOCFORTRESS RULE",
1098
+ modification_history: {
1099
+ "1705169059.778518": {
1100
+ user: "administrator",
1101
+ user_id: 1,
1102
+ action: "Alert created"
1103
+ },
1104
+ "1705169059.836505": {
1105
+ user: "administrator",
1106
+ user_id: 1,
1107
+ action: "updated alert: \"assets\" from \"[]\" to \"[{'asset_name': 'ANSYDWDC01', 'asset_ip': '139.180.134.102', 'asset_description': 'Microsoft Windows Server 2016 Standard', 'asset_type_id': 9, 'asset_tags': 'agent_id:102'}]\""
1108
+ }
1109
+ },
1110
+ status: {
1111
+ status_description: "Alert is assigned to a user and pending investigation",
1112
+ status_id: 3,
1113
+ status_name: "Assigned"
1114
+ },
1115
+ cases: [],
1116
+ alert_description: "Executable file dropped in Users\\Public folder",
1117
+ customer: {
1118
+ customer_id: 44,
1119
+ customer_sla: null,
1120
+ customer_name: "test_praeco",
1121
+ customer_description: null,
1122
+ creation_date: "2024-01-11T01:46:06.947860",
1123
+ custom_attributes: {},
1124
+ last_update_date: "2024-01-11T01:46:06.947860",
1125
+ client_uuid: "d6d42317-f29d-4637-bfdf-31816e08d587"
1126
+ },
1127
+ alert_id: 12127,
1128
+ resolution_status: null
1129
+ },
1130
+ {
1131
+ alert_owner_id: 1,
1132
+ alert_uuid: "2e6f2bc7-d39d-4b91-be0f-ae75b45914ae",
1133
+ alert_creation_time: "2024-01-13T17:40:19.764429",
1134
+ comments: [],
1135
+ assets: [
1136
+ {
1137
+ asset_name: "ANSYDWDC01",
1138
+ asset_description: "Microsoft Windows Server 2016 Standard",
1139
+ asset_type: {
1140
+ asset_id: 9,
1141
+ asset_icon_compromised: "ioc_windows_desktop.png",
1142
+ asset_name: "Windows - Computer",
1143
+ asset_icon_not_compromised: "windows_desktop.png",
1144
+ asset_description: "Standard Windows Computer"
1145
+ },
1146
+ custom_attributes: null,
1147
+ asset_tags: "agent_id:102",
1148
+ asset_compromise_status_id: null,
1149
+ date_update: null,
1150
+ asset_enrichment: null,
1151
+ case_id: null,
1152
+ user_id: null,
1153
+ asset_type_id: 9,
1154
+ asset_id: 12436,
1155
+ asset_ip: "139.180.134.102",
1156
+ asset_domain: null,
1157
+ asset_uuid: "7f38a9f5-eb7c-45be-9476-457d44b2d607",
1158
+ analysis_status_id: null,
1159
+ asset_info: null,
1160
+ date_added: null
1161
+ }
1162
+ ],
1163
+ alert_classification_id: null,
1164
+ alert_status_id: 3,
1165
+ alert_severity_id: 5,
1166
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
1167
+ alert_source_content: {
1168
+ index: "wazuh_00002_268",
1169
+ id: "1705000849.1377555541",
1170
+ agent_name: "ANSYDWDC01",
1171
+ agent_ip: "139.180.134.102",
1172
+ agent_id: "102",
1173
+ agent_labels_customer: "00002",
1174
+ rule_id: "92207",
1175
+ rule_level: 12,
1176
+ rule_description: "Executable file dropped in Users\\Public folder",
1177
+ timestamp: "2024-01-11 19:20:52.106",
1178
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
1179
+ time_field: "2024-01-11T19:20:48.181Z",
1180
+ asset_type_id: 9,
1181
+ gl2_source_input: "6459151dea00fd5d3da2df91",
1182
+ data_win_system_level: "4",
1183
+ data_win_system_processID: "2144",
1184
+ rule_mitre_technique: "Ingress Tool Transfer",
1185
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
1186
+ rule_group1: "sysmon",
1187
+ rule_mail: true,
1188
+ decoder_name: "windows_eventchannel",
1189
+ syslog_level: "ALERT",
1190
+ data_win_system_threadID: "3140",
1191
+ data_win_system_eventRecordID: "18951669",
1192
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
1193
+ data_win_eventdata_processId: "3608",
1194
+ streams: [
1195
+ "658d6cec5e9a2d550c8354c1",
1196
+ "659f47da5e9a2d550cac9a40",
1197
+ "659f485b5e9a2d550cac9b85",
1198
+ "645a3a6123e5cc30bbc0e5dc",
1199
+ "658d6d435e9a2d550c83558a"
1200
+ ],
1201
+ gl2_remote_ip: "10.255.255.13",
1202
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
1203
+ agent_ip_geolocation: "1.3078,103.6818",
1204
+ message:
1205
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
1206
+ true: 1705000849.314127,
1207
+ rule_firedtimes: 1,
1208
+ data_win_eventdata_image:
1209
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
1210
+ source_reserved_ip: true,
1211
+ agent_ip_city_name: "Singapore",
1212
+ num_hits: 1,
1213
+ manager_name: "ASHWZHMA",
1214
+ agent_ip_country_code: "SG",
1215
+ syslog_type: "wazuh",
1216
+ data_win_system_eventID: "11",
1217
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
1218
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
1219
+ gl2_accounted_message_size: 4116,
1220
+ data_win_system_message:
1221
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
1222
+ process_id: "3608",
1223
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
1224
+ rule_group3: "windows",
1225
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
1226
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
1227
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
1228
+ num_matches: 1,
1229
+ source: "10.255.255.13",
1230
+ data_win_system_keywords: "0x8000000000000000",
1231
+ gl2_processing_error:
1232
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
1233
+ data_win_system_task: "11",
1234
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
1235
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
1236
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
1237
+ rule_mitre_id: "T1105",
1238
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
1239
+ rule_group2: "sysmon_eid11_detections",
1240
+ rule_mitre_tactic: "Command and Control",
1241
+ location: "EventChannel",
1242
+ gl2_remote_port: 58986,
1243
+ data_win_eventdata_user: "NT AUTHORITY\\\\SYSTEM",
1244
+ data_win_system_opcode: "0",
1245
+ data_win_system_severityValue: "INFORMATION",
1246
+ data_win_system_version: "2"
1247
+ },
1248
+ alert_title: "Executable file dropped in Users\\Public folder",
1249
+ alert_customer_id: 44,
1250
+ alert_resolution_status_id: null,
1251
+ alert_context: {
1252
+ customer_iris_id: 44,
1253
+ customer_name: "test_praeco",
1254
+ customer_cases_index: "dfir_iris_test_praeco",
1255
+ alert_id: "1705000849.1377555541",
1256
+ alert_name: "Executable file dropped in Users\\Public folder",
1257
+ alert_level: 12,
1258
+ rule_id: "92207",
1259
+ asset_name: "ANSYDWDC01",
1260
+ asset_ip: "139.180.134.102",
1261
+ asset_type: 9,
1262
+ process_id: "3608",
1263
+ rule_mitre_id: "T1105",
1264
+ rule_mitre_tactic: "Command and Control",
1265
+ rule_mitre_technique: "Ingress Tool Transfer"
1266
+ },
1267
+ owner: {
1268
+ user_login: "administrator",
1269
+ user_email: "administrator@localhost",
1270
+ user_name: "administrator",
1271
+ id: 1
1272
+ },
1273
+ alert_source_ref: null,
1274
+ alert_tags: null,
1275
+ classification: null,
1276
+ severity: {
1277
+ severity_name: "High",
1278
+ severity_description: "High",
1279
+ severity_id: 5
1280
+ },
1281
+ alert_source_link:
1282
+ "test.com/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22process_id:%5C%223608%5C%22%20AND%20agent_name:%5C%22ANSYDWDC01%5C%22%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D",
1283
+ iocs: [],
1284
+ alert_note: null,
1285
+ alert_source: "SOCFORTRESS RULE",
1286
+ modification_history: {
1287
+ "1705167619.769534": {
1288
+ user: "administrator",
1289
+ user_id: 1,
1290
+ action: "Alert created"
1291
+ },
1292
+ "1705167619.818835": {
1293
+ user: "administrator",
1294
+ user_id: 1,
1295
+ action: "updated alert: \"assets\" from \"[]\" to \"[{'asset_name': 'ANSYDWDC01', 'asset_ip': '139.180.134.102', 'asset_description': 'Microsoft Windows Server 2016 Standard', 'asset_type_id': 9, 'asset_tags': 'agent_id:102'}]\""
1296
+ }
1297
+ },
1298
+ status: {
1299
+ status_description: "Alert is assigned to a user and pending investigation",
1300
+ status_id: 3,
1301
+ status_name: "Assigned"
1302
+ },
1303
+ cases: [],
1304
+ alert_description: "Executable file dropped in Users\\Public folder",
1305
+ customer: {
1306
+ customer_id: 44,
1307
+ customer_sla: null,
1308
+ customer_name: "test_praeco",
1309
+ customer_description: null,
1310
+ creation_date: "2024-01-11T01:46:06.947860",
1311
+ custom_attributes: {},
1312
+ last_update_date: "2024-01-11T01:46:06.947860",
1313
+ client_uuid: "d6d42317-f29d-4637-bfdf-31816e08d587"
1314
+ },
1315
+ alert_id: 12031,
1316
+ resolution_status: null
1317
+ },
1318
+ {
1319
+ alert_owner_id: 1,
1320
+ alert_uuid: "a5fb2fb8-d1cf-4617-8156-706dea87b8aa",
1321
+ alert_creation_time: "2024-01-13T17:44:19.760511",
1322
+ comments: [],
1323
+ assets: [
1324
+ {
1325
+ asset_name: "ANSYDWDC01",
1326
+ asset_description: "Microsoft Windows Server 2016 Standard",
1327
+ asset_type: {
1328
+ asset_id: 9,
1329
+ asset_icon_compromised: "ioc_windows_desktop.png",
1330
+ asset_name: "Windows - Computer",
1331
+ asset_icon_not_compromised: "windows_desktop.png",
1332
+ asset_description: "Standard Windows Computer"
1333
+ },
1334
+ custom_attributes: null,
1335
+ asset_tags: "agent_id:102",
1336
+ asset_compromise_status_id: null,
1337
+ date_update: null,
1338
+ asset_enrichment: null,
1339
+ case_id: null,
1340
+ user_id: null,
1341
+ asset_type_id: 9,
1342
+ asset_id: 12452,
1343
+ asset_ip: "139.180.134.102",
1344
+ asset_domain: null,
1345
+ asset_uuid: "d5536446-6b44-4de6-9b4a-86903884e905",
1346
+ analysis_status_id: null,
1347
+ asset_info: null,
1348
+ date_added: null
1349
+ }
1350
+ ],
1351
+ alert_classification_id: null,
1352
+ alert_status_id: 3,
1353
+ alert_severity_id: 5,
1354
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
1355
+ alert_source_content: {
1356
+ index: "wazuh_00002_268",
1357
+ id: "1705000849.1377555541",
1358
+ agent_name: "ANSYDWDC01",
1359
+ agent_ip: "139.180.134.102",
1360
+ agent_id: "102",
1361
+ agent_labels_customer: "00002",
1362
+ rule_id: "92207",
1363
+ rule_level: 12,
1364
+ rule_description: "Executable file dropped in Users\\Public folder",
1365
+ timestamp: "2024-01-11 19:20:52.106",
1366
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
1367
+ time_field: "2024-01-11T19:20:48.181Z",
1368
+ asset_type_id: 9,
1369
+ gl2_source_input: "6459151dea00fd5d3da2df91",
1370
+ data_win_system_level: "4",
1371
+ data_win_system_processID: "2144",
1372
+ rule_mitre_technique: "Ingress Tool Transfer",
1373
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
1374
+ rule_group1: "sysmon",
1375
+ rule_mail: true,
1376
+ decoder_name: "windows_eventchannel",
1377
+ syslog_level: "ALERT",
1378
+ data_win_system_threadID: "3140",
1379
+ data_win_system_eventRecordID: "18951669",
1380
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
1381
+ data_win_eventdata_processId: "3608",
1382
+ streams: [
1383
+ "658d6cec5e9a2d550c8354c1",
1384
+ "659f47da5e9a2d550cac9a40",
1385
+ "659f485b5e9a2d550cac9b85",
1386
+ "645a3a6123e5cc30bbc0e5dc",
1387
+ "658d6d435e9a2d550c83558a"
1388
+ ],
1389
+ gl2_remote_ip: "10.255.255.13",
1390
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
1391
+ agent_ip_geolocation: "1.3078,103.6818",
1392
+ message:
1393
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
1394
+ true: 1705000849.314127,
1395
+ rule_firedtimes: 1,
1396
+ data_win_eventdata_image:
1397
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
1398
+ source_reserved_ip: true,
1399
+ agent_ip_city_name: "Singapore",
1400
+ num_hits: 1,
1401
+ manager_name: "ASHWZHMA",
1402
+ agent_ip_country_code: "SG",
1403
+ syslog_type: "wazuh",
1404
+ data_win_system_eventID: "11",
1405
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
1406
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
1407
+ gl2_accounted_message_size: 4116,
1408
+ data_win_system_message:
1409
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
1410
+ process_id: "3608",
1411
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
1412
+ rule_group3: "windows",
1413
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
1414
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
1415
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
1416
+ num_matches: 1,
1417
+ source: "10.255.255.13",
1418
+ data_win_system_keywords: "0x8000000000000000",
1419
+ gl2_processing_error:
1420
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
1421
+ data_win_system_task: "11",
1422
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
1423
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
1424
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
1425
+ rule_mitre_id: "T1105",
1426
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
1427
+ rule_group2: "sysmon_eid11_detections",
1428
+ rule_mitre_tactic: "Command and Control",
1429
+ location: "EventChannel",
1430
+ gl2_remote_port: 58986,
1431
+ data_win_eventdata_user: "NT AUTHORITY\\\\SYSTEM",
1432
+ data_win_system_opcode: "0",
1433
+ data_win_system_severityValue: "INFORMATION",
1434
+ data_win_system_version: "2"
1435
+ },
1436
+ alert_title: "Executable file dropped in Users\\Public folder",
1437
+ alert_customer_id: 44,
1438
+ alert_resolution_status_id: null,
1439
+ alert_context: {
1440
+ customer_iris_id: 44,
1441
+ customer_name: "test_praeco",
1442
+ customer_cases_index: "dfir_iris_test_praeco",
1443
+ alert_id: "1705000849.1377555541",
1444
+ alert_name: "Executable file dropped in Users\\Public folder",
1445
+ alert_level: 12,
1446
+ rule_id: "92207",
1447
+ asset_name: "ANSYDWDC01",
1448
+ asset_ip: "139.180.134.102",
1449
+ asset_type: 9,
1450
+ process_id: "3608",
1451
+ rule_mitre_id: "T1105",
1452
+ rule_mitre_tactic: "Command and Control",
1453
+ rule_mitre_technique: "Ingress Tool Transfer"
1454
+ },
1455
+ owner: {
1456
+ user_login: "administrator",
1457
+ user_email: "administrator@localhost",
1458
+ user_name: "administrator",
1459
+ id: 1
1460
+ },
1461
+ alert_source_ref: null,
1462
+ alert_tags: null,
1463
+ classification: null,
1464
+ severity: {
1465
+ severity_name: "High",
1466
+ severity_description: "High",
1467
+ severity_id: 5
1468
+ },
1469
+ alert_source_link:
1470
+ "test.com/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22process_id:%5C%223608%5C%22%20AND%20agent_name:%5C%22ANSYDWDC01%5C%22%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D",
1471
+ iocs: [],
1472
+ alert_note: null,
1473
+ alert_source: "SOCFORTRESS RULE",
1474
+ modification_history: {
1475
+ "1705167859.765731": {
1476
+ user: "administrator",
1477
+ user_id: 1,
1478
+ action: "Alert created"
1479
+ },
1480
+ "1705167859.811671": {
1481
+ user: "administrator",
1482
+ user_id: 1,
1483
+ action: "updated alert: \"assets\" from \"[]\" to \"[{'asset_name': 'ANSYDWDC01', 'asset_ip': '139.180.134.102', 'asset_description': 'Microsoft Windows Server 2016 Standard', 'asset_type_id': 9, 'asset_tags': 'agent_id:102'}]\""
1484
+ }
1485
+ },
1486
+ status: {
1487
+ status_description: "Alert is assigned to a user and pending investigation",
1488
+ status_id: 3,
1489
+ status_name: "Assigned"
1490
+ },
1491
+ cases: [],
1492
+ alert_description: "Executable file dropped in Users\\Public folder",
1493
+ customer: {
1494
+ customer_id: 44,
1495
+ customer_sla: null,
1496
+ customer_name: "test_praeco",
1497
+ customer_description: null,
1498
+ creation_date: "2024-01-11T01:46:06.947860",
1499
+ custom_attributes: {},
1500
+ last_update_date: "2024-01-11T01:46:06.947860",
1501
+ client_uuid: "d6d42317-f29d-4637-bfdf-31816e08d587"
1502
+ },
1503
+ alert_id: 12047,
1504
+ resolution_status: null
1505
+ },
1506
+ {
1507
+ alert_owner_id: 1,
1508
+ alert_uuid: "25983587-04e7-45ce-86de-ffca411852dc",
1509
+ alert_creation_time: "2024-01-13T17:50:19.770806",
1510
+ comments: [],
1511
+ assets: [
1512
+ {
1513
+ asset_name: "ANSYDWDC01",
1514
+ asset_description: "Microsoft Windows Server 2016 Standard",
1515
+ asset_type: {
1516
+ asset_id: 9,
1517
+ asset_icon_compromised: "ioc_windows_desktop.png",
1518
+ asset_name: "Windows - Computer",
1519
+ asset_icon_not_compromised: "windows_desktop.png",
1520
+ asset_description: "Standard Windows Computer"
1521
+ },
1522
+ custom_attributes: null,
1523
+ asset_tags: "agent_id:102",
1524
+ asset_compromise_status_id: null,
1525
+ date_update: null,
1526
+ asset_enrichment: null,
1527
+ case_id: null,
1528
+ user_id: null,
1529
+ asset_type_id: 9,
1530
+ asset_id: 12476,
1531
+ asset_ip: "139.180.134.102",
1532
+ asset_domain: null,
1533
+ asset_uuid: "70af1621-9bb8-4921-88d2-301f4734e4e1",
1534
+ analysis_status_id: null,
1535
+ asset_info: null,
1536
+ date_added: null
1537
+ }
1538
+ ],
1539
+ alert_classification_id: null,
1540
+ alert_status_id: 3,
1541
+ alert_severity_id: 5,
1542
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
1543
+ alert_source_content: {
1544
+ index: "wazuh_00002_268",
1545
+ id: "1705000849.1377555541",
1546
+ agent_name: "ANSYDWDC01",
1547
+ agent_ip: "139.180.134.102",
1548
+ agent_id: "102",
1549
+ agent_labels_customer: "00002",
1550
+ rule_id: "92207",
1551
+ rule_level: 12,
1552
+ rule_description: "Executable file dropped in Users\\Public folder",
1553
+ timestamp: "2024-01-11 19:20:52.106",
1554
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
1555
+ time_field: "2024-01-11T19:20:48.181Z",
1556
+ asset_type_id: 9,
1557
+ gl2_source_input: "6459151dea00fd5d3da2df91",
1558
+ data_win_system_level: "4",
1559
+ data_win_system_processID: "2144",
1560
+ rule_mitre_technique: "Ingress Tool Transfer",
1561
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
1562
+ rule_group1: "sysmon",
1563
+ rule_mail: true,
1564
+ decoder_name: "windows_eventchannel",
1565
+ syslog_level: "ALERT",
1566
+ data_win_system_threadID: "3140",
1567
+ data_win_system_eventRecordID: "18951669",
1568
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
1569
+ data_win_eventdata_processId: "3608",
1570
+ streams: [
1571
+ "658d6cec5e9a2d550c8354c1",
1572
+ "659f47da5e9a2d550cac9a40",
1573
+ "659f485b5e9a2d550cac9b85",
1574
+ "645a3a6123e5cc30bbc0e5dc",
1575
+ "658d6d435e9a2d550c83558a"
1576
+ ],
1577
+ gl2_remote_ip: "10.255.255.13",
1578
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
1579
+ agent_ip_geolocation: "1.3078,103.6818",
1580
+ message:
1581
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
1582
+ true: 1705000849.314127,
1583
+ rule_firedtimes: 1,
1584
+ data_win_eventdata_image:
1585
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
1586
+ source_reserved_ip: true,
1587
+ agent_ip_city_name: "Singapore",
1588
+ num_hits: 1,
1589
+ manager_name: "ASHWZHMA",
1590
+ agent_ip_country_code: "SG",
1591
+ syslog_type: "wazuh",
1592
+ data_win_system_eventID: "11",
1593
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
1594
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
1595
+ gl2_accounted_message_size: 4116,
1596
+ data_win_system_message:
1597
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
1598
+ process_id: "3608",
1599
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
1600
+ rule_group3: "windows",
1601
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
1602
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
1603
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
1604
+ num_matches: 1,
1605
+ source: "10.255.255.13",
1606
+ data_win_system_keywords: "0x8000000000000000",
1607
+ gl2_processing_error:
1608
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
1609
+ data_win_system_task: "11",
1610
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
1611
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
1612
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
1613
+ rule_mitre_id: "T1105",
1614
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
1615
+ rule_group2: "sysmon_eid11_detections",
1616
+ rule_mitre_tactic: "Command and Control",
1617
+ location: "EventChannel",
1618
+ gl2_remote_port: 58986,
1619
+ data_win_eventdata_user: "NT AUTHORITY\\\\SYSTEM",
1620
+ data_win_system_opcode: "0",
1621
+ data_win_system_severityValue: "INFORMATION",
1622
+ data_win_system_version: "2"
1623
+ },
1624
+ alert_title: "Executable file dropped in Users\\Public folder",
1625
+ alert_customer_id: 44,
1626
+ alert_resolution_status_id: null,
1627
+ alert_context: {
1628
+ customer_iris_id: 44,
1629
+ customer_name: "test_praeco",
1630
+ customer_cases_index: "dfir_iris_test_praeco",
1631
+ alert_id: "1705000849.1377555541",
1632
+ alert_name: "Executable file dropped in Users\\Public folder",
1633
+ alert_level: 12,
1634
+ rule_id: "92207",
1635
+ asset_name: "ANSYDWDC01",
1636
+ asset_ip: "139.180.134.102",
1637
+ asset_type: 9,
1638
+ process_id: "3608",
1639
+ rule_mitre_id: "T1105",
1640
+ rule_mitre_tactic: "Command and Control",
1641
+ rule_mitre_technique: "Ingress Tool Transfer"
1642
+ },
1643
+ owner: {
1644
+ user_login: "administrator",
1645
+ user_email: "administrator@localhost",
1646
+ user_name: "administrator",
1647
+ id: 1
1648
+ },
1649
+ alert_source_ref: null,
1650
+ alert_tags: null,
1651
+ classification: null,
1652
+ severity: {
1653
+ severity_name: "High",
1654
+ severity_description: "High",
1655
+ severity_id: 5
1656
+ },
1657
+ alert_source_link:
1658
+ "test.com/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22process_id:%5C%223608%5C%22%20AND%20agent_name:%5C%22ANSYDWDC01%5C%22%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D",
1659
+ iocs: [],
1660
+ alert_note: null,
1661
+ alert_source: "SOCFORTRESS RULE",
1662
+ modification_history: {
1663
+ "1705168219.77573": {
1664
+ user: "administrator",
1665
+ user_id: 1,
1666
+ action: "Alert created"
1667
+ },
1668
+ "1705168219.828675": {
1669
+ user: "administrator",
1670
+ user_id: 1,
1671
+ action: "updated alert: \"assets\" from \"[]\" to \"[{'asset_name': 'ANSYDWDC01', 'asset_ip': '139.180.134.102', 'asset_description': 'Microsoft Windows Server 2016 Standard', 'asset_type_id': 9, 'asset_tags': 'agent_id:102'}]\""
1672
+ }
1673
+ },
1674
+ status: {
1675
+ status_description: "Alert is assigned to a user and pending investigation",
1676
+ status_id: 3,
1677
+ status_name: "Assigned"
1678
+ },
1679
+ cases: [],
1680
+ alert_description: "Executable file dropped in Users\\Public folder",
1681
+ customer: {
1682
+ customer_id: 44,
1683
+ customer_sla: null,
1684
+ customer_name: "test_praeco",
1685
+ customer_description: null,
1686
+ creation_date: "2024-01-11T01:46:06.947860",
1687
+ custom_attributes: {},
1688
+ last_update_date: "2024-01-11T01:46:06.947860",
1689
+ client_uuid: "d6d42317-f29d-4637-bfdf-31816e08d587"
1690
+ },
1691
+ alert_id: 12071,
1692
+ resolution_status: null
1693
+ },
1694
+ {
1695
+ alert_owner_id: 1,
1696
+ alert_uuid: "8eeb72be-af2b-4021-8b8e-0e4c47138347",
1697
+ alert_creation_time: "2024-01-13T17:54:19.765353",
1698
+ comments: [],
1699
+ assets: [
1700
+ {
1701
+ asset_name: "ANSYDWDC01",
1702
+ asset_description: "Microsoft Windows Server 2016 Standard",
1703
+ asset_type: {
1704
+ asset_id: 9,
1705
+ asset_icon_compromised: "ioc_windows_desktop.png",
1706
+ asset_name: "Windows - Computer",
1707
+ asset_icon_not_compromised: "windows_desktop.png",
1708
+ asset_description: "Standard Windows Computer"
1709
+ },
1710
+ custom_attributes: null,
1711
+ asset_tags: "agent_id:102",
1712
+ asset_compromise_status_id: null,
1713
+ date_update: null,
1714
+ asset_enrichment: null,
1715
+ case_id: null,
1716
+ user_id: null,
1717
+ asset_type_id: 9,
1718
+ asset_id: 12492,
1719
+ asset_ip: "139.180.134.102",
1720
+ asset_domain: null,
1721
+ asset_uuid: "ee8c4bbe-c44b-45b6-82eb-4a3118b4067c",
1722
+ analysis_status_id: null,
1723
+ asset_info: null,
1724
+ date_added: null
1725
+ }
1726
+ ],
1727
+ alert_classification_id: null,
1728
+ alert_status_id: 3,
1729
+ alert_severity_id: 5,
1730
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
1731
+ alert_source_content: {
1732
+ index: "wazuh_00002_268",
1733
+ id: "1705000849.1377555541",
1734
+ agent_name: "ANSYDWDC01",
1735
+ agent_ip: "139.180.134.102",
1736
+ agent_id: "102",
1737
+ agent_labels_customer: "00002",
1738
+ rule_id: "92207",
1739
+ rule_level: 12,
1740
+ rule_description: "Executable file dropped in Users\\Public folder",
1741
+ timestamp: "2024-01-11 19:20:52.106",
1742
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
1743
+ time_field: "2024-01-11T19:20:48.181Z",
1744
+ asset_type_id: 9,
1745
+ gl2_source_input: "6459151dea00fd5d3da2df91",
1746
+ data_win_system_level: "4",
1747
+ data_win_system_processID: "2144",
1748
+ rule_mitre_technique: "Ingress Tool Transfer",
1749
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
1750
+ rule_group1: "sysmon",
1751
+ rule_mail: true,
1752
+ decoder_name: "windows_eventchannel",
1753
+ syslog_level: "ALERT",
1754
+ data_win_system_threadID: "3140",
1755
+ data_win_system_eventRecordID: "18951669",
1756
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
1757
+ data_win_eventdata_processId: "3608",
1758
+ streams: [
1759
+ "658d6cec5e9a2d550c8354c1",
1760
+ "659f47da5e9a2d550cac9a40",
1761
+ "659f485b5e9a2d550cac9b85",
1762
+ "645a3a6123e5cc30bbc0e5dc",
1763
+ "658d6d435e9a2d550c83558a"
1764
+ ],
1765
+ gl2_remote_ip: "10.255.255.13",
1766
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
1767
+ agent_ip_geolocation: "1.3078,103.6818",
1768
+ message:
1769
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
1770
+ true: 1705000849.314127,
1771
+ rule_firedtimes: 1,
1772
+ data_win_eventdata_image:
1773
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
1774
+ source_reserved_ip: true,
1775
+ agent_ip_city_name: "Singapore",
1776
+ num_hits: 1,
1777
+ manager_name: "ASHWZHMA",
1778
+ agent_ip_country_code: "SG",
1779
+ syslog_type: "wazuh",
1780
+ data_win_system_eventID: "11",
1781
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
1782
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
1783
+ gl2_accounted_message_size: 4116,
1784
+ data_win_system_message:
1785
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
1786
+ process_id: "3608",
1787
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
1788
+ rule_group3: "windows",
1789
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
1790
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
1791
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
1792
+ num_matches: 1,
1793
+ source: "10.255.255.13",
1794
+ data_win_system_keywords: "0x8000000000000000",
1795
+ gl2_processing_error:
1796
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
1797
+ data_win_system_task: "11",
1798
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
1799
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
1800
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
1801
+ rule_mitre_id: "T1105",
1802
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
1803
+ rule_group2: "sysmon_eid11_detections",
1804
+ rule_mitre_tactic: "Command and Control",
1805
+ location: "EventChannel",
1806
+ gl2_remote_port: 58986,
1807
+ data_win_eventdata_user: "NT AUTHORITY\\\\SYSTEM",
1808
+ data_win_system_opcode: "0",
1809
+ data_win_system_severityValue: "INFORMATION",
1810
+ data_win_system_version: "2"
1811
+ },
1812
+ alert_title: "Executable file dropped in Users\\Public folder",
1813
+ alert_customer_id: 44,
1814
+ alert_resolution_status_id: null,
1815
+ alert_context: {
1816
+ customer_iris_id: 44,
1817
+ customer_name: "test_praeco",
1818
+ customer_cases_index: "dfir_iris_test_praeco",
1819
+ alert_id: "1705000849.1377555541",
1820
+ alert_name: "Executable file dropped in Users\\Public folder",
1821
+ alert_level: 12,
1822
+ rule_id: "92207",
1823
+ asset_name: "ANSYDWDC01",
1824
+ asset_ip: "139.180.134.102",
1825
+ asset_type: 9,
1826
+ process_id: "3608",
1827
+ rule_mitre_id: "T1105",
1828
+ rule_mitre_tactic: "Command and Control",
1829
+ rule_mitre_technique: "Ingress Tool Transfer"
1830
+ },
1831
+ owner: {
1832
+ user_login: "administrator",
1833
+ user_email: "administrator@localhost",
1834
+ user_name: "administrator",
1835
+ id: 1
1836
+ },
1837
+ alert_source_ref: null,
1838
+ alert_tags: null,
1839
+ classification: null,
1840
+ severity: {
1841
+ severity_name: "High",
1842
+ severity_description: "High",
1843
+ severity_id: 5
1844
+ },
1845
+ alert_source_link:
1846
+ "test.com/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22process_id:%5C%223608%5C%22%20AND%20agent_name:%5C%22ANSYDWDC01%5C%22%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D",
1847
+ iocs: [],
1848
+ alert_note: null,
1849
+ alert_source: "SOCFORTRESS RULE",
1850
+ modification_history: {
1851
+ "1705168459.770737": {
1852
+ user: "administrator",
1853
+ user_id: 1,
1854
+ action: "Alert created"
1855
+ },
1856
+ "1705168459.833107": {
1857
+ user: "administrator",
1858
+ user_id: 1,
1859
+ action: "updated alert: \"assets\" from \"[]\" to \"[{'asset_name': 'ANSYDWDC01', 'asset_ip': '139.180.134.102', 'asset_description': 'Microsoft Windows Server 2016 Standard', 'asset_type_id': 9, 'asset_tags': 'agent_id:102'}]\""
1860
+ }
1861
+ },
1862
+ status: {
1863
+ status_description: "Alert is assigned to a user and pending investigation",
1864
+ status_id: 3,
1865
+ status_name: "Assigned"
1866
+ },
1867
+ cases: [],
1868
+ alert_description: "Executable file dropped in Users\\Public folder",
1869
+ customer: {
1870
+ customer_id: 44,
1871
+ customer_sla: null,
1872
+ customer_name: "test_praeco",
1873
+ customer_description: null,
1874
+ creation_date: "2024-01-11T01:46:06.947860",
1875
+ custom_attributes: {},
1876
+ last_update_date: "2024-01-11T01:46:06.947860",
1877
+ client_uuid: "d6d42317-f29d-4637-bfdf-31816e08d587"
1878
+ },
1879
+ alert_id: 12087,
1880
+ resolution_status: null
1881
+ },
1882
+ {
1883
+ alert_owner_id: 1,
1884
+ alert_uuid: "bf9f1f0b-b5cb-48d0-8038-8e3a00c4ad73",
1885
+ alert_creation_time: "2024-01-13T17:58:19.763965",
1886
+ comments: [],
1887
+ assets: [
1888
+ {
1889
+ asset_name: "ANSYDWDC01",
1890
+ asset_description: "Microsoft Windows Server 2016 Standard",
1891
+ asset_type: {
1892
+ asset_id: 9,
1893
+ asset_icon_compromised: "ioc_windows_desktop.png",
1894
+ asset_name: "Windows - Computer",
1895
+ asset_icon_not_compromised: "windows_desktop.png",
1896
+ asset_description: "Standard Windows Computer"
1897
+ },
1898
+ custom_attributes: null,
1899
+ asset_tags: "agent_id:102",
1900
+ asset_compromise_status_id: null,
1901
+ date_update: null,
1902
+ asset_enrichment: null,
1903
+ case_id: null,
1904
+ user_id: null,
1905
+ asset_type_id: 9,
1906
+ asset_id: 12508,
1907
+ asset_ip: "139.180.134.102",
1908
+ asset_domain: null,
1909
+ asset_uuid: "5b58ad8f-baca-4538-9a92-6a6d93e9c88d",
1910
+ analysis_status_id: null,
1911
+ asset_info: null,
1912
+ date_added: null
1913
+ }
1914
+ ],
1915
+ alert_classification_id: null,
1916
+ alert_status_id: 3,
1917
+ alert_severity_id: 5,
1918
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
1919
+ alert_source_content: {
1920
+ index: "wazuh_00002_268",
1921
+ id: "1705000849.1377555541",
1922
+ agent_name: "ANSYDWDC01",
1923
+ agent_ip: "139.180.134.102",
1924
+ agent_id: "102",
1925
+ agent_labels_customer: "00002",
1926
+ rule_id: "92207",
1927
+ rule_level: 12,
1928
+ rule_description: "Executable file dropped in Users\\Public folder",
1929
+ timestamp: "2024-01-11 19:20:52.106",
1930
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
1931
+ time_field: "2024-01-11T19:20:48.181Z",
1932
+ asset_type_id: 9,
1933
+ gl2_source_input: "6459151dea00fd5d3da2df91",
1934
+ data_win_system_level: "4",
1935
+ data_win_system_processID: "2144",
1936
+ rule_mitre_technique: "Ingress Tool Transfer",
1937
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
1938
+ rule_group1: "sysmon",
1939
+ rule_mail: true,
1940
+ decoder_name: "windows_eventchannel",
1941
+ syslog_level: "ALERT",
1942
+ data_win_system_threadID: "3140",
1943
+ data_win_system_eventRecordID: "18951669",
1944
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
1945
+ data_win_eventdata_processId: "3608",
1946
+ streams: [
1947
+ "658d6cec5e9a2d550c8354c1",
1948
+ "659f47da5e9a2d550cac9a40",
1949
+ "659f485b5e9a2d550cac9b85",
1950
+ "645a3a6123e5cc30bbc0e5dc",
1951
+ "658d6d435e9a2d550c83558a"
1952
+ ],
1953
+ gl2_remote_ip: "10.255.255.13",
1954
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
1955
+ agent_ip_geolocation: "1.3078,103.6818",
1956
+ message:
1957
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
1958
+ true: 1705000849.314127,
1959
+ rule_firedtimes: 1,
1960
+ data_win_eventdata_image:
1961
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
1962
+ source_reserved_ip: true,
1963
+ agent_ip_city_name: "Singapore",
1964
+ num_hits: 1,
1965
+ manager_name: "ASHWZHMA",
1966
+ agent_ip_country_code: "SG",
1967
+ syslog_type: "wazuh",
1968
+ data_win_system_eventID: "11",
1969
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
1970
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
1971
+ gl2_accounted_message_size: 4116,
1972
+ data_win_system_message:
1973
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
1974
+ process_id: "3608",
1975
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
1976
+ rule_group3: "windows",
1977
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
1978
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
1979
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
1980
+ num_matches: 1,
1981
+ source: "10.255.255.13",
1982
+ data_win_system_keywords: "0x8000000000000000",
1983
+ gl2_processing_error:
1984
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
1985
+ data_win_system_task: "11",
1986
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
1987
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
1988
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
1989
+ rule_mitre_id: "T1105",
1990
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
1991
+ rule_group2: "sysmon_eid11_detections",
1992
+ rule_mitre_tactic: "Command and Control",
1993
+ location: "EventChannel",
1994
+ gl2_remote_port: 58986,
1995
+ data_win_eventdata_user: "NT AUTHORITY\\\\SYSTEM",
1996
+ data_win_system_opcode: "0",
1997
+ data_win_system_severityValue: "INFORMATION",
1998
+ data_win_system_version: "2"
1999
+ },
2000
+ alert_title: "Executable file dropped in Users\\Public folder",
2001
+ alert_customer_id: 44,
2002
+ alert_resolution_status_id: null,
2003
+ alert_context: {
2004
+ customer_iris_id: 44,
2005
+ customer_name: "test_praeco",
2006
+ customer_cases_index: "dfir_iris_test_praeco",
2007
+ alert_id: "1705000849.1377555541",
2008
+ alert_name: "Executable file dropped in Users\\Public folder",
2009
+ alert_level: 12,
2010
+ rule_id: "92207",
2011
+ asset_name: "ANSYDWDC01",
2012
+ asset_ip: "139.180.134.102",
2013
+ asset_type: 9,
2014
+ process_id: "3608",
2015
+ rule_mitre_id: "T1105",
2016
+ rule_mitre_tactic: "Command and Control",
2017
+ rule_mitre_technique: "Ingress Tool Transfer"
2018
+ },
2019
+ owner: {
2020
+ user_login: "administrator",
2021
+ user_email: "administrator@localhost",
2022
+ user_name: "administrator",
2023
+ id: 1
2024
+ },
2025
+ alert_source_ref: null,
2026
+ alert_tags: null,
2027
+ classification: null,
2028
+ severity: {
2029
+ severity_name: "High",
2030
+ severity_description: "High",
2031
+ severity_id: 5
2032
+ },
2033
+ alert_source_link:
2034
+ "test.com/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22process_id:%5C%223608%5C%22%20AND%20agent_name:%5C%22ANSYDWDC01%5C%22%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D",
2035
+ iocs: [],
2036
+ alert_note: null,
2037
+ alert_source: "SOCFORTRESS RULE",
2038
+ modification_history: {
2039
+ "1705168699.769288": {
2040
+ user: "administrator",
2041
+ user_id: 1,
2042
+ action: "Alert created"
2043
+ },
2044
+ "1705168699.82393": {
2045
+ user: "administrator",
2046
+ user_id: 1,
2047
+ action: "updated alert: \"assets\" from \"[]\" to \"[{'asset_name': 'ANSYDWDC01', 'asset_ip': '139.180.134.102', 'asset_description': 'Microsoft Windows Server 2016 Standard', 'asset_type_id': 9, 'asset_tags': 'agent_id:102'}]\""
2048
+ }
2049
+ },
2050
+ status: {
2051
+ status_description: "Alert is assigned to a user and pending investigation",
2052
+ status_id: 3,
2053
+ status_name: "Assigned"
2054
+ },
2055
+ cases: [],
2056
+ alert_description: "Executable file dropped in Users\\Public folder",
2057
+ customer: {
2058
+ customer_id: 44,
2059
+ customer_sla: null,
2060
+ customer_name: "test_praeco",
2061
+ customer_description: null,
2062
+ creation_date: "2024-01-11T01:46:06.947860",
2063
+ custom_attributes: {},
2064
+ last_update_date: "2024-01-11T01:46:06.947860",
2065
+ client_uuid: "d6d42317-f29d-4637-bfdf-31816e08d587"
2066
+ },
2067
+ alert_id: 12103,
2068
+ resolution_status: null
2069
+ },
2070
+ {
2071
+ alert_owner_id: 1,
2072
+ alert_uuid: "9d2d48de-8ad0-4fa9-9cd2-1f33229acd91",
2073
+ alert_creation_time: "2024-01-13T18:01:19.758224",
2074
+ comments: [],
2075
+ assets: [
2076
+ {
2077
+ asset_name: "ANSYDWDC01",
2078
+ asset_description: "Microsoft Windows Server 2016 Standard",
2079
+ asset_type: {
2080
+ asset_id: 9,
2081
+ asset_icon_compromised: "ioc_windows_desktop.png",
2082
+ asset_name: "Windows - Computer",
2083
+ asset_icon_not_compromised: "windows_desktop.png",
2084
+ asset_description: "Standard Windows Computer"
2085
+ },
2086
+ custom_attributes: null,
2087
+ asset_tags: "agent_id:102",
2088
+ asset_compromise_status_id: null,
2089
+ date_update: null,
2090
+ asset_enrichment: null,
2091
+ case_id: null,
2092
+ user_id: null,
2093
+ asset_type_id: 9,
2094
+ asset_id: 12520,
2095
+ asset_ip: "139.180.134.102",
2096
+ asset_domain: null,
2097
+ asset_uuid: "1a0865ab-f742-456d-937a-a0ddff1246a4",
2098
+ analysis_status_id: null,
2099
+ asset_info: null,
2100
+ date_added: null
2101
+ }
2102
+ ],
2103
+ alert_classification_id: null,
2104
+ alert_status_id: 3,
2105
+ alert_severity_id: 5,
2106
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
2107
+ alert_source_content: {
2108
+ index: "wazuh_00002_268",
2109
+ id: "1705000849.1377555541",
2110
+ agent_name: "ANSYDWDC01",
2111
+ agent_ip: "139.180.134.102",
2112
+ agent_id: "102",
2113
+ agent_labels_customer: "00002",
2114
+ rule_id: "92207",
2115
+ rule_level: 12,
2116
+ rule_description: "Executable file dropped in Users\\Public folder",
2117
+ timestamp: "2024-01-11 19:20:52.106",
2118
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
2119
+ time_field: "2024-01-11T19:20:48.181Z",
2120
+ asset_type_id: 9,
2121
+ gl2_source_input: "6459151dea00fd5d3da2df91",
2122
+ data_win_system_level: "4",
2123
+ data_win_system_processID: "2144",
2124
+ rule_mitre_technique: "Ingress Tool Transfer",
2125
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
2126
+ rule_group1: "sysmon",
2127
+ rule_mail: true,
2128
+ decoder_name: "windows_eventchannel",
2129
+ syslog_level: "ALERT",
2130
+ data_win_system_threadID: "3140",
2131
+ data_win_system_eventRecordID: "18951669",
2132
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
2133
+ data_win_eventdata_processId: "3608",
2134
+ streams: [
2135
+ "658d6cec5e9a2d550c8354c1",
2136
+ "659f47da5e9a2d550cac9a40",
2137
+ "659f485b5e9a2d550cac9b85",
2138
+ "645a3a6123e5cc30bbc0e5dc",
2139
+ "658d6d435e9a2d550c83558a"
2140
+ ],
2141
+ gl2_remote_ip: "10.255.255.13",
2142
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
2143
+ agent_ip_geolocation: "1.3078,103.6818",
2144
+ message:
2145
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
2146
+ true: 1705000849.314127,
2147
+ rule_firedtimes: 1,
2148
+ data_win_eventdata_image:
2149
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
2150
+ source_reserved_ip: true,
2151
+ agent_ip_city_name: "Singapore",
2152
+ num_hits: 1,
2153
+ manager_name: "ASHWZHMA",
2154
+ agent_ip_country_code: "SG",
2155
+ syslog_type: "wazuh",
2156
+ data_win_system_eventID: "11",
2157
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
2158
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
2159
+ gl2_accounted_message_size: 4116,
2160
+ data_win_system_message:
2161
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
2162
+ process_id: "3608",
2163
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
2164
+ rule_group3: "windows",
2165
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
2166
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
2167
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
2168
+ num_matches: 1,
2169
+ source: "10.255.255.13",
2170
+ data_win_system_keywords: "0x8000000000000000",
2171
+ gl2_processing_error:
2172
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
2173
+ data_win_system_task: "11",
2174
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
2175
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
2176
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
2177
+ rule_mitre_id: "T1105",
2178
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
2179
+ rule_group2: "sysmon_eid11_detections",
2180
+ rule_mitre_tactic: "Command and Control",
2181
+ location: "EventChannel",
2182
+ gl2_remote_port: 58986,
2183
+ data_win_eventdata_user: "NT AUTHORITY\\\\SYSTEM",
2184
+ data_win_system_opcode: "0",
2185
+ data_win_system_severityValue: "INFORMATION",
2186
+ data_win_system_version: "2"
2187
+ },
2188
+ alert_title: "Executable file dropped in Users\\Public folder",
2189
+ alert_customer_id: 44,
2190
+ alert_resolution_status_id: null,
2191
+ alert_context: {
2192
+ customer_iris_id: 44,
2193
+ customer_name: "test_praeco",
2194
+ customer_cases_index: "dfir_iris_test_praeco",
2195
+ alert_id: "1705000849.1377555541",
2196
+ alert_name: "Executable file dropped in Users\\Public folder",
2197
+ alert_level: 12,
2198
+ rule_id: "92207",
2199
+ asset_name: "ANSYDWDC01",
2200
+ asset_ip: "139.180.134.102",
2201
+ asset_type: 9,
2202
+ process_id: "3608",
2203
+ rule_mitre_id: "T1105",
2204
+ rule_mitre_tactic: "Command and Control",
2205
+ rule_mitre_technique: "Ingress Tool Transfer"
2206
+ },
2207
+ owner: {
2208
+ user_login: "administrator",
2209
+ user_email: "administrator@localhost",
2210
+ user_name: "administrator",
2211
+ id: 1
2212
+ },
2213
+ alert_source_ref: null,
2214
+ alert_tags: null,
2215
+ classification: null,
2216
+ severity: {
2217
+ severity_name: "High",
2218
+ severity_description: "High",
2219
+ severity_id: 5
2220
+ },
2221
+ alert_source_link:
2222
+ "test.com/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22process_id:%5C%223608%5C%22%20AND%20agent_name:%5C%22ANSYDWDC01%5C%22%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D",
2223
+ iocs: [],
2224
+ alert_note: null,
2225
+ alert_source: "SOCFORTRESS RULE",
2226
+ modification_history: {
2227
+ "1705168879.764017": {
2228
+ user: "administrator",
2229
+ user_id: 1,
2230
+ action: "Alert created"
2231
+ },
2232
+ "1705168879.817701": {
2233
+ user: "administrator",
2234
+ user_id: 1,
2235
+ action: "updated alert: \"assets\" from \"[]\" to \"[{'asset_name': 'ANSYDWDC01', 'asset_ip': '139.180.134.102', 'asset_description': 'Microsoft Windows Server 2016 Standard', 'asset_type_id': 9, 'asset_tags': 'agent_id:102'}]\""
2236
+ }
2237
+ },
2238
+ status: {
2239
+ status_description: "Alert is assigned to a user and pending investigation",
2240
+ status_id: 3,
2241
+ status_name: "Assigned"
2242
+ },
2243
+ cases: [],
2244
+ alert_description: "Executable file dropped in Users\\Public folder",
2245
+ customer: {
2246
+ customer_id: 44,
2247
+ customer_sla: null,
2248
+ customer_name: "test_praeco",
2249
+ customer_description: null,
2250
+ creation_date: "2024-01-11T01:46:06.947860",
2251
+ custom_attributes: {},
2252
+ last_update_date: "2024-01-11T01:46:06.947860",
2253
+ client_uuid: "d6d42317-f29d-4637-bfdf-31816e08d587"
2254
+ },
2255
+ alert_id: 12115,
2256
+ resolution_status: null
2257
+ },
2258
+ {
2259
+ alert_owner_id: 1,
2260
+ alert_uuid: "93259fe1-3a76-4f3d-b17c-3a24890dd2cc",
2261
+ alert_creation_time: "2024-01-13T18:03:19.765986",
2262
+ comments: [],
2263
+ assets: [
2264
+ {
2265
+ asset_name: "ANSYDWDC01",
2266
+ asset_description: "Microsoft Windows Server 2016 Standard",
2267
+ asset_type: {
2268
+ asset_id: 9,
2269
+ asset_icon_compromised: "ioc_windows_desktop.png",
2270
+ asset_name: "Windows - Computer",
2271
+ asset_icon_not_compromised: "windows_desktop.png",
2272
+ asset_description: "Standard Windows Computer"
2273
+ },
2274
+ custom_attributes: null,
2275
+ asset_tags: "agent_id:102",
2276
+ asset_compromise_status_id: null,
2277
+ date_update: null,
2278
+ asset_enrichment: null,
2279
+ case_id: null,
2280
+ user_id: null,
2281
+ asset_type_id: 9,
2282
+ asset_id: 12528,
2283
+ asset_ip: "139.180.134.102",
2284
+ asset_domain: null,
2285
+ asset_uuid: "9e548857-d8a4-485b-a5dc-19c88960adb8",
2286
+ analysis_status_id: null,
2287
+ asset_info: null,
2288
+ date_added: null
2289
+ }
2290
+ ],
2291
+ alert_classification_id: null,
2292
+ alert_status_id: 3,
2293
+ alert_severity_id: 5,
2294
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
2295
+ alert_source_content: {
2296
+ index: "wazuh_00002_268",
2297
+ id: "1705000849.1377555541",
2298
+ agent_name: "ANSYDWDC01",
2299
+ agent_ip: "139.180.134.102",
2300
+ agent_id: "102",
2301
+ agent_labels_customer: "00002",
2302
+ rule_id: "92207",
2303
+ rule_level: 12,
2304
+ rule_description: "Executable file dropped in Users\\Public folder",
2305
+ timestamp: "2024-01-11 19:20:52.106",
2306
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
2307
+ time_field: "2024-01-11T19:20:48.181Z",
2308
+ asset_type_id: 9,
2309
+ gl2_source_input: "6459151dea00fd5d3da2df91",
2310
+ data_win_system_level: "4",
2311
+ data_win_system_processID: "2144",
2312
+ rule_mitre_technique: "Ingress Tool Transfer",
2313
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
2314
+ rule_group1: "sysmon",
2315
+ rule_mail: true,
2316
+ decoder_name: "windows_eventchannel",
2317
+ syslog_level: "ALERT",
2318
+ data_win_system_threadID: "3140",
2319
+ data_win_system_eventRecordID: "18951669",
2320
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
2321
+ data_win_eventdata_processId: "3608",
2322
+ streams: [
2323
+ "658d6cec5e9a2d550c8354c1",
2324
+ "659f47da5e9a2d550cac9a40",
2325
+ "659f485b5e9a2d550cac9b85",
2326
+ "645a3a6123e5cc30bbc0e5dc",
2327
+ "658d6d435e9a2d550c83558a"
2328
+ ],
2329
+ gl2_remote_ip: "10.255.255.13",
2330
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
2331
+ agent_ip_geolocation: "1.3078,103.6818",
2332
+ message:
2333
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
2334
+ true: 1705000849.314127,
2335
+ rule_firedtimes: 1,
2336
+ data_win_eventdata_image:
2337
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
2338
+ source_reserved_ip: true,
2339
+ agent_ip_city_name: "Singapore",
2340
+ num_hits: 1,
2341
+ manager_name: "ASHWZHMA",
2342
+ agent_ip_country_code: "SG",
2343
+ syslog_type: "wazuh",
2344
+ data_win_system_eventID: "11",
2345
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
2346
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
2347
+ gl2_accounted_message_size: 4116,
2348
+ data_win_system_message:
2349
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
2350
+ process_id: "3608",
2351
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
2352
+ rule_group3: "windows",
2353
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
2354
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
2355
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
2356
+ num_matches: 1,
2357
+ source: "10.255.255.13",
2358
+ data_win_system_keywords: "0x8000000000000000",
2359
+ gl2_processing_error:
2360
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
2361
+ data_win_system_task: "11",
2362
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
2363
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
2364
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
2365
+ rule_mitre_id: "T1105",
2366
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
2367
+ rule_group2: "sysmon_eid11_detections",
2368
+ rule_mitre_tactic: "Command and Control",
2369
+ location: "EventChannel",
2370
+ gl2_remote_port: 58986,
2371
+ data_win_eventdata_user: "NT AUTHORITY\\\\SYSTEM",
2372
+ data_win_system_opcode: "0",
2373
+ data_win_system_severityValue: "INFORMATION",
2374
+ data_win_system_version: "2"
2375
+ },
2376
+ alert_title: "Executable file dropped in Users\\Public folder",
2377
+ alert_customer_id: 44,
2378
+ alert_resolution_status_id: null,
2379
+ alert_context: {
2380
+ customer_iris_id: 44,
2381
+ customer_name: "test_praeco",
2382
+ customer_cases_index: "dfir_iris_test_praeco",
2383
+ alert_id: "1705000849.1377555541",
2384
+ alert_name: "Executable file dropped in Users\\Public folder",
2385
+ alert_level: 12,
2386
+ rule_id: "92207",
2387
+ asset_name: "ANSYDWDC01",
2388
+ asset_ip: "139.180.134.102",
2389
+ asset_type: 9,
2390
+ process_id: "3608",
2391
+ rule_mitre_id: "T1105",
2392
+ rule_mitre_tactic: "Command and Control",
2393
+ rule_mitre_technique: "Ingress Tool Transfer"
2394
+ },
2395
+ owner: {
2396
+ user_login: "administrator",
2397
+ user_email: "administrator@localhost",
2398
+ user_name: "administrator",
2399
+ id: 1
2400
+ },
2401
+ alert_source_ref: null,
2402
+ alert_tags: null,
2403
+ classification: null,
2404
+ severity: {
2405
+ severity_name: "High",
2406
+ severity_description: "High",
2407
+ severity_id: 5
2408
+ },
2409
+ alert_source_link:
2410
+ "test.com/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22process_id:%5C%223608%5C%22%20AND%20agent_name:%5C%22ANSYDWDC01%5C%22%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D",
2411
+ iocs: [],
2412
+ alert_note: null,
2413
+ alert_source: "SOCFORTRESS RULE",
2414
+ modification_history: {
2415
+ "1705168999.77058": {
2416
+ user: "administrator",
2417
+ user_id: 1,
2418
+ action: "Alert created"
2419
+ },
2420
+ "1705168999.817484": {
2421
+ user: "administrator",
2422
+ user_id: 1,
2423
+ action: "updated alert: \"assets\" from \"[]\" to \"[{'asset_name': 'ANSYDWDC01', 'asset_ip': '139.180.134.102', 'asset_description': 'Microsoft Windows Server 2016 Standard', 'asset_type_id': 9, 'asset_tags': 'agent_id:102'}]\""
2424
+ }
2425
+ },
2426
+ status: {
2427
+ status_description: "Alert is assigned to a user and pending investigation",
2428
+ status_id: 3,
2429
+ status_name: "Assigned"
2430
+ },
2431
+ cases: [],
2432
+ alert_description: "Executable file dropped in Users\\Public folder",
2433
+ customer: {
2434
+ customer_id: 44,
2435
+ customer_sla: null,
2436
+ customer_name: "test_praeco",
2437
+ customer_description: null,
2438
+ creation_date: "2024-01-11T01:46:06.947860",
2439
+ custom_attributes: {},
2440
+ last_update_date: "2024-01-11T01:46:06.947860",
2441
+ client_uuid: "d6d42317-f29d-4637-bfdf-31816e08d587"
2442
+ },
2443
+ alert_id: 12123,
2444
+ resolution_status: null
2445
+ },
2446
+ {
2447
+ alert_owner_id: 1,
2448
+ alert_uuid: "2d17e26d-9955-416e-9d46-836c171380b5",
2449
+ alert_creation_time: "2024-01-13T17:37:19.766480",
2450
+ comments: [],
2451
+ assets: [
2452
+ {
2453
+ asset_name: "ANSYDWDC01",
2454
+ asset_description: "Microsoft Windows Server 2016 Standard",
2455
+ asset_type: {
2456
+ asset_id: 9,
2457
+ asset_icon_compromised: "ioc_windows_desktop.png",
2458
+ asset_name: "Windows - Computer",
2459
+ asset_icon_not_compromised: "windows_desktop.png",
2460
+ asset_description: "Standard Windows Computer"
2461
+ },
2462
+ custom_attributes: null,
2463
+ asset_tags: "agent_id:102",
2464
+ asset_compromise_status_id: null,
2465
+ date_update: null,
2466
+ asset_enrichment: null,
2467
+ case_id: null,
2468
+ user_id: null,
2469
+ asset_type_id: 9,
2470
+ asset_id: 12424,
2471
+ asset_ip: "139.180.134.102",
2472
+ asset_domain: null,
2473
+ asset_uuid: "450ccdb0-296f-48a8-9239-90c636ddfb97",
2474
+ analysis_status_id: null,
2475
+ asset_info: null,
2476
+ date_added: null
2477
+ }
2478
+ ],
2479
+ alert_classification_id: null,
2480
+ alert_status_id: 3,
2481
+ alert_severity_id: 5,
2482
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
2483
+ alert_source_content: {
2484
+ index: "wazuh_00002_268",
2485
+ id: "1705000849.1377555541",
2486
+ agent_name: "ANSYDWDC01",
2487
+ agent_ip: "139.180.134.102",
2488
+ agent_id: "102",
2489
+ agent_labels_customer: "00002",
2490
+ rule_id: "92207",
2491
+ rule_level: 12,
2492
+ rule_description: "Executable file dropped in Users\\Public folder",
2493
+ timestamp: "2024-01-11 19:20:52.106",
2494
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
2495
+ time_field: "2024-01-11T19:20:48.181Z",
2496
+ asset_type_id: 9,
2497
+ gl2_source_input: "6459151dea00fd5d3da2df91",
2498
+ data_win_system_level: "4",
2499
+ data_win_system_processID: "2144",
2500
+ rule_mitre_technique: "Ingress Tool Transfer",
2501
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
2502
+ rule_group1: "sysmon",
2503
+ rule_mail: true,
2504
+ decoder_name: "windows_eventchannel",
2505
+ syslog_level: "ALERT",
2506
+ data_win_system_threadID: "3140",
2507
+ data_win_system_eventRecordID: "18951669",
2508
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
2509
+ data_win_eventdata_processId: "3608",
2510
+ streams: [
2511
+ "658d6cec5e9a2d550c8354c1",
2512
+ "659f47da5e9a2d550cac9a40",
2513
+ "659f485b5e9a2d550cac9b85",
2514
+ "645a3a6123e5cc30bbc0e5dc",
2515
+ "658d6d435e9a2d550c83558a"
2516
+ ],
2517
+ gl2_remote_ip: "10.255.255.13",
2518
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
2519
+ agent_ip_geolocation: "1.3078,103.6818",
2520
+ message:
2521
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
2522
+ true: 1705000849.314127,
2523
+ rule_firedtimes: 1,
2524
+ data_win_eventdata_image:
2525
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
2526
+ source_reserved_ip: true,
2527
+ agent_ip_city_name: "Singapore",
2528
+ num_hits: 1,
2529
+ manager_name: "ASHWZHMA",
2530
+ agent_ip_country_code: "SG",
2531
+ syslog_type: "wazuh",
2532
+ data_win_system_eventID: "11",
2533
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
2534
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
2535
+ gl2_accounted_message_size: 4116,
2536
+ data_win_system_message:
2537
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
2538
+ process_id: "3608",
2539
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
2540
+ rule_group3: "windows",
2541
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
2542
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
2543
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
2544
+ num_matches: 1,
2545
+ source: "10.255.255.13",
2546
+ data_win_system_keywords: "0x8000000000000000",
2547
+ gl2_processing_error:
2548
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
2549
+ data_win_system_task: "11",
2550
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
2551
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
2552
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
2553
+ rule_mitre_id: "T1105",
2554
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
2555
+ rule_group2: "sysmon_eid11_detections",
2556
+ rule_mitre_tactic: "Command and Control",
2557
+ location: "EventChannel",
2558
+ gl2_remote_port: 58986,
2559
+ data_win_eventdata_user: "NT AUTHORITY\\\\SYSTEM",
2560
+ data_win_system_opcode: "0",
2561
+ data_win_system_severityValue: "INFORMATION",
2562
+ data_win_system_version: "2"
2563
+ },
2564
+ alert_title: "Executable file dropped in Users\\Public folder",
2565
+ alert_customer_id: 44,
2566
+ alert_resolution_status_id: null,
2567
+ alert_context: {
2568
+ customer_iris_id: 44,
2569
+ customer_name: "test_praeco",
2570
+ customer_cases_index: "dfir_iris_test_praeco",
2571
+ alert_id: "1705000849.1377555541",
2572
+ alert_name: "Executable file dropped in Users\\Public folder",
2573
+ alert_level: 12,
2574
+ rule_id: "92207",
2575
+ asset_name: "ANSYDWDC01",
2576
+ asset_ip: "139.180.134.102",
2577
+ asset_type: 9,
2578
+ process_id: "3608",
2579
+ rule_mitre_id: "T1105",
2580
+ rule_mitre_tactic: "Command and Control",
2581
+ rule_mitre_technique: "Ingress Tool Transfer"
2582
+ },
2583
+ owner: {
2584
+ user_login: "administrator",
2585
+ user_email: "administrator@localhost",
2586
+ user_name: "administrator",
2587
+ id: 1
2588
+ },
2589
+ alert_source_ref: null,
2590
+ alert_tags: null,
2591
+ classification: null,
2592
+ severity: {
2593
+ severity_name: "High",
2594
+ severity_description: "High",
2595
+ severity_id: 5
2596
+ },
2597
+ alert_source_link:
2598
+ "test.com/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22process_id:%5C%223608%5C%22%20AND%20agent_name:%5C%22ANSYDWDC01%5C%22%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D",
2599
+ iocs: [],
2600
+ alert_note: null,
2601
+ alert_source: "SOCFORTRESS RULE",
2602
+ modification_history: {
2603
+ "1705167439.771146": {
2604
+ user: "administrator",
2605
+ user_id: 1,
2606
+ action: "Alert created"
2607
+ },
2608
+ "1705167439.81702": {
2609
+ user: "administrator",
2610
+ user_id: 1,
2611
+ action: "updated alert: \"assets\" from \"[]\" to \"[{'asset_name': 'ANSYDWDC01', 'asset_ip': '139.180.134.102', 'asset_description': 'Microsoft Windows Server 2016 Standard', 'asset_type_id': 9, 'asset_tags': 'agent_id:102'}]\""
2612
+ }
2613
+ },
2614
+ status: {
2615
+ status_description: "Alert is assigned to a user and pending investigation",
2616
+ status_id: 3,
2617
+ status_name: "Assigned"
2618
+ },
2619
+ cases: [],
2620
+ alert_description: "Executable file dropped in Users\\Public folder",
2621
+ customer: {
2622
+ customer_id: 44,
2623
+ customer_sla: null,
2624
+ customer_name: "test_praeco",
2625
+ customer_description: null,
2626
+ creation_date: "2024-01-11T01:46:06.947860",
2627
+ custom_attributes: {},
2628
+ last_update_date: "2024-01-11T01:46:06.947860",
2629
+ client_uuid: "d6d42317-f29d-4637-bfdf-31816e08d587"
2630
+ },
2631
+ alert_id: 12019,
2632
+ resolution_status: null
2633
+ },
2634
+ {
2635
+ alert_owner_id: 1,
2636
+ alert_uuid: "7dfe536f-a087-4b32-92fd-711fd818b4a2",
2637
+ alert_creation_time: "2024-01-13T17:38:19.757247",
2638
+ comments: [],
2639
+ assets: [
2640
+ {
2641
+ asset_name: "ANSYDWDC01",
2642
+ asset_description: "Microsoft Windows Server 2016 Standard",
2643
+ asset_type: {
2644
+ asset_id: 9,
2645
+ asset_icon_compromised: "ioc_windows_desktop.png",
2646
+ asset_name: "Windows - Computer",
2647
+ asset_icon_not_compromised: "windows_desktop.png",
2648
+ asset_description: "Standard Windows Computer"
2649
+ },
2650
+ custom_attributes: null,
2651
+ asset_tags: "agent_id:102",
2652
+ asset_compromise_status_id: null,
2653
+ date_update: null,
2654
+ asset_enrichment: null,
2655
+ case_id: null,
2656
+ user_id: null,
2657
+ asset_type_id: 9,
2658
+ asset_id: 12428,
2659
+ asset_ip: "139.180.134.102",
2660
+ asset_domain: null,
2661
+ asset_uuid: "88291546-ba06-4792-8edf-5bbb67661cab",
2662
+ analysis_status_id: null,
2663
+ asset_info: null,
2664
+ date_added: null
2665
+ }
2666
+ ],
2667
+ alert_classification_id: null,
2668
+ alert_status_id: 3,
2669
+ alert_severity_id: 5,
2670
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
2671
+ alert_source_content: {
2672
+ index: "wazuh_00002_268",
2673
+ id: "1705000849.1377555541",
2674
+ agent_name: "ANSYDWDC01",
2675
+ agent_ip: "139.180.134.102",
2676
+ agent_id: "102",
2677
+ agent_labels_customer: "00002",
2678
+ rule_id: "92207",
2679
+ rule_level: 12,
2680
+ rule_description: "Executable file dropped in Users\\Public folder",
2681
+ timestamp: "2024-01-11 19:20:52.106",
2682
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
2683
+ time_field: "2024-01-11T19:20:48.181Z",
2684
+ asset_type_id: 9,
2685
+ gl2_source_input: "6459151dea00fd5d3da2df91",
2686
+ data_win_system_level: "4",
2687
+ data_win_system_processID: "2144",
2688
+ rule_mitre_technique: "Ingress Tool Transfer",
2689
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
2690
+ rule_group1: "sysmon",
2691
+ rule_mail: true,
2692
+ decoder_name: "windows_eventchannel",
2693
+ syslog_level: "ALERT",
2694
+ data_win_system_threadID: "3140",
2695
+ data_win_system_eventRecordID: "18951669",
2696
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
2697
+ data_win_eventdata_processId: "3608",
2698
+ streams: [
2699
+ "658d6cec5e9a2d550c8354c1",
2700
+ "659f47da5e9a2d550cac9a40",
2701
+ "659f485b5e9a2d550cac9b85",
2702
+ "645a3a6123e5cc30bbc0e5dc",
2703
+ "658d6d435e9a2d550c83558a"
2704
+ ],
2705
+ gl2_remote_ip: "10.255.255.13",
2706
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
2707
+ agent_ip_geolocation: "1.3078,103.6818",
2708
+ message:
2709
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
2710
+ true: 1705000849.314127,
2711
+ rule_firedtimes: 1,
2712
+ data_win_eventdata_image:
2713
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
2714
+ source_reserved_ip: true,
2715
+ agent_ip_city_name: "Singapore",
2716
+ num_hits: 1,
2717
+ manager_name: "ASHWZHMA",
2718
+ agent_ip_country_code: "SG",
2719
+ syslog_type: "wazuh",
2720
+ data_win_system_eventID: "11",
2721
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
2722
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
2723
+ gl2_accounted_message_size: 4116,
2724
+ data_win_system_message:
2725
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
2726
+ process_id: "3608",
2727
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
2728
+ rule_group3: "windows",
2729
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
2730
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
2731
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
2732
+ num_matches: 1,
2733
+ source: "10.255.255.13",
2734
+ data_win_system_keywords: "0x8000000000000000",
2735
+ gl2_processing_error:
2736
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
2737
+ data_win_system_task: "11",
2738
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
2739
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
2740
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
2741
+ rule_mitre_id: "T1105",
2742
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
2743
+ rule_group2: "sysmon_eid11_detections",
2744
+ rule_mitre_tactic: "Command and Control",
2745
+ location: "EventChannel",
2746
+ gl2_remote_port: 58986,
2747
+ data_win_eventdata_user: "NT AUTHORITY\\\\SYSTEM",
2748
+ data_win_system_opcode: "0",
2749
+ data_win_system_severityValue: "INFORMATION",
2750
+ data_win_system_version: "2"
2751
+ },
2752
+ alert_title: "Executable file dropped in Users\\Public folder",
2753
+ alert_customer_id: 44,
2754
+ alert_resolution_status_id: null,
2755
+ alert_context: {
2756
+ customer_iris_id: 44,
2757
+ customer_name: "test_praeco",
2758
+ customer_cases_index: "dfir_iris_test_praeco",
2759
+ alert_id: "1705000849.1377555541",
2760
+ alert_name: "Executable file dropped in Users\\Public folder",
2761
+ alert_level: 12,
2762
+ rule_id: "92207",
2763
+ asset_name: "ANSYDWDC01",
2764
+ asset_ip: "139.180.134.102",
2765
+ asset_type: 9,
2766
+ process_id: "3608",
2767
+ rule_mitre_id: "T1105",
2768
+ rule_mitre_tactic: "Command and Control",
2769
+ rule_mitre_technique: "Ingress Tool Transfer"
2770
+ },
2771
+ owner: {
2772
+ user_login: "administrator",
2773
+ user_email: "administrator@localhost",
2774
+ user_name: "administrator",
2775
+ id: 1
2776
+ },
2777
+ alert_source_ref: null,
2778
+ alert_tags: null,
2779
+ classification: null,
2780
+ severity: {
2781
+ severity_name: "High",
2782
+ severity_description: "High",
2783
+ severity_id: 5
2784
+ },
2785
+ alert_source_link:
2786
+ "test.com/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22process_id:%5C%223608%5C%22%20AND%20agent_name:%5C%22ANSYDWDC01%5C%22%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D",
2787
+ iocs: [],
2788
+ alert_note: null,
2789
+ alert_source: "SOCFORTRESS RULE",
2790
+ modification_history: {
2791
+ "1705167499.763375": {
2792
+ user: "administrator",
2793
+ user_id: 1,
2794
+ action: "Alert created"
2795
+ },
2796
+ "1705167499.822182": {
2797
+ user: "administrator",
2798
+ user_id: 1,
2799
+ action: "updated alert: \"assets\" from \"[]\" to \"[{'asset_name': 'ANSYDWDC01', 'asset_ip': '139.180.134.102', 'asset_description': 'Microsoft Windows Server 2016 Standard', 'asset_type_id': 9, 'asset_tags': 'agent_id:102'}]\""
2800
+ }
2801
+ },
2802
+ status: {
2803
+ status_description: "Alert is assigned to a user and pending investigation",
2804
+ status_id: 3,
2805
+ status_name: "Assigned"
2806
+ },
2807
+ cases: [],
2808
+ alert_description: "Executable file dropped in Users\\Public folder",
2809
+ customer: {
2810
+ customer_id: 44,
2811
+ customer_sla: null,
2812
+ customer_name: "test_praeco",
2813
+ customer_description: null,
2814
+ creation_date: "2024-01-11T01:46:06.947860",
2815
+ custom_attributes: {},
2816
+ last_update_date: "2024-01-11T01:46:06.947860",
2817
+ client_uuid: "d6d42317-f29d-4637-bfdf-31816e08d587"
2818
+ },
2819
+ alert_id: 12023,
2820
+ resolution_status: null
2821
+ },
2822
+ {
2823
+ alert_owner_id: 1,
2824
+ alert_uuid: "e93b8c9c-83fc-4762-bdbe-6f4b8ff2b895",
2825
+ alert_creation_time: "2024-01-13T17:41:19.768405",
2826
+ comments: [],
2827
+ assets: [
2828
+ {
2829
+ asset_name: "ANSYDWDC01",
2830
+ asset_description: "Microsoft Windows Server 2016 Standard",
2831
+ asset_type: {
2832
+ asset_id: 9,
2833
+ asset_icon_compromised: "ioc_windows_desktop.png",
2834
+ asset_name: "Windows - Computer",
2835
+ asset_icon_not_compromised: "windows_desktop.png",
2836
+ asset_description: "Standard Windows Computer"
2837
+ },
2838
+ custom_attributes: null,
2839
+ asset_tags: "agent_id:102",
2840
+ asset_compromise_status_id: null,
2841
+ date_update: null,
2842
+ asset_enrichment: null,
2843
+ case_id: null,
2844
+ user_id: null,
2845
+ asset_type_id: 9,
2846
+ asset_id: 12440,
2847
+ asset_ip: "139.180.134.102",
2848
+ asset_domain: null,
2849
+ asset_uuid: "90044871-e1aa-46a6-884d-fdfc35dcfd9d",
2850
+ analysis_status_id: null,
2851
+ asset_info: null,
2852
+ date_added: null
2853
+ }
2854
+ ],
2855
+ alert_classification_id: null,
2856
+ alert_status_id: 3,
2857
+ alert_severity_id: 5,
2858
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
2859
+ alert_source_content: {
2860
+ index: "wazuh_00002_268",
2861
+ id: "1705000849.1377555541",
2862
+ agent_name: "ANSYDWDC01",
2863
+ agent_ip: "139.180.134.102",
2864
+ agent_id: "102",
2865
+ agent_labels_customer: "00002",
2866
+ rule_id: "92207",
2867
+ rule_level: 12,
2868
+ rule_description: "Executable file dropped in Users\\Public folder",
2869
+ timestamp: "2024-01-11 19:20:52.106",
2870
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
2871
+ time_field: "2024-01-11T19:20:48.181Z",
2872
+ asset_type_id: 9,
2873
+ gl2_source_input: "6459151dea00fd5d3da2df91",
2874
+ data_win_system_level: "4",
2875
+ data_win_system_processID: "2144",
2876
+ rule_mitre_technique: "Ingress Tool Transfer",
2877
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
2878
+ rule_group1: "sysmon",
2879
+ rule_mail: true,
2880
+ decoder_name: "windows_eventchannel",
2881
+ syslog_level: "ALERT",
2882
+ data_win_system_threadID: "3140",
2883
+ data_win_system_eventRecordID: "18951669",
2884
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
2885
+ data_win_eventdata_processId: "3608",
2886
+ streams: [
2887
+ "658d6cec5e9a2d550c8354c1",
2888
+ "659f47da5e9a2d550cac9a40",
2889
+ "659f485b5e9a2d550cac9b85",
2890
+ "645a3a6123e5cc30bbc0e5dc",
2891
+ "658d6d435e9a2d550c83558a"
2892
+ ],
2893
+ gl2_remote_ip: "10.255.255.13",
2894
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
2895
+ agent_ip_geolocation: "1.3078,103.6818",
2896
+ message:
2897
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
2898
+ true: 1705000849.314127,
2899
+ rule_firedtimes: 1,
2900
+ data_win_eventdata_image:
2901
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
2902
+ source_reserved_ip: true,
2903
+ agent_ip_city_name: "Singapore",
2904
+ num_hits: 1,
2905
+ manager_name: "ASHWZHMA",
2906
+ agent_ip_country_code: "SG",
2907
+ syslog_type: "wazuh",
2908
+ data_win_system_eventID: "11",
2909
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
2910
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
2911
+ gl2_accounted_message_size: 4116,
2912
+ data_win_system_message:
2913
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
2914
+ process_id: "3608",
2915
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
2916
+ rule_group3: "windows",
2917
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
2918
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
2919
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
2920
+ num_matches: 1,
2921
+ source: "10.255.255.13",
2922
+ data_win_system_keywords: "0x8000000000000000",
2923
+ gl2_processing_error:
2924
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
2925
+ data_win_system_task: "11",
2926
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
2927
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
2928
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
2929
+ rule_mitre_id: "T1105",
2930
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
2931
+ rule_group2: "sysmon_eid11_detections",
2932
+ rule_mitre_tactic: "Command and Control",
2933
+ location: "EventChannel",
2934
+ gl2_remote_port: 58986,
2935
+ data_win_eventdata_user: "NT AUTHORITY\\\\SYSTEM",
2936
+ data_win_system_opcode: "0",
2937
+ data_win_system_severityValue: "INFORMATION",
2938
+ data_win_system_version: "2"
2939
+ },
2940
+ alert_title: "Executable file dropped in Users\\Public folder",
2941
+ alert_customer_id: 44,
2942
+ alert_resolution_status_id: null,
2943
+ alert_context: {
2944
+ customer_iris_id: 44,
2945
+ customer_name: "test_praeco",
2946
+ customer_cases_index: "dfir_iris_test_praeco",
2947
+ alert_id: "1705000849.1377555541",
2948
+ alert_name: "Executable file dropped in Users\\Public folder",
2949
+ alert_level: 12,
2950
+ rule_id: "92207",
2951
+ asset_name: "ANSYDWDC01",
2952
+ asset_ip: "139.180.134.102",
2953
+ asset_type: 9,
2954
+ process_id: "3608",
2955
+ rule_mitre_id: "T1105",
2956
+ rule_mitre_tactic: "Command and Control",
2957
+ rule_mitre_technique: "Ingress Tool Transfer"
2958
+ },
2959
+ owner: {
2960
+ user_login: "administrator",
2961
+ user_email: "administrator@localhost",
2962
+ user_name: "administrator",
2963
+ id: 1
2964
+ },
2965
+ alert_source_ref: null,
2966
+ alert_tags: null,
2967
+ classification: null,
2968
+ severity: {
2969
+ severity_name: "High",
2970
+ severity_description: "High",
2971
+ severity_id: 5
2972
+ },
2973
+ alert_source_link:
2974
+ "test.com/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22process_id:%5C%223608%5C%22%20AND%20agent_name:%5C%22ANSYDWDC01%5C%22%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D",
2975
+ iocs: [],
2976
+ alert_note: null,
2977
+ alert_source: "SOCFORTRESS RULE",
2978
+ modification_history: {
2979
+ "1705167679.773684": {
2980
+ user: "administrator",
2981
+ user_id: 1,
2982
+ action: "Alert created"
2983
+ },
2984
+ "1705167679.826435": {
2985
+ user: "administrator",
2986
+ user_id: 1,
2987
+ action: "updated alert: \"assets\" from \"[]\" to \"[{'asset_name': 'ANSYDWDC01', 'asset_ip': '139.180.134.102', 'asset_description': 'Microsoft Windows Server 2016 Standard', 'asset_type_id': 9, 'asset_tags': 'agent_id:102'}]\""
2988
+ }
2989
+ },
2990
+ status: {
2991
+ status_description: "Alert is assigned to a user and pending investigation",
2992
+ status_id: 3,
2993
+ status_name: "Assigned"
2994
+ },
2995
+ cases: [],
2996
+ alert_description: "Executable file dropped in Users\\Public folder",
2997
+ customer: {
2998
+ customer_id: 44,
2999
+ customer_sla: null,
3000
+ customer_name: "test_praeco",
3001
+ customer_description: null,
3002
+ creation_date: "2024-01-11T01:46:06.947860",
3003
+ custom_attributes: {},
3004
+ last_update_date: "2024-01-11T01:46:06.947860",
3005
+ client_uuid: "d6d42317-f29d-4637-bfdf-31816e08d587"
3006
+ },
3007
+ alert_id: 12035,
3008
+ resolution_status: null
3009
+ },
3010
+ {
3011
+ alert_owner_id: 1,
3012
+ alert_uuid: "8bc05faa-6747-4759-a957-a33724b99526",
3013
+ alert_creation_time: "2024-01-13T17:42:19.769863",
3014
+ comments: [],
3015
+ assets: [
3016
+ {
3017
+ asset_name: "ANSYDWDC01",
3018
+ asset_description: "Microsoft Windows Server 2016 Standard",
3019
+ asset_type: {
3020
+ asset_id: 9,
3021
+ asset_icon_compromised: "ioc_windows_desktop.png",
3022
+ asset_name: "Windows - Computer",
3023
+ asset_icon_not_compromised: "windows_desktop.png",
3024
+ asset_description: "Standard Windows Computer"
3025
+ },
3026
+ custom_attributes: null,
3027
+ asset_tags: "agent_id:102",
3028
+ asset_compromise_status_id: null,
3029
+ date_update: null,
3030
+ asset_enrichment: null,
3031
+ case_id: null,
3032
+ user_id: null,
3033
+ asset_type_id: 9,
3034
+ asset_id: 12444,
3035
+ asset_ip: "139.180.134.102",
3036
+ asset_domain: null,
3037
+ asset_uuid: "f555c2da-96c5-4ba9-bf07-4be93567c50d",
3038
+ analysis_status_id: null,
3039
+ asset_info: null,
3040
+ date_added: null
3041
+ }
3042
+ ],
3043
+ alert_classification_id: null,
3044
+ alert_status_id: 3,
3045
+ alert_severity_id: 5,
3046
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
3047
+ alert_source_content: {
3048
+ index: "wazuh_00002_268",
3049
+ id: "1705000849.1377555541",
3050
+ agent_name: "ANSYDWDC01",
3051
+ agent_ip: "139.180.134.102",
3052
+ agent_id: "102",
3053
+ agent_labels_customer: "00002",
3054
+ rule_id: "92207",
3055
+ rule_level: 12,
3056
+ rule_description: "Executable file dropped in Users\\Public folder",
3057
+ timestamp: "2024-01-11 19:20:52.106",
3058
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
3059
+ time_field: "2024-01-11T19:20:48.181Z",
3060
+ asset_type_id: 9,
3061
+ gl2_source_input: "6459151dea00fd5d3da2df91",
3062
+ data_win_system_level: "4",
3063
+ data_win_system_processID: "2144",
3064
+ rule_mitre_technique: "Ingress Tool Transfer",
3065
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
3066
+ rule_group1: "sysmon",
3067
+ rule_mail: true,
3068
+ decoder_name: "windows_eventchannel",
3069
+ syslog_level: "ALERT",
3070
+ data_win_system_threadID: "3140",
3071
+ data_win_system_eventRecordID: "18951669",
3072
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
3073
+ data_win_eventdata_processId: "3608",
3074
+ streams: [
3075
+ "658d6cec5e9a2d550c8354c1",
3076
+ "659f47da5e9a2d550cac9a40",
3077
+ "659f485b5e9a2d550cac9b85",
3078
+ "645a3a6123e5cc30bbc0e5dc",
3079
+ "658d6d435e9a2d550c83558a"
3080
+ ],
3081
+ gl2_remote_ip: "10.255.255.13",
3082
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
3083
+ agent_ip_geolocation: "1.3078,103.6818",
3084
+ message:
3085
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
3086
+ true: 1705000849.314127,
3087
+ rule_firedtimes: 1,
3088
+ data_win_eventdata_image:
3089
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
3090
+ source_reserved_ip: true,
3091
+ agent_ip_city_name: "Singapore",
3092
+ num_hits: 1,
3093
+ manager_name: "ASHWZHMA",
3094
+ agent_ip_country_code: "SG",
3095
+ syslog_type: "wazuh",
3096
+ data_win_system_eventID: "11",
3097
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
3098
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
3099
+ gl2_accounted_message_size: 4116,
3100
+ data_win_system_message:
3101
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
3102
+ process_id: "3608",
3103
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
3104
+ rule_group3: "windows",
3105
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
3106
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
3107
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
3108
+ num_matches: 1,
3109
+ source: "10.255.255.13",
3110
+ data_win_system_keywords: "0x8000000000000000",
3111
+ gl2_processing_error:
3112
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
3113
+ data_win_system_task: "11",
3114
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
3115
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
3116
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
3117
+ rule_mitre_id: "T1105",
3118
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
3119
+ rule_group2: "sysmon_eid11_detections",
3120
+ rule_mitre_tactic: "Command and Control",
3121
+ location: "EventChannel",
3122
+ gl2_remote_port: 58986,
3123
+ data_win_eventdata_user: "NT AUTHORITY\\\\SYSTEM",
3124
+ data_win_system_opcode: "0",
3125
+ data_win_system_severityValue: "INFORMATION",
3126
+ data_win_system_version: "2"
3127
+ },
3128
+ alert_title: "Executable file dropped in Users\\Public folder",
3129
+ alert_customer_id: 44,
3130
+ alert_resolution_status_id: null,
3131
+ alert_context: {
3132
+ customer_iris_id: 44,
3133
+ customer_name: "test_praeco",
3134
+ customer_cases_index: "dfir_iris_test_praeco",
3135
+ alert_id: "1705000849.1377555541",
3136
+ alert_name: "Executable file dropped in Users\\Public folder",
3137
+ alert_level: 12,
3138
+ rule_id: "92207",
3139
+ asset_name: "ANSYDWDC01",
3140
+ asset_ip: "139.180.134.102",
3141
+ asset_type: 9,
3142
+ process_id: "3608",
3143
+ rule_mitre_id: "T1105",
3144
+ rule_mitre_tactic: "Command and Control",
3145
+ rule_mitre_technique: "Ingress Tool Transfer"
3146
+ },
3147
+ owner: {
3148
+ user_login: "administrator",
3149
+ user_email: "administrator@localhost",
3150
+ user_name: "administrator",
3151
+ id: 1
3152
+ },
3153
+ alert_source_ref: null,
3154
+ alert_tags: null,
3155
+ classification: null,
3156
+ severity: {
3157
+ severity_name: "High",
3158
+ severity_description: "High",
3159
+ severity_id: 5
3160
+ },
3161
+ alert_source_link:
3162
+ "test.com/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22process_id:%5C%223608%5C%22%20AND%20agent_name:%5C%22ANSYDWDC01%5C%22%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D",
3163
+ iocs: [],
3164
+ alert_note: null,
3165
+ alert_source: "SOCFORTRESS RULE",
3166
+ modification_history: {
3167
+ "1705167739.775084": {
3168
+ user: "administrator",
3169
+ user_id: 1,
3170
+ action: "Alert created"
3171
+ },
3172
+ "1705167739.822561": {
3173
+ user: "administrator",
3174
+ user_id: 1,
3175
+ action: "updated alert: \"assets\" from \"[]\" to \"[{'asset_name': 'ANSYDWDC01', 'asset_ip': '139.180.134.102', 'asset_description': 'Microsoft Windows Server 2016 Standard', 'asset_type_id': 9, 'asset_tags': 'agent_id:102'}]\""
3176
+ }
3177
+ },
3178
+ status: {
3179
+ status_description: "Alert is assigned to a user and pending investigation",
3180
+ status_id: 3,
3181
+ status_name: "Assigned"
3182
+ },
3183
+ cases: [],
3184
+ alert_description: "Executable file dropped in Users\\Public folder",
3185
+ customer: {
3186
+ customer_id: 44,
3187
+ customer_sla: null,
3188
+ customer_name: "test_praeco",
3189
+ customer_description: null,
3190
+ creation_date: "2024-01-11T01:46:06.947860",
3191
+ custom_attributes: {},
3192
+ last_update_date: "2024-01-11T01:46:06.947860",
3193
+ client_uuid: "d6d42317-f29d-4637-bfdf-31816e08d587"
3194
+ },
3195
+ alert_id: 12039,
3196
+ resolution_status: null
3197
+ },
3198
+ {
3199
+ alert_owner_id: 1,
3200
+ alert_uuid: "bb077ce5-3d38-4690-b262-f9a5aa5474d2",
3201
+ alert_creation_time: "2024-01-13T17:45:19.764319",
3202
+ comments: [],
3203
+ assets: [
3204
+ {
3205
+ asset_name: "ANSYDWDC01",
3206
+ asset_description: "Microsoft Windows Server 2016 Standard",
3207
+ asset_type: {
3208
+ asset_id: 9,
3209
+ asset_icon_compromised: "ioc_windows_desktop.png",
3210
+ asset_name: "Windows - Computer",
3211
+ asset_icon_not_compromised: "windows_desktop.png",
3212
+ asset_description: "Standard Windows Computer"
3213
+ },
3214
+ custom_attributes: null,
3215
+ asset_tags: "agent_id:102",
3216
+ asset_compromise_status_id: null,
3217
+ date_update: null,
3218
+ asset_enrichment: null,
3219
+ case_id: null,
3220
+ user_id: null,
3221
+ asset_type_id: 9,
3222
+ asset_id: 12456,
3223
+ asset_ip: "139.180.134.102",
3224
+ asset_domain: null,
3225
+ asset_uuid: "f1a2d727-9e4c-44ca-9642-7fed6bbbbe16",
3226
+ analysis_status_id: null,
3227
+ asset_info: null,
3228
+ date_added: null
3229
+ }
3230
+ ],
3231
+ alert_classification_id: null,
3232
+ alert_status_id: 3,
3233
+ alert_severity_id: 5,
3234
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
3235
+ alert_source_content: {
3236
+ index: "wazuh_00002_268",
3237
+ id: "1705000849.1377555541",
3238
+ agent_name: "ANSYDWDC01",
3239
+ agent_ip: "139.180.134.102",
3240
+ agent_id: "102",
3241
+ agent_labels_customer: "00002",
3242
+ rule_id: "92207",
3243
+ rule_level: 12,
3244
+ rule_description: "Executable file dropped in Users\\Public folder",
3245
+ timestamp: "2024-01-11 19:20:52.106",
3246
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
3247
+ time_field: "2024-01-11T19:20:48.181Z",
3248
+ asset_type_id: 9,
3249
+ gl2_source_input: "6459151dea00fd5d3da2df91",
3250
+ data_win_system_level: "4",
3251
+ data_win_system_processID: "2144",
3252
+ rule_mitre_technique: "Ingress Tool Transfer",
3253
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
3254
+ rule_group1: "sysmon",
3255
+ rule_mail: true,
3256
+ decoder_name: "windows_eventchannel",
3257
+ syslog_level: "ALERT",
3258
+ data_win_system_threadID: "3140",
3259
+ data_win_system_eventRecordID: "18951669",
3260
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
3261
+ data_win_eventdata_processId: "3608",
3262
+ streams: [
3263
+ "658d6cec5e9a2d550c8354c1",
3264
+ "659f47da5e9a2d550cac9a40",
3265
+ "659f485b5e9a2d550cac9b85",
3266
+ "645a3a6123e5cc30bbc0e5dc",
3267
+ "658d6d435e9a2d550c83558a"
3268
+ ],
3269
+ gl2_remote_ip: "10.255.255.13",
3270
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
3271
+ agent_ip_geolocation: "1.3078,103.6818",
3272
+ message:
3273
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
3274
+ true: 1705000849.314127,
3275
+ rule_firedtimes: 1,
3276
+ data_win_eventdata_image:
3277
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
3278
+ source_reserved_ip: true,
3279
+ agent_ip_city_name: "Singapore",
3280
+ num_hits: 1,
3281
+ manager_name: "ASHWZHMA",
3282
+ agent_ip_country_code: "SG",
3283
+ syslog_type: "wazuh",
3284
+ data_win_system_eventID: "11",
3285
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
3286
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
3287
+ gl2_accounted_message_size: 4116,
3288
+ data_win_system_message:
3289
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
3290
+ process_id: "3608",
3291
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
3292
+ rule_group3: "windows",
3293
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
3294
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
3295
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
3296
+ num_matches: 1,
3297
+ source: "10.255.255.13",
3298
+ data_win_system_keywords: "0x8000000000000000",
3299
+ gl2_processing_error:
3300
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
3301
+ data_win_system_task: "11",
3302
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
3303
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
3304
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
3305
+ rule_mitre_id: "T1105",
3306
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
3307
+ rule_group2: "sysmon_eid11_detections",
3308
+ rule_mitre_tactic: "Command and Control",
3309
+ location: "EventChannel",
3310
+ gl2_remote_port: 58986,
3311
+ data_win_eventdata_user: "NT AUTHORITY\\\\SYSTEM",
3312
+ data_win_system_opcode: "0",
3313
+ data_win_system_severityValue: "INFORMATION",
3314
+ data_win_system_version: "2"
3315
+ },
3316
+ alert_title: "Executable file dropped in Users\\Public folder",
3317
+ alert_customer_id: 44,
3318
+ alert_resolution_status_id: null,
3319
+ alert_context: {
3320
+ customer_iris_id: 44,
3321
+ customer_name: "test_praeco",
3322
+ customer_cases_index: "dfir_iris_test_praeco",
3323
+ alert_id: "1705000849.1377555541",
3324
+ alert_name: "Executable file dropped in Users\\Public folder",
3325
+ alert_level: 12,
3326
+ rule_id: "92207",
3327
+ asset_name: "ANSYDWDC01",
3328
+ asset_ip: "139.180.134.102",
3329
+ asset_type: 9,
3330
+ process_id: "3608",
3331
+ rule_mitre_id: "T1105",
3332
+ rule_mitre_tactic: "Command and Control",
3333
+ rule_mitre_technique: "Ingress Tool Transfer"
3334
+ },
3335
+ owner: {
3336
+ user_login: "administrator",
3337
+ user_email: "administrator@localhost",
3338
+ user_name: "administrator",
3339
+ id: 1
3340
+ },
3341
+ alert_source_ref: null,
3342
+ alert_tags: null,
3343
+ classification: null,
3344
+ severity: {
3345
+ severity_name: "High",
3346
+ severity_description: "High",
3347
+ severity_id: 5
3348
+ },
3349
+ alert_source_link:
3350
+ "test.com/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22process_id:%5C%223608%5C%22%20AND%20agent_name:%5C%22ANSYDWDC01%5C%22%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D",
3351
+ iocs: [],
3352
+ alert_note: null,
3353
+ alert_source: "SOCFORTRESS RULE",
3354
+ modification_history: {
3355
+ "1705167919.768401": {
3356
+ user: "administrator",
3357
+ user_id: 1,
3358
+ action: "Alert created"
3359
+ },
3360
+ "1705167919.813058": {
3361
+ user: "administrator",
3362
+ user_id: 1,
3363
+ action: "updated alert: \"assets\" from \"[]\" to \"[{'asset_name': 'ANSYDWDC01', 'asset_ip': '139.180.134.102', 'asset_description': 'Microsoft Windows Server 2016 Standard', 'asset_type_id': 9, 'asset_tags': 'agent_id:102'}]\""
3364
+ }
3365
+ },
3366
+ status: {
3367
+ status_description: "Alert is assigned to a user and pending investigation",
3368
+ status_id: 3,
3369
+ status_name: "Assigned"
3370
+ },
3371
+ cases: [],
3372
+ alert_description: "Executable file dropped in Users\\Public folder",
3373
+ customer: {
3374
+ customer_id: 44,
3375
+ customer_sla: null,
3376
+ customer_name: "test_praeco",
3377
+ customer_description: null,
3378
+ creation_date: "2024-01-11T01:46:06.947860",
3379
+ custom_attributes: {},
3380
+ last_update_date: "2024-01-11T01:46:06.947860",
3381
+ client_uuid: "d6d42317-f29d-4637-bfdf-31816e08d587"
3382
+ },
3383
+ alert_id: 12051,
3384
+ resolution_status: null
3385
+ },
3386
+ {
3387
+ alert_owner_id: 1,
3388
+ alert_uuid: "b7996b59-690f-4aae-ba1c-cb24689a8fcf",
3389
+ alert_creation_time: "2024-01-13T17:47:19.760593",
3390
+ comments: [],
3391
+ assets: [
3392
+ {
3393
+ asset_name: "ANSYDWDC01",
3394
+ asset_description: "Microsoft Windows Server 2016 Standard",
3395
+ asset_type: {
3396
+ asset_id: 9,
3397
+ asset_icon_compromised: "ioc_windows_desktop.png",
3398
+ asset_name: "Windows - Computer",
3399
+ asset_icon_not_compromised: "windows_desktop.png",
3400
+ asset_description: "Standard Windows Computer"
3401
+ },
3402
+ custom_attributes: null,
3403
+ asset_tags: "agent_id:102",
3404
+ asset_compromise_status_id: null,
3405
+ date_update: null,
3406
+ asset_enrichment: null,
3407
+ case_id: null,
3408
+ user_id: null,
3409
+ asset_type_id: 9,
3410
+ asset_id: 12464,
3411
+ asset_ip: "139.180.134.102",
3412
+ asset_domain: null,
3413
+ asset_uuid: "6f3d23d0-4c41-4e8d-9226-eac12a47da78",
3414
+ analysis_status_id: null,
3415
+ asset_info: null,
3416
+ date_added: null
3417
+ }
3418
+ ],
3419
+ alert_classification_id: null,
3420
+ alert_status_id: 3,
3421
+ alert_severity_id: 5,
3422
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
3423
+ alert_source_content: {
3424
+ index: "wazuh_00002_268",
3425
+ id: "1705000849.1377555541",
3426
+ agent_name: "ANSYDWDC01",
3427
+ agent_ip: "139.180.134.102",
3428
+ agent_id: "102",
3429
+ agent_labels_customer: "00002",
3430
+ rule_id: "92207",
3431
+ rule_level: 12,
3432
+ rule_description: "Executable file dropped in Users\\Public folder",
3433
+ timestamp: "2024-01-11 19:20:52.106",
3434
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
3435
+ time_field: "2024-01-11T19:20:48.181Z",
3436
+ asset_type_id: 9,
3437
+ gl2_source_input: "6459151dea00fd5d3da2df91",
3438
+ data_win_system_level: "4",
3439
+ data_win_system_processID: "2144",
3440
+ rule_mitre_technique: "Ingress Tool Transfer",
3441
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
3442
+ rule_group1: "sysmon",
3443
+ rule_mail: true,
3444
+ decoder_name: "windows_eventchannel",
3445
+ syslog_level: "ALERT",
3446
+ data_win_system_threadID: "3140",
3447
+ data_win_system_eventRecordID: "18951669",
3448
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
3449
+ data_win_eventdata_processId: "3608",
3450
+ streams: [
3451
+ "658d6cec5e9a2d550c8354c1",
3452
+ "659f47da5e9a2d550cac9a40",
3453
+ "659f485b5e9a2d550cac9b85",
3454
+ "645a3a6123e5cc30bbc0e5dc",
3455
+ "658d6d435e9a2d550c83558a"
3456
+ ],
3457
+ gl2_remote_ip: "10.255.255.13",
3458
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
3459
+ agent_ip_geolocation: "1.3078,103.6818",
3460
+ message:
3461
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
3462
+ true: 1705000849.314127,
3463
+ rule_firedtimes: 1,
3464
+ data_win_eventdata_image:
3465
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
3466
+ source_reserved_ip: true,
3467
+ agent_ip_city_name: "Singapore",
3468
+ num_hits: 1,
3469
+ manager_name: "ASHWZHMA",
3470
+ agent_ip_country_code: "SG",
3471
+ syslog_type: "wazuh",
3472
+ data_win_system_eventID: "11",
3473
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
3474
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
3475
+ gl2_accounted_message_size: 4116,
3476
+ data_win_system_message:
3477
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
3478
+ process_id: "3608",
3479
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
3480
+ rule_group3: "windows",
3481
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
3482
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
3483
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
3484
+ num_matches: 1,
3485
+ source: "10.255.255.13",
3486
+ data_win_system_keywords: "0x8000000000000000",
3487
+ gl2_processing_error:
3488
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
3489
+ data_win_system_task: "11",
3490
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
3491
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
3492
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
3493
+ rule_mitre_id: "T1105",
3494
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
3495
+ rule_group2: "sysmon_eid11_detections",
3496
+ rule_mitre_tactic: "Command and Control",
3497
+ location: "EventChannel",
3498
+ gl2_remote_port: 58986,
3499
+ data_win_eventdata_user: "NT AUTHORITY\\\\SYSTEM",
3500
+ data_win_system_opcode: "0",
3501
+ data_win_system_severityValue: "INFORMATION",
3502
+ data_win_system_version: "2"
3503
+ },
3504
+ alert_title: "Executable file dropped in Users\\Public folder",
3505
+ alert_customer_id: 44,
3506
+ alert_resolution_status_id: null,
3507
+ alert_context: {
3508
+ customer_iris_id: 44,
3509
+ customer_name: "test_praeco",
3510
+ customer_cases_index: "dfir_iris_test_praeco",
3511
+ alert_id: "1705000849.1377555541",
3512
+ alert_name: "Executable file dropped in Users\\Public folder",
3513
+ alert_level: 12,
3514
+ rule_id: "92207",
3515
+ asset_name: "ANSYDWDC01",
3516
+ asset_ip: "139.180.134.102",
3517
+ asset_type: 9,
3518
+ process_id: "3608",
3519
+ rule_mitre_id: "T1105",
3520
+ rule_mitre_tactic: "Command and Control",
3521
+ rule_mitre_technique: "Ingress Tool Transfer"
3522
+ },
3523
+ owner: {
3524
+ user_login: "administrator",
3525
+ user_email: "administrator@localhost",
3526
+ user_name: "administrator",
3527
+ id: 1
3528
+ },
3529
+ alert_source_ref: null,
3530
+ alert_tags: null,
3531
+ classification: null,
3532
+ severity: {
3533
+ severity_name: "High",
3534
+ severity_description: "High",
3535
+ severity_id: 5
3536
+ },
3537
+ alert_source_link:
3538
+ "test.com/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22process_id:%5C%223608%5C%22%20AND%20agent_name:%5C%22ANSYDWDC01%5C%22%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D",
3539
+ iocs: [],
3540
+ alert_note: null,
3541
+ alert_source: "SOCFORTRESS RULE",
3542
+ modification_history: {
3543
+ "1705168039.764918": {
3544
+ user: "administrator",
3545
+ user_id: 1,
3546
+ action: "Alert created"
3547
+ },
3548
+ "1705168039.809592": {
3549
+ user: "administrator",
3550
+ user_id: 1,
3551
+ action: "updated alert: \"assets\" from \"[]\" to \"[{'asset_name': 'ANSYDWDC01', 'asset_ip': '139.180.134.102', 'asset_description': 'Microsoft Windows Server 2016 Standard', 'asset_type_id': 9, 'asset_tags': 'agent_id:102'}]\""
3552
+ }
3553
+ },
3554
+ status: {
3555
+ status_description: "Alert is assigned to a user and pending investigation",
3556
+ status_id: 3,
3557
+ status_name: "Assigned"
3558
+ },
3559
+ cases: [],
3560
+ alert_description: "Executable file dropped in Users\\Public folder",
3561
+ customer: {
3562
+ customer_id: 44,
3563
+ customer_sla: null,
3564
+ customer_name: "test_praeco",
3565
+ customer_description: null,
3566
+ creation_date: "2024-01-11T01:46:06.947860",
3567
+ custom_attributes: {},
3568
+ last_update_date: "2024-01-11T01:46:06.947860",
3569
+ client_uuid: "d6d42317-f29d-4637-bfdf-31816e08d587"
3570
+ },
3571
+ alert_id: 12059,
3572
+ resolution_status: null
3573
+ },
3574
+ {
3575
+ alert_owner_id: 1,
3576
+ alert_uuid: "2a061402-b209-4aa3-a6c5-09f06d0d7c1c",
3577
+ alert_creation_time: "2024-01-13T17:49:19.756023",
3578
+ comments: [],
3579
+ assets: [
3580
+ {
3581
+ asset_name: "ANSYDWDC01",
3582
+ asset_description: "Microsoft Windows Server 2016 Standard",
3583
+ asset_type: {
3584
+ asset_id: 9,
3585
+ asset_icon_compromised: "ioc_windows_desktop.png",
3586
+ asset_name: "Windows - Computer",
3587
+ asset_icon_not_compromised: "windows_desktop.png",
3588
+ asset_description: "Standard Windows Computer"
3589
+ },
3590
+ custom_attributes: null,
3591
+ asset_tags: "agent_id:102",
3592
+ asset_compromise_status_id: null,
3593
+ date_update: null,
3594
+ asset_enrichment: null,
3595
+ case_id: null,
3596
+ user_id: null,
3597
+ asset_type_id: 9,
3598
+ asset_id: 12472,
3599
+ asset_ip: "139.180.134.102",
3600
+ asset_domain: null,
3601
+ asset_uuid: "ee66b965-3ad0-4d6f-b94b-3eb32da41d4f",
3602
+ analysis_status_id: null,
3603
+ asset_info: null,
3604
+ date_added: null
3605
+ }
3606
+ ],
3607
+ alert_classification_id: null,
3608
+ alert_status_id: 3,
3609
+ alert_severity_id: 5,
3610
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
3611
+ alert_source_content: {
3612
+ index: "wazuh_00002_268",
3613
+ id: "1705000849.1377555541",
3614
+ agent_name: "ANSYDWDC01",
3615
+ agent_ip: "139.180.134.102",
3616
+ agent_id: "102",
3617
+ agent_labels_customer: "00002",
3618
+ rule_id: "92207",
3619
+ rule_level: 12,
3620
+ rule_description: "Executable file dropped in Users\\Public folder",
3621
+ timestamp: "2024-01-11 19:20:52.106",
3622
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
3623
+ time_field: "2024-01-11T19:20:48.181Z",
3624
+ asset_type_id: 9,
3625
+ gl2_source_input: "6459151dea00fd5d3da2df91",
3626
+ data_win_system_level: "4",
3627
+ data_win_system_processID: "2144",
3628
+ rule_mitre_technique: "Ingress Tool Transfer",
3629
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
3630
+ rule_group1: "sysmon",
3631
+ rule_mail: true,
3632
+ decoder_name: "windows_eventchannel",
3633
+ syslog_level: "ALERT",
3634
+ data_win_system_threadID: "3140",
3635
+ data_win_system_eventRecordID: "18951669",
3636
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
3637
+ data_win_eventdata_processId: "3608",
3638
+ streams: [
3639
+ "658d6cec5e9a2d550c8354c1",
3640
+ "659f47da5e9a2d550cac9a40",
3641
+ "659f485b5e9a2d550cac9b85",
3642
+ "645a3a6123e5cc30bbc0e5dc",
3643
+ "658d6d435e9a2d550c83558a"
3644
+ ],
3645
+ gl2_remote_ip: "10.255.255.13",
3646
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
3647
+ agent_ip_geolocation: "1.3078,103.6818",
3648
+ message:
3649
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
3650
+ true: 1705000849.314127,
3651
+ rule_firedtimes: 1,
3652
+ data_win_eventdata_image:
3653
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
3654
+ source_reserved_ip: true,
3655
+ agent_ip_city_name: "Singapore",
3656
+ num_hits: 1,
3657
+ manager_name: "ASHWZHMA",
3658
+ agent_ip_country_code: "SG",
3659
+ syslog_type: "wazuh",
3660
+ data_win_system_eventID: "11",
3661
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
3662
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
3663
+ gl2_accounted_message_size: 4116,
3664
+ data_win_system_message:
3665
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
3666
+ process_id: "3608",
3667
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
3668
+ rule_group3: "windows",
3669
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
3670
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
3671
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
3672
+ num_matches: 1,
3673
+ source: "10.255.255.13",
3674
+ data_win_system_keywords: "0x8000000000000000",
3675
+ gl2_processing_error:
3676
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
3677
+ data_win_system_task: "11",
3678
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
3679
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
3680
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
3681
+ rule_mitre_id: "T1105",
3682
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
3683
+ rule_group2: "sysmon_eid11_detections",
3684
+ rule_mitre_tactic: "Command and Control",
3685
+ location: "EventChannel",
3686
+ gl2_remote_port: 58986,
3687
+ data_win_eventdata_user: "NT AUTHORITY\\\\SYSTEM",
3688
+ data_win_system_opcode: "0",
3689
+ data_win_system_severityValue: "INFORMATION",
3690
+ data_win_system_version: "2"
3691
+ },
3692
+ alert_title: "Executable file dropped in Users\\Public folder",
3693
+ alert_customer_id: 44,
3694
+ alert_resolution_status_id: null,
3695
+ alert_context: {
3696
+ customer_iris_id: 44,
3697
+ customer_name: "test_praeco",
3698
+ customer_cases_index: "dfir_iris_test_praeco",
3699
+ alert_id: "1705000849.1377555541",
3700
+ alert_name: "Executable file dropped in Users\\Public folder",
3701
+ alert_level: 12,
3702
+ rule_id: "92207",
3703
+ asset_name: "ANSYDWDC01",
3704
+ asset_ip: "139.180.134.102",
3705
+ asset_type: 9,
3706
+ process_id: "3608",
3707
+ rule_mitre_id: "T1105",
3708
+ rule_mitre_tactic: "Command and Control",
3709
+ rule_mitre_technique: "Ingress Tool Transfer"
3710
+ },
3711
+ owner: {
3712
+ user_login: "administrator",
3713
+ user_email: "administrator@localhost",
3714
+ user_name: "administrator",
3715
+ id: 1
3716
+ },
3717
+ alert_source_ref: null,
3718
+ alert_tags: null,
3719
+ classification: null,
3720
+ severity: {
3721
+ severity_name: "High",
3722
+ severity_description: "High",
3723
+ severity_id: 5
3724
+ },
3725
+ alert_source_link:
3726
+ "test.com/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22process_id:%5C%223608%5C%22%20AND%20agent_name:%5C%22ANSYDWDC01%5C%22%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D",
3727
+ iocs: [],
3728
+ alert_note: null,
3729
+ alert_source: "SOCFORTRESS RULE",
3730
+ modification_history: {
3731
+ "1705168159.760292": {
3732
+ user: "administrator",
3733
+ user_id: 1,
3734
+ action: "Alert created"
3735
+ },
3736
+ "1705168159.810327": {
3737
+ user: "administrator",
3738
+ user_id: 1,
3739
+ action: "updated alert: \"assets\" from \"[]\" to \"[{'asset_name': 'ANSYDWDC01', 'asset_ip': '139.180.134.102', 'asset_description': 'Microsoft Windows Server 2016 Standard', 'asset_type_id': 9, 'asset_tags': 'agent_id:102'}]\""
3740
+ }
3741
+ },
3742
+ status: {
3743
+ status_description: "Alert is assigned to a user and pending investigation",
3744
+ status_id: 3,
3745
+ status_name: "Assigned"
3746
+ },
3747
+ cases: [],
3748
+ alert_description: "Executable file dropped in Users\\Public folder",
3749
+ customer: {
3750
+ customer_id: 44,
3751
+ customer_sla: null,
3752
+ customer_name: "test_praeco",
3753
+ customer_description: null,
3754
+ creation_date: "2024-01-11T01:46:06.947860",
3755
+ custom_attributes: {},
3756
+ last_update_date: "2024-01-11T01:46:06.947860",
3757
+ client_uuid: "d6d42317-f29d-4637-bfdf-31816e08d587"
3758
+ },
3759
+ alert_id: 12067,
3760
+ resolution_status: null
3761
+ },
3762
+ {
3763
+ alert_owner_id: 1,
3764
+ alert_uuid: "26bf2470-c9d5-4d26-98bb-b8979142a81e",
3765
+ alert_creation_time: "2024-01-13T17:51:19.766628",
3766
+ comments: [],
3767
+ assets: [
3768
+ {
3769
+ asset_name: "ANSYDWDC01",
3770
+ asset_description: "Microsoft Windows Server 2016 Standard",
3771
+ asset_type: {
3772
+ asset_id: 9,
3773
+ asset_icon_compromised: "ioc_windows_desktop.png",
3774
+ asset_name: "Windows - Computer",
3775
+ asset_icon_not_compromised: "windows_desktop.png",
3776
+ asset_description: "Standard Windows Computer"
3777
+ },
3778
+ custom_attributes: null,
3779
+ asset_tags: "agent_id:102",
3780
+ asset_compromise_status_id: null,
3781
+ date_update: null,
3782
+ asset_enrichment: null,
3783
+ case_id: null,
3784
+ user_id: null,
3785
+ asset_type_id: 9,
3786
+ asset_id: 12480,
3787
+ asset_ip: "139.180.134.102",
3788
+ asset_domain: null,
3789
+ asset_uuid: "e25d62e3-4d3f-4773-9db3-f0ecb23e57d2",
3790
+ analysis_status_id: null,
3791
+ asset_info: null,
3792
+ date_added: null
3793
+ }
3794
+ ],
3795
+ alert_classification_id: null,
3796
+ alert_status_id: 3,
3797
+ alert_severity_id: 5,
3798
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
3799
+ alert_source_content: {
3800
+ index: "wazuh_00002_268",
3801
+ id: "1705000849.1377555541",
3802
+ agent_name: "ANSYDWDC01",
3803
+ agent_ip: "139.180.134.102",
3804
+ agent_id: "102",
3805
+ agent_labels_customer: "00002",
3806
+ rule_id: "92207",
3807
+ rule_level: 12,
3808
+ rule_description: "Executable file dropped in Users\\Public folder",
3809
+ timestamp: "2024-01-11 19:20:52.106",
3810
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
3811
+ time_field: "2024-01-11T19:20:48.181Z",
3812
+ asset_type_id: 9,
3813
+ gl2_source_input: "6459151dea00fd5d3da2df91",
3814
+ data_win_system_level: "4",
3815
+ data_win_system_processID: "2144",
3816
+ rule_mitre_technique: "Ingress Tool Transfer",
3817
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
3818
+ rule_group1: "sysmon",
3819
+ rule_mail: true,
3820
+ decoder_name: "windows_eventchannel",
3821
+ syslog_level: "ALERT",
3822
+ data_win_system_threadID: "3140",
3823
+ data_win_system_eventRecordID: "18951669",
3824
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
3825
+ data_win_eventdata_processId: "3608",
3826
+ streams: [
3827
+ "658d6cec5e9a2d550c8354c1",
3828
+ "659f47da5e9a2d550cac9a40",
3829
+ "659f485b5e9a2d550cac9b85",
3830
+ "645a3a6123e5cc30bbc0e5dc",
3831
+ "658d6d435e9a2d550c83558a"
3832
+ ],
3833
+ gl2_remote_ip: "10.255.255.13",
3834
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
3835
+ agent_ip_geolocation: "1.3078,103.6818",
3836
+ message:
3837
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
3838
+ true: 1705000849.314127,
3839
+ rule_firedtimes: 1,
3840
+ data_win_eventdata_image:
3841
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
3842
+ source_reserved_ip: true,
3843
+ agent_ip_city_name: "Singapore",
3844
+ num_hits: 1,
3845
+ manager_name: "ASHWZHMA",
3846
+ agent_ip_country_code: "SG",
3847
+ syslog_type: "wazuh",
3848
+ data_win_system_eventID: "11",
3849
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
3850
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
3851
+ gl2_accounted_message_size: 4116,
3852
+ data_win_system_message:
3853
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
3854
+ process_id: "3608",
3855
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
3856
+ rule_group3: "windows",
3857
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
3858
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
3859
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
3860
+ num_matches: 1,
3861
+ source: "10.255.255.13",
3862
+ data_win_system_keywords: "0x8000000000000000",
3863
+ gl2_processing_error:
3864
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
3865
+ data_win_system_task: "11",
3866
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
3867
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
3868
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
3869
+ rule_mitre_id: "T1105",
3870
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
3871
+ rule_group2: "sysmon_eid11_detections",
3872
+ rule_mitre_tactic: "Command and Control",
3873
+ location: "EventChannel",
3874
+ gl2_remote_port: 58986,
3875
+ data_win_eventdata_user: "NT AUTHORITY\\\\SYSTEM",
3876
+ data_win_system_opcode: "0",
3877
+ data_win_system_severityValue: "INFORMATION",
3878
+ data_win_system_version: "2"
3879
+ },
3880
+ alert_title: "Executable file dropped in Users\\Public folder",
3881
+ alert_customer_id: 44,
3882
+ alert_resolution_status_id: null,
3883
+ alert_context: {
3884
+ customer_iris_id: 44,
3885
+ customer_name: "test_praeco",
3886
+ customer_cases_index: "dfir_iris_test_praeco",
3887
+ alert_id: "1705000849.1377555541",
3888
+ alert_name: "Executable file dropped in Users\\Public folder",
3889
+ alert_level: 12,
3890
+ rule_id: "92207",
3891
+ asset_name: "ANSYDWDC01",
3892
+ asset_ip: "139.180.134.102",
3893
+ asset_type: 9,
3894
+ process_id: "3608",
3895
+ rule_mitre_id: "T1105",
3896
+ rule_mitre_tactic: "Command and Control",
3897
+ rule_mitre_technique: "Ingress Tool Transfer"
3898
+ },
3899
+ owner: {
3900
+ user_login: "administrator",
3901
+ user_email: "administrator@localhost",
3902
+ user_name: "administrator",
3903
+ id: 1
3904
+ },
3905
+ alert_source_ref: null,
3906
+ alert_tags: null,
3907
+ classification: null,
3908
+ severity: {
3909
+ severity_name: "High",
3910
+ severity_description: "High",
3911
+ severity_id: 5
3912
+ },
3913
+ alert_source_link:
3914
+ "test.com/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22process_id:%5C%223608%5C%22%20AND%20agent_name:%5C%22ANSYDWDC01%5C%22%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D",
3915
+ iocs: [],
3916
+ alert_note: null,
3917
+ alert_source: "SOCFORTRESS RULE",
3918
+ modification_history: {
3919
+ "1705168279.771562": {
3920
+ user: "administrator",
3921
+ user_id: 1,
3922
+ action: "Alert created"
3923
+ },
3924
+ "1705168279.821397": {
3925
+ user: "administrator",
3926
+ user_id: 1,
3927
+ action: "updated alert: \"assets\" from \"[]\" to \"[{'asset_name': 'ANSYDWDC01', 'asset_ip': '139.180.134.102', 'asset_description': 'Microsoft Windows Server 2016 Standard', 'asset_type_id': 9, 'asset_tags': 'agent_id:102'}]\""
3928
+ }
3929
+ },
3930
+ status: {
3931
+ status_description: "Alert is assigned to a user and pending investigation",
3932
+ status_id: 3,
3933
+ status_name: "Assigned"
3934
+ },
3935
+ cases: [],
3936
+ alert_description: "Executable file dropped in Users\\Public folder",
3937
+ customer: {
3938
+ customer_id: 44,
3939
+ customer_sla: null,
3940
+ customer_name: "test_praeco",
3941
+ customer_description: null,
3942
+ creation_date: "2024-01-11T01:46:06.947860",
3943
+ custom_attributes: {},
3944
+ last_update_date: "2024-01-11T01:46:06.947860",
3945
+ client_uuid: "d6d42317-f29d-4637-bfdf-31816e08d587"
3946
+ },
3947
+ alert_id: 12075,
3948
+ resolution_status: null
3949
+ },
3950
+ {
3951
+ alert_owner_id: 1,
3952
+ alert_uuid: "1a11fea8-4db9-4de6-8b7a-5d89ac3d4882",
3953
+ alert_creation_time: "2024-01-13T17:52:19.767598",
3954
+ comments: [],
3955
+ assets: [
3956
+ {
3957
+ asset_name: "ANSYDWDC01",
3958
+ asset_description: "Microsoft Windows Server 2016 Standard",
3959
+ asset_type: {
3960
+ asset_id: 9,
3961
+ asset_icon_compromised: "ioc_windows_desktop.png",
3962
+ asset_name: "Windows - Computer",
3963
+ asset_icon_not_compromised: "windows_desktop.png",
3964
+ asset_description: "Standard Windows Computer"
3965
+ },
3966
+ custom_attributes: null,
3967
+ asset_tags: "agent_id:102",
3968
+ asset_compromise_status_id: null,
3969
+ date_update: null,
3970
+ asset_enrichment: null,
3971
+ case_id: null,
3972
+ user_id: null,
3973
+ asset_type_id: 9,
3974
+ asset_id: 12484,
3975
+ asset_ip: "139.180.134.102",
3976
+ asset_domain: null,
3977
+ asset_uuid: "ca0dab2b-1886-41ef-87d7-5e81087ab37d",
3978
+ analysis_status_id: null,
3979
+ asset_info: null,
3980
+ date_added: null
3981
+ }
3982
+ ],
3983
+ alert_classification_id: null,
3984
+ alert_status_id: 3,
3985
+ alert_severity_id: 5,
3986
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
3987
+ alert_source_content: {
3988
+ index: "wazuh_00002_268",
3989
+ id: "1705000849.1377555541",
3990
+ agent_name: "ANSYDWDC01",
3991
+ agent_ip: "139.180.134.102",
3992
+ agent_id: "102",
3993
+ agent_labels_customer: "00002",
3994
+ rule_id: "92207",
3995
+ rule_level: 12,
3996
+ rule_description: "Executable file dropped in Users\\Public folder",
3997
+ timestamp: "2024-01-11 19:20:52.106",
3998
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
3999
+ time_field: "2024-01-11T19:20:48.181Z",
4000
+ asset_type_id: 9,
4001
+ gl2_source_input: "6459151dea00fd5d3da2df91",
4002
+ data_win_system_level: "4",
4003
+ data_win_system_processID: "2144",
4004
+ rule_mitre_technique: "Ingress Tool Transfer",
4005
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
4006
+ rule_group1: "sysmon",
4007
+ rule_mail: true,
4008
+ decoder_name: "windows_eventchannel",
4009
+ syslog_level: "ALERT",
4010
+ data_win_system_threadID: "3140",
4011
+ data_win_system_eventRecordID: "18951669",
4012
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
4013
+ data_win_eventdata_processId: "3608",
4014
+ streams: [
4015
+ "658d6cec5e9a2d550c8354c1",
4016
+ "659f47da5e9a2d550cac9a40",
4017
+ "659f485b5e9a2d550cac9b85",
4018
+ "645a3a6123e5cc30bbc0e5dc",
4019
+ "658d6d435e9a2d550c83558a"
4020
+ ],
4021
+ gl2_remote_ip: "10.255.255.13",
4022
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
4023
+ agent_ip_geolocation: "1.3078,103.6818",
4024
+ message:
4025
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
4026
+ true: 1705000849.314127,
4027
+ rule_firedtimes: 1,
4028
+ data_win_eventdata_image:
4029
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
4030
+ source_reserved_ip: true,
4031
+ agent_ip_city_name: "Singapore",
4032
+ num_hits: 1,
4033
+ manager_name: "ASHWZHMA",
4034
+ agent_ip_country_code: "SG",
4035
+ syslog_type: "wazuh",
4036
+ data_win_system_eventID: "11",
4037
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
4038
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
4039
+ gl2_accounted_message_size: 4116,
4040
+ data_win_system_message:
4041
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
4042
+ process_id: "3608",
4043
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
4044
+ rule_group3: "windows",
4045
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
4046
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
4047
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
4048
+ num_matches: 1,
4049
+ source: "10.255.255.13",
4050
+ data_win_system_keywords: "0x8000000000000000",
4051
+ gl2_processing_error:
4052
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
4053
+ data_win_system_task: "11",
4054
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
4055
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
4056
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
4057
+ rule_mitre_id: "T1105",
4058
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
4059
+ rule_group2: "sysmon_eid11_detections",
4060
+ rule_mitre_tactic: "Command and Control",
4061
+ location: "EventChannel",
4062
+ gl2_remote_port: 58986,
4063
+ data_win_eventdata_user: "NT AUTHORITY\\\\SYSTEM",
4064
+ data_win_system_opcode: "0",
4065
+ data_win_system_severityValue: "INFORMATION",
4066
+ data_win_system_version: "2"
4067
+ },
4068
+ alert_title: "Executable file dropped in Users\\Public folder",
4069
+ alert_customer_id: 44,
4070
+ alert_resolution_status_id: null,
4071
+ alert_context: {
4072
+ customer_iris_id: 44,
4073
+ customer_name: "test_praeco",
4074
+ customer_cases_index: "dfir_iris_test_praeco",
4075
+ alert_id: "1705000849.1377555541",
4076
+ alert_name: "Executable file dropped in Users\\Public folder",
4077
+ alert_level: 12,
4078
+ rule_id: "92207",
4079
+ asset_name: "ANSYDWDC01",
4080
+ asset_ip: "139.180.134.102",
4081
+ asset_type: 9,
4082
+ process_id: "3608",
4083
+ rule_mitre_id: "T1105",
4084
+ rule_mitre_tactic: "Command and Control",
4085
+ rule_mitre_technique: "Ingress Tool Transfer"
4086
+ },
4087
+ owner: {
4088
+ user_login: "administrator",
4089
+ user_email: "administrator@localhost",
4090
+ user_name: "administrator",
4091
+ id: 1
4092
+ },
4093
+ alert_source_ref: null,
4094
+ alert_tags: null,
4095
+ classification: null,
4096
+ severity: {
4097
+ severity_name: "High",
4098
+ severity_description: "High",
4099
+ severity_id: 5
4100
+ },
4101
+ alert_source_link:
4102
+ "test.com/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22process_id:%5C%223608%5C%22%20AND%20agent_name:%5C%22ANSYDWDC01%5C%22%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D",
4103
+ iocs: [],
4104
+ alert_note: null,
4105
+ alert_source: "SOCFORTRESS RULE",
4106
+ modification_history: {
4107
+ "1705168339.77171": {
4108
+ user: "administrator",
4109
+ user_id: 1,
4110
+ action: "Alert created"
4111
+ },
4112
+ "1705168339.818058": {
4113
+ user: "administrator",
4114
+ user_id: 1,
4115
+ action: "updated alert: \"assets\" from \"[]\" to \"[{'asset_name': 'ANSYDWDC01', 'asset_ip': '139.180.134.102', 'asset_description': 'Microsoft Windows Server 2016 Standard', 'asset_type_id': 9, 'asset_tags': 'agent_id:102'}]\""
4116
+ }
4117
+ },
4118
+ status: {
4119
+ status_description: "Alert is assigned to a user and pending investigation",
4120
+ status_id: 3,
4121
+ status_name: "Assigned"
4122
+ },
4123
+ cases: [],
4124
+ alert_description: "Executable file dropped in Users\\Public folder",
4125
+ customer: {
4126
+ customer_id: 44,
4127
+ customer_sla: null,
4128
+ customer_name: "test_praeco",
4129
+ customer_description: null,
4130
+ creation_date: "2024-01-11T01:46:06.947860",
4131
+ custom_attributes: {},
4132
+ last_update_date: "2024-01-11T01:46:06.947860",
4133
+ client_uuid: "d6d42317-f29d-4637-bfdf-31816e08d587"
4134
+ },
4135
+ alert_id: 12079,
4136
+ resolution_status: null
4137
+ },
4138
+ {
4139
+ alert_owner_id: 1,
4140
+ alert_uuid: "81ca793e-a033-43fb-a0ec-041c243a7301",
4141
+ alert_creation_time: "2024-01-11T21:50:19.760802",
4142
+ comments: [],
4143
+ assets: [
4144
+ {
4145
+ asset_name: "ANSYDWDC01",
4146
+ asset_description: "Microsoft Windows Server 2016 Standard",
4147
+ asset_type: {
4148
+ asset_id: 9,
4149
+ asset_icon_compromised: "ioc_windows_desktop.png",
4150
+ asset_name: "Windows - Computer",
4151
+ asset_icon_not_compromised: "windows_desktop.png",
4152
+ asset_description: "Standard Windows Computer"
4153
+ },
4154
+ custom_attributes: null,
4155
+ asset_tags: "agent_id:102",
4156
+ asset_compromise_status_id: null,
4157
+ date_update: null,
4158
+ asset_enrichment: null,
4159
+ case_id: null,
4160
+ user_id: null,
4161
+ asset_type_id: 9,
4162
+ asset_id: 3563,
4163
+ asset_ip: "139.180.134.102",
4164
+ asset_domain: null,
4165
+ asset_uuid: "f02381a8-2b1d-40fa-b15a-e546c6f899bc",
4166
+ analysis_status_id: null,
4167
+ asset_info: null,
4168
+ date_added: null
4169
+ }
4170
+ ],
4171
+ alert_classification_id: null,
4172
+ alert_status_id: 3,
4173
+ alert_severity_id: 5,
4174
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
4175
+ alert_source_content: {
4176
+ index: "wazuh_00002_268",
4177
+ id: "1705000849.1377555541",
4178
+ agent_name: "ANSYDWDC01",
4179
+ agent_ip: "139.180.134.102",
4180
+ agent_id: "102",
4181
+ agent_labels_customer: "00002",
4182
+ rule_id: "92207",
4183
+ rule_level: 12,
4184
+ rule_description: "Executable file dropped in Users\\Public folder",
4185
+ timestamp: "2024-01-11 19:20:52.106",
4186
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
4187
+ time_field: "2024-01-11T19:20:48.181Z",
4188
+ asset_type_id: 9,
4189
+ gl2_source_input: "6459151dea00fd5d3da2df91",
4190
+ data_win_system_level: "4",
4191
+ data_win_system_processID: "2144",
4192
+ rule_mitre_technique: "Ingress Tool Transfer",
4193
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
4194
+ rule_group1: "sysmon",
4195
+ rule_mail: true,
4196
+ decoder_name: "windows_eventchannel",
4197
+ syslog_level: "ALERT",
4198
+ data_win_system_threadID: "3140",
4199
+ data_win_system_eventRecordID: "18951669",
4200
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
4201
+ data_win_eventdata_processId: "3608",
4202
+ streams: [
4203
+ "658d6cec5e9a2d550c8354c1",
4204
+ "659f47da5e9a2d550cac9a40",
4205
+ "659f485b5e9a2d550cac9b85",
4206
+ "645a3a6123e5cc30bbc0e5dc",
4207
+ "658d6d435e9a2d550c83558a"
4208
+ ],
4209
+ gl2_remote_ip: "10.255.255.13",
4210
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
4211
+ agent_ip_geolocation: "1.3078,103.6818",
4212
+ message:
4213
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
4214
+ true: 1705000849.314127,
4215
+ rule_firedtimes: 1,
4216
+ data_win_eventdata_image:
4217
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
4218
+ source_reserved_ip: true,
4219
+ agent_ip_city_name: "Singapore",
4220
+ num_hits: 1,
4221
+ manager_name: "ASHWZHMA",
4222
+ agent_ip_country_code: "SG",
4223
+ syslog_type: "wazuh",
4224
+ data_win_system_eventID: "11",
4225
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
4226
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
4227
+ gl2_accounted_message_size: 4116,
4228
+ data_win_system_message:
4229
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
4230
+ process_id: "3608",
4231
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
4232
+ rule_group3: "windows",
4233
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
4234
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
4235
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
4236
+ num_matches: 1,
4237
+ source: "10.255.255.13",
4238
+ data_win_system_keywords: "0x8000000000000000",
4239
+ gl2_processing_error:
4240
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
4241
+ data_win_system_task: "11",
4242
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
4243
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
4244
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
4245
+ rule_mitre_id: "T1105",
4246
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
4247
+ rule_group2: "sysmon_eid11_detections",
4248
+ rule_mitre_tactic: "Command and Control",
4249
+ location: "EventChannel",
4250
+ gl2_remote_port: 58986,
4251
+ data_win_eventdata_user: "NT AUTHORITY\\\\SYSTEM",
4252
+ data_win_system_opcode: "0",
4253
+ data_win_system_severityValue: "INFORMATION",
4254
+ data_win_system_version: "2"
4255
+ },
4256
+ alert_title: "Executable file dropped in Users\\Public folder",
4257
+ alert_customer_id: 44,
4258
+ alert_resolution_status_id: null,
4259
+ alert_context: {
4260
+ customer_iris_id: 44,
4261
+ customer_name: "test_praeco",
4262
+ customer_cases_index: "dfir_iris_test_praeco",
4263
+ alert_id: "1705000849.1377555541",
4264
+ alert_name: "Executable file dropped in Users\\Public folder",
4265
+ alert_level: 12,
4266
+ rule_id: "92207",
4267
+ asset_name: "ANSYDWDC01",
4268
+ asset_ip: "139.180.134.102",
4269
+ asset_type: 9,
4270
+ process_id: "3608",
4271
+ rule_mitre_id: "T1105",
4272
+ rule_mitre_tactic: "Command and Control",
4273
+ rule_mitre_technique: "Ingress Tool Transfer"
4274
+ },
4275
+ owner: {
4276
+ user_login: "administrator",
4277
+ user_email: "administrator@localhost",
4278
+ user_name: "administrator",
4279
+ id: 1
4280
+ },
4281
+ alert_source_ref: null,
4282
+ alert_tags: null,
4283
+ classification: null,
4284
+ severity: {
4285
+ severity_name: "High",
4286
+ severity_description: "High",
4287
+ severity_id: 5
4288
+ },
4289
+ alert_source_link:
4290
+ "test.com/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22process_id:%5C%223608%5C%22%20AND%20agent_name:%5C%22ANSYDWDC01%5C%22%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D",
4291
+ iocs: [],
4292
+ alert_note: null,
4293
+ alert_source: "SOCFORTRESS RULE",
4294
+ modification_history: {
4295
+ "1705009819.765604": {
4296
+ user: "administrator",
4297
+ user_id: 1,
4298
+ action: "Alert created"
4299
+ },
4300
+ "1705009819.813519": {
4301
+ user: "administrator",
4302
+ user_id: 1,
4303
+ action: "updated alert: \"assets\" from \"[]\" to \"[{'asset_name': 'ANSYDWDC01', 'asset_ip': '139.180.134.102', 'asset_description': 'Microsoft Windows Server 2016 Standard', 'asset_type_id': 9, 'asset_tags': 'agent_id:102'}]\""
4304
+ }
4305
+ },
4306
+ status: {
4307
+ status_description: "Alert is assigned to a user and pending investigation",
4308
+ status_id: 3,
4309
+ status_name: "Assigned"
4310
+ },
4311
+ cases: [],
4312
+ alert_description: "Executable file dropped in Users\\Public folder",
4313
+ customer: {
4314
+ customer_id: 44,
4315
+ customer_sla: null,
4316
+ customer_name: "test_praeco",
4317
+ customer_description: null,
4318
+ creation_date: "2024-01-11T01:46:06.947860",
4319
+ custom_attributes: {},
4320
+ last_update_date: "2024-01-11T01:46:06.947860",
4321
+ client_uuid: "d6d42317-f29d-4637-bfdf-31816e08d587"
4322
+ },
4323
+ alert_id: 3158,
4324
+ resolution_status: null
4325
+ },
4326
+ {
4327
+ alert_owner_id: 1,
4328
+ alert_uuid: "917a38cb-90ae-474f-a329-06aa2b4b208e",
4329
+ alert_creation_time: "2024-01-13T17:57:19.764342",
4330
+ comments: [],
4331
+ assets: [
4332
+ {
4333
+ asset_name: "ANSYDWDC01",
4334
+ asset_description: "Microsoft Windows Server 2016 Standard",
4335
+ asset_type: {
4336
+ asset_id: 9,
4337
+ asset_icon_compromised: "ioc_windows_desktop.png",
4338
+ asset_name: "Windows - Computer",
4339
+ asset_icon_not_compromised: "windows_desktop.png",
4340
+ asset_description: "Standard Windows Computer"
4341
+ },
4342
+ custom_attributes: null,
4343
+ asset_tags: "agent_id:102",
4344
+ asset_compromise_status_id: null,
4345
+ date_update: null,
4346
+ asset_enrichment: null,
4347
+ case_id: null,
4348
+ user_id: null,
4349
+ asset_type_id: 9,
4350
+ asset_id: 12504,
4351
+ asset_ip: "139.180.134.102",
4352
+ asset_domain: null,
4353
+ asset_uuid: "c01dc9fd-bd9c-448a-a1ab-26fd2cb9ccd3",
4354
+ analysis_status_id: null,
4355
+ asset_info: null,
4356
+ date_added: null
4357
+ }
4358
+ ],
4359
+ alert_classification_id: null,
4360
+ alert_status_id: 3,
4361
+ alert_severity_id: 5,
4362
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
4363
+ alert_source_content: {
4364
+ index: "wazuh_00002_268",
4365
+ id: "1705000849.1377555541",
4366
+ agent_name: "ANSYDWDC01",
4367
+ agent_ip: "139.180.134.102",
4368
+ agent_id: "102",
4369
+ agent_labels_customer: "00002",
4370
+ rule_id: "92207",
4371
+ rule_level: 12,
4372
+ rule_description: "Executable file dropped in Users\\Public folder",
4373
+ timestamp: "2024-01-11 19:20:52.106",
4374
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
4375
+ time_field: "2024-01-11T19:20:48.181Z",
4376
+ asset_type_id: 9,
4377
+ gl2_source_input: "6459151dea00fd5d3da2df91",
4378
+ data_win_system_level: "4",
4379
+ data_win_system_processID: "2144",
4380
+ rule_mitre_technique: "Ingress Tool Transfer",
4381
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
4382
+ rule_group1: "sysmon",
4383
+ rule_mail: true,
4384
+ decoder_name: "windows_eventchannel",
4385
+ syslog_level: "ALERT",
4386
+ data_win_system_threadID: "3140",
4387
+ data_win_system_eventRecordID: "18951669",
4388
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
4389
+ data_win_eventdata_processId: "3608",
4390
+ streams: [
4391
+ "658d6cec5e9a2d550c8354c1",
4392
+ "659f47da5e9a2d550cac9a40",
4393
+ "659f485b5e9a2d550cac9b85",
4394
+ "645a3a6123e5cc30bbc0e5dc",
4395
+ "658d6d435e9a2d550c83558a"
4396
+ ],
4397
+ gl2_remote_ip: "10.255.255.13",
4398
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
4399
+ agent_ip_geolocation: "1.3078,103.6818",
4400
+ message:
4401
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
4402
+ true: 1705000849.314127,
4403
+ rule_firedtimes: 1,
4404
+ data_win_eventdata_image:
4405
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
4406
+ source_reserved_ip: true,
4407
+ agent_ip_city_name: "Singapore",
4408
+ num_hits: 1,
4409
+ manager_name: "ASHWZHMA",
4410
+ agent_ip_country_code: "SG",
4411
+ syslog_type: "wazuh",
4412
+ data_win_system_eventID: "11",
4413
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
4414
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
4415
+ gl2_accounted_message_size: 4116,
4416
+ data_win_system_message:
4417
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
4418
+ process_id: "3608",
4419
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
4420
+ rule_group3: "windows",
4421
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
4422
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
4423
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
4424
+ num_matches: 1,
4425
+ source: "10.255.255.13",
4426
+ data_win_system_keywords: "0x8000000000000000",
4427
+ gl2_processing_error:
4428
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
4429
+ data_win_system_task: "11",
4430
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
4431
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
4432
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
4433
+ rule_mitre_id: "T1105",
4434
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
4435
+ rule_group2: "sysmon_eid11_detections",
4436
+ rule_mitre_tactic: "Command and Control",
4437
+ location: "EventChannel",
4438
+ gl2_remote_port: 58986,
4439
+ data_win_eventdata_user: "NT AUTHORITY\\\\SYSTEM",
4440
+ data_win_system_opcode: "0",
4441
+ data_win_system_severityValue: "INFORMATION",
4442
+ data_win_system_version: "2"
4443
+ },
4444
+ alert_title: "Executable file dropped in Users\\Public folder",
4445
+ alert_customer_id: 44,
4446
+ alert_resolution_status_id: null,
4447
+ alert_context: {
4448
+ customer_iris_id: 44,
4449
+ customer_name: "test_praeco",
4450
+ customer_cases_index: "dfir_iris_test_praeco",
4451
+ alert_id: "1705000849.1377555541",
4452
+ alert_name: "Executable file dropped in Users\\Public folder",
4453
+ alert_level: 12,
4454
+ rule_id: "92207",
4455
+ asset_name: "ANSYDWDC01",
4456
+ asset_ip: "139.180.134.102",
4457
+ asset_type: 9,
4458
+ process_id: "3608",
4459
+ rule_mitre_id: "T1105",
4460
+ rule_mitre_tactic: "Command and Control",
4461
+ rule_mitre_technique: "Ingress Tool Transfer"
4462
+ },
4463
+ owner: {
4464
+ user_login: "administrator",
4465
+ user_email: "administrator@localhost",
4466
+ user_name: "administrator",
4467
+ id: 1
4468
+ },
4469
+ alert_source_ref: null,
4470
+ alert_tags: null,
4471
+ classification: null,
4472
+ severity: {
4473
+ severity_name: "High",
4474
+ severity_description: "High",
4475
+ severity_id: 5
4476
+ },
4477
+ alert_source_link:
4478
+ "test.com/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22process_id:%5C%223608%5C%22%20AND%20agent_name:%5C%22ANSYDWDC01%5C%22%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D",
4479
+ iocs: [],
4480
+ alert_note: null,
4481
+ alert_source: "SOCFORTRESS RULE",
4482
+ modification_history: {
4483
+ "1705168639.769476": {
4484
+ user: "administrator",
4485
+ user_id: 1,
4486
+ action: "Alert created"
4487
+ },
4488
+ "1705168639.823149": {
4489
+ user: "administrator",
4490
+ user_id: 1,
4491
+ action: "updated alert: \"assets\" from \"[]\" to \"[{'asset_name': 'ANSYDWDC01', 'asset_ip': '139.180.134.102', 'asset_description': 'Microsoft Windows Server 2016 Standard', 'asset_type_id': 9, 'asset_tags': 'agent_id:102'}]\""
4492
+ }
4493
+ },
4494
+ status: {
4495
+ status_description: "Alert is assigned to a user and pending investigation",
4496
+ status_id: 3,
4497
+ status_name: "Assigned"
4498
+ },
4499
+ cases: [],
4500
+ alert_description: "Executable file dropped in Users\\Public folder",
4501
+ customer: {
4502
+ customer_id: 44,
4503
+ customer_sla: null,
4504
+ customer_name: "test_praeco",
4505
+ customer_description: null,
4506
+ creation_date: "2024-01-11T01:46:06.947860",
4507
+ custom_attributes: {},
4508
+ last_update_date: "2024-01-11T01:46:06.947860",
4509
+ client_uuid: "d6d42317-f29d-4637-bfdf-31816e08d587"
4510
+ },
4511
+ alert_id: 12099,
4512
+ resolution_status: null
4513
+ },
4514
+ {
4515
+ alert_owner_id: 1,
4516
+ alert_uuid: "c4e89681-7a0e-4f30-9fe2-960a529466f7",
4517
+ alert_creation_time: "2024-01-12T22:12:19.773994",
4518
+ comments: [],
4519
+ assets: [
4520
+ {
4521
+ asset_name: "ANSYDWDC01",
4522
+ asset_description: "Microsoft Windows Server 2016 Standard",
4523
+ asset_type: {
4524
+ asset_id: 9,
4525
+ asset_icon_compromised: "ioc_windows_desktop.png",
4526
+ asset_name: "Windows - Computer",
4527
+ asset_icon_not_compromised: "windows_desktop.png",
4528
+ asset_description: "Standard Windows Computer"
4529
+ },
4530
+ custom_attributes: null,
4531
+ asset_tags: "agent_id:102",
4532
+ asset_compromise_status_id: null,
4533
+ date_update: null,
4534
+ asset_enrichment: null,
4535
+ case_id: null,
4536
+ user_id: null,
4537
+ asset_type_id: 9,
4538
+ asset_id: 7764,
4539
+ asset_ip: "139.180.134.102",
4540
+ asset_domain: null,
4541
+ asset_uuid: "3a7de672-d54d-4008-9510-0f03535e583d",
4542
+ analysis_status_id: null,
4543
+ asset_info: null,
4544
+ date_added: null
4545
+ }
4546
+ ],
4547
+ alert_classification_id: null,
4548
+ alert_status_id: 3,
4549
+ alert_severity_id: 5,
4550
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
4551
+ alert_source_content: {
4552
+ index: "wazuh_00002_268",
4553
+ id: "1705000849.1377555541",
4554
+ agent_name: "ANSYDWDC01",
4555
+ agent_ip: "139.180.134.102",
4556
+ agent_id: "102",
4557
+ agent_labels_customer: "00002",
4558
+ rule_id: "92207",
4559
+ rule_level: 12,
4560
+ rule_description: "Executable file dropped in Users\\Public folder",
4561
+ timestamp: "2024-01-11 19:20:52.106",
4562
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
4563
+ time_field: "2024-01-11T19:20:48.181Z",
4564
+ asset_type_id: 9,
4565
+ gl2_source_input: "6459151dea00fd5d3da2df91",
4566
+ data_win_system_level: "4",
4567
+ data_win_system_processID: "2144",
4568
+ rule_mitre_technique: "Ingress Tool Transfer",
4569
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
4570
+ rule_group1: "sysmon",
4571
+ rule_mail: true,
4572
+ decoder_name: "windows_eventchannel",
4573
+ syslog_level: "ALERT",
4574
+ data_win_system_threadID: "3140",
4575
+ data_win_system_eventRecordID: "18951669",
4576
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
4577
+ data_win_eventdata_processId: "3608",
4578
+ streams: [
4579
+ "658d6cec5e9a2d550c8354c1",
4580
+ "659f47da5e9a2d550cac9a40",
4581
+ "659f485b5e9a2d550cac9b85",
4582
+ "645a3a6123e5cc30bbc0e5dc",
4583
+ "658d6d435e9a2d550c83558a"
4584
+ ],
4585
+ gl2_remote_ip: "10.255.255.13",
4586
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
4587
+ agent_ip_geolocation: "1.3078,103.6818",
4588
+ message:
4589
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
4590
+ true: 1705000849.314127,
4591
+ rule_firedtimes: 1,
4592
+ data_win_eventdata_image:
4593
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
4594
+ source_reserved_ip: true,
4595
+ agent_ip_city_name: "Singapore",
4596
+ num_hits: 1,
4597
+ manager_name: "ASHWZHMA",
4598
+ agent_ip_country_code: "SG",
4599
+ syslog_type: "wazuh",
4600
+ data_win_system_eventID: "11",
4601
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
4602
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
4603
+ gl2_accounted_message_size: 4116,
4604
+ data_win_system_message:
4605
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
4606
+ process_id: "3608",
4607
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
4608
+ rule_group3: "windows",
4609
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
4610
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
4611
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
4612
+ num_matches: 1,
4613
+ source: "10.255.255.13",
4614
+ data_win_system_keywords: "0x8000000000000000",
4615
+ gl2_processing_error:
4616
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
4617
+ data_win_system_task: "11",
4618
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
4619
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
4620
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
4621
+ rule_mitre_id: "T1105",
4622
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
4623
+ rule_group2: "sysmon_eid11_detections",
4624
+ rule_mitre_tactic: "Command and Control",
4625
+ location: "EventChannel",
4626
+ gl2_remote_port: 58986,
4627
+ data_win_eventdata_user: "NT AUTHORITY\\\\SYSTEM",
4628
+ data_win_system_opcode: "0",
4629
+ data_win_system_severityValue: "INFORMATION",
4630
+ data_win_system_version: "2"
4631
+ },
4632
+ alert_title: "Executable file dropped in Users\\Public folder",
4633
+ alert_customer_id: 44,
4634
+ alert_resolution_status_id: null,
4635
+ alert_context: {
4636
+ customer_iris_id: 44,
4637
+ customer_name: "test_praeco",
4638
+ customer_cases_index: "dfir_iris_test_praeco",
4639
+ alert_id: "1705000849.1377555541",
4640
+ alert_name: "Executable file dropped in Users\\Public folder",
4641
+ alert_level: 12,
4642
+ rule_id: "92207",
4643
+ asset_name: "ANSYDWDC01",
4644
+ asset_ip: "139.180.134.102",
4645
+ asset_type: 9,
4646
+ process_id: "3608",
4647
+ rule_mitre_id: "T1105",
4648
+ rule_mitre_tactic: "Command and Control",
4649
+ rule_mitre_technique: "Ingress Tool Transfer"
4650
+ },
4651
+ owner: {
4652
+ user_login: "administrator",
4653
+ user_email: "administrator@localhost",
4654
+ user_name: "administrator",
4655
+ id: 1
4656
+ },
4657
+ alert_source_ref: null,
4658
+ alert_tags: null,
4659
+ classification: null,
4660
+ severity: {
4661
+ severity_name: "High",
4662
+ severity_description: "High",
4663
+ severity_id: 5
4664
+ },
4665
+ alert_source_link:
4666
+ "test.com/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22process_id:%5C%223608%5C%22%20AND%20agent_name:%5C%22ANSYDWDC01%5C%22%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D",
4667
+ iocs: [],
4668
+ alert_note: null,
4669
+ alert_source: "SOCFORTRESS RULE",
4670
+ modification_history: {
4671
+ "1705097539.778607": {
4672
+ user: "administrator",
4673
+ user_id: 1,
4674
+ action: "Alert created"
4675
+ },
4676
+ "1705097539.82934": {
4677
+ user: "administrator",
4678
+ user_id: 1,
4679
+ action: "updated alert: \"assets\" from \"[]\" to \"[{'asset_name': 'ANSYDWDC01', 'asset_ip': '139.180.134.102', 'asset_description': 'Microsoft Windows Server 2016 Standard', 'asset_type_id': 9, 'asset_tags': 'agent_id:102'}]\""
4680
+ }
4681
+ },
4682
+ status: {
4683
+ status_description: "Alert is assigned to a user and pending investigation",
4684
+ status_id: 3,
4685
+ status_name: "Assigned"
4686
+ },
4687
+ cases: [],
4688
+ alert_description: "Executable file dropped in Users\\Public folder",
4689
+ customer: {
4690
+ customer_id: 44,
4691
+ customer_sla: null,
4692
+ customer_name: "test_praeco",
4693
+ customer_description: null,
4694
+ creation_date: "2024-01-11T01:46:06.947860",
4695
+ custom_attributes: {},
4696
+ last_update_date: "2024-01-11T01:46:06.947860",
4697
+ client_uuid: "d6d42317-f29d-4637-bfdf-31816e08d587"
4698
+ },
4699
+ alert_id: 7359,
4700
+ resolution_status: null
4701
+ },
4702
+ {
4703
+ alert_owner_id: 1,
4704
+ alert_uuid: "3d87b37e-6d39-4ed5-8542-c020e66a2b73",
4705
+ alert_creation_time: "2024-01-13T17:59:19.773805",
4706
+ comments: [],
4707
+ assets: [
4708
+ {
4709
+ asset_name: "ANSYDWDC01",
4710
+ asset_description: "Microsoft Windows Server 2016 Standard",
4711
+ asset_type: {
4712
+ asset_id: 9,
4713
+ asset_icon_compromised: "ioc_windows_desktop.png",
4714
+ asset_name: "Windows - Computer",
4715
+ asset_icon_not_compromised: "windows_desktop.png",
4716
+ asset_description: "Standard Windows Computer"
4717
+ },
4718
+ custom_attributes: null,
4719
+ asset_tags: "agent_id:102",
4720
+ asset_compromise_status_id: null,
4721
+ date_update: null,
4722
+ asset_enrichment: null,
4723
+ case_id: null,
4724
+ user_id: null,
4725
+ asset_type_id: 9,
4726
+ asset_id: 12512,
4727
+ asset_ip: "139.180.134.102",
4728
+ asset_domain: null,
4729
+ asset_uuid: "289ac9d8-5026-4f52-ac62-6b56f33194ba",
4730
+ analysis_status_id: null,
4731
+ asset_info: null,
4732
+ date_added: null
4733
+ }
4734
+ ],
4735
+ alert_classification_id: null,
4736
+ alert_status_id: 3,
4737
+ alert_severity_id: 5,
4738
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
4739
+ alert_source_content: {
4740
+ index: "wazuh_00002_268",
4741
+ id: "1705000849.1377555541",
4742
+ agent_name: "ANSYDWDC01",
4743
+ agent_ip: "139.180.134.102",
4744
+ agent_id: "102",
4745
+ agent_labels_customer: "00002",
4746
+ rule_id: "92207",
4747
+ rule_level: 12,
4748
+ rule_description: "Executable file dropped in Users\\Public folder",
4749
+ timestamp: "2024-01-11 19:20:52.106",
4750
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
4751
+ time_field: "2024-01-11T19:20:48.181Z",
4752
+ asset_type_id: 9,
4753
+ gl2_source_input: "6459151dea00fd5d3da2df91",
4754
+ data_win_system_level: "4",
4755
+ data_win_system_processID: "2144",
4756
+ rule_mitre_technique: "Ingress Tool Transfer",
4757
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
4758
+ rule_group1: "sysmon",
4759
+ rule_mail: true,
4760
+ decoder_name: "windows_eventchannel",
4761
+ syslog_level: "ALERT",
4762
+ data_win_system_threadID: "3140",
4763
+ data_win_system_eventRecordID: "18951669",
4764
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
4765
+ data_win_eventdata_processId: "3608",
4766
+ streams: [
4767
+ "658d6cec5e9a2d550c8354c1",
4768
+ "659f47da5e9a2d550cac9a40",
4769
+ "659f485b5e9a2d550cac9b85",
4770
+ "645a3a6123e5cc30bbc0e5dc",
4771
+ "658d6d435e9a2d550c83558a"
4772
+ ],
4773
+ gl2_remote_ip: "10.255.255.13",
4774
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
4775
+ agent_ip_geolocation: "1.3078,103.6818",
4776
+ message:
4777
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
4778
+ true: 1705000849.314127,
4779
+ rule_firedtimes: 1,
4780
+ data_win_eventdata_image:
4781
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
4782
+ source_reserved_ip: true,
4783
+ agent_ip_city_name: "Singapore",
4784
+ num_hits: 1,
4785
+ manager_name: "ASHWZHMA",
4786
+ agent_ip_country_code: "SG",
4787
+ syslog_type: "wazuh",
4788
+ data_win_system_eventID: "11",
4789
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
4790
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
4791
+ gl2_accounted_message_size: 4116,
4792
+ data_win_system_message:
4793
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
4794
+ process_id: "3608",
4795
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
4796
+ rule_group3: "windows",
4797
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
4798
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
4799
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
4800
+ num_matches: 1,
4801
+ source: "10.255.255.13",
4802
+ data_win_system_keywords: "0x8000000000000000",
4803
+ gl2_processing_error:
4804
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
4805
+ data_win_system_task: "11",
4806
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
4807
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
4808
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
4809
+ rule_mitre_id: "T1105",
4810
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
4811
+ rule_group2: "sysmon_eid11_detections",
4812
+ rule_mitre_tactic: "Command and Control",
4813
+ location: "EventChannel",
4814
+ gl2_remote_port: 58986,
4815
+ data_win_eventdata_user: "NT AUTHORITY\\\\SYSTEM",
4816
+ data_win_system_opcode: "0",
4817
+ data_win_system_severityValue: "INFORMATION",
4818
+ data_win_system_version: "2"
4819
+ },
4820
+ alert_title: "Executable file dropped in Users\\Public folder",
4821
+ alert_customer_id: 44,
4822
+ alert_resolution_status_id: null,
4823
+ alert_context: {
4824
+ customer_iris_id: 44,
4825
+ customer_name: "test_praeco",
4826
+ customer_cases_index: "dfir_iris_test_praeco",
4827
+ alert_id: "1705000849.1377555541",
4828
+ alert_name: "Executable file dropped in Users\\Public folder",
4829
+ alert_level: 12,
4830
+ rule_id: "92207",
4831
+ asset_name: "ANSYDWDC01",
4832
+ asset_ip: "139.180.134.102",
4833
+ asset_type: 9,
4834
+ process_id: "3608",
4835
+ rule_mitre_id: "T1105",
4836
+ rule_mitre_tactic: "Command and Control",
4837
+ rule_mitre_technique: "Ingress Tool Transfer"
4838
+ },
4839
+ owner: {
4840
+ user_login: "administrator",
4841
+ user_email: "administrator@localhost",
4842
+ user_name: "administrator",
4843
+ id: 1
4844
+ },
4845
+ alert_source_ref: null,
4846
+ alert_tags: null,
4847
+ classification: null,
4848
+ severity: {
4849
+ severity_name: "High",
4850
+ severity_description: "High",
4851
+ severity_id: 5
4852
+ },
4853
+ alert_source_link:
4854
+ "test.com/explore?left=%5B%22now-6h%22,%22now%22,%22WAZUH%22,%7B%22refId%22:%22A%22,%22query%22:%22process_id:%5C%223608%5C%22%20AND%20agent_name:%5C%22ANSYDWDC01%5C%22%22,%22alias%22:%22%22,%22metrics%22:%5B%7B%22id%22:%221%22,%22type%22:%22logs%22,%22settings%22:%7B%22limit%22:%22500%22%7D%7D%5D,%22bucketAggs%22:%5B%5D,%22timeField%22:%22timestamp%22%7D%5D",
4855
+ iocs: [],
4856
+ alert_note: null,
4857
+ alert_source: "SOCFORTRESS RULE",
4858
+ modification_history: {
4859
+ "1705168759.779238": {
4860
+ user: "administrator",
4861
+ user_id: 1,
4862
+ action: "Alert created"
4863
+ },
4864
+ "1705168759.835745": {
4865
+ user: "administrator",
4866
+ user_id: 1,
4867
+ action: "updated alert: \"assets\" from \"[]\" to \"[{'asset_name': 'ANSYDWDC01', 'asset_ip': '139.180.134.102', 'asset_description': 'Microsoft Windows Server 2016 Standard', 'asset_type_id': 9, 'asset_tags': 'agent_id:102'}]\""
4868
+ }
4869
+ },
4870
+ status: {
4871
+ status_description: "Alert is assigned to a user and pending investigation",
4872
+ status_id: 3,
4873
+ status_name: "Assigned"
4874
+ },
4875
+ cases: [],
4876
+ alert_description: "Executable file dropped in Users\\Public folder",
4877
+ customer: {
4878
+ customer_id: 44,
4879
+ customer_sla: null,
4880
+ customer_name: "test_praeco",
4881
+ customer_description: null,
4882
+ creation_date: "2024-01-11T01:46:06.947860",
4883
+ custom_attributes: {},
4884
+ last_update_date: "2024-01-11T01:46:06.947860",
4885
+ client_uuid: "d6d42317-f29d-4637-bfdf-31816e08d587"
4886
+ },
4887
+ alert_id: 12107,
4888
+ resolution_status: null
4889
+ },
4890
+ {
4891
+ alert_owner_id: 1,
4892
+ alert_uuid: "267927f9-4f2e-4eac-b5f0-019625908f72",
4893
+ alert_creation_time: "2024-01-13T17:20:19.768463",
4894
+ comments: [],
4895
+ assets: [
4896
+ {
4897
+ asset_name: "ANSYDWDC01",
4898
+ asset_description: "Microsoft Windows Server 2016 Standard",
4899
+ asset_type: {
4900
+ asset_id: 9,
4901
+ asset_icon_compromised: "ioc_windows_desktop.png",
4902
+ asset_name: "Windows - Computer",
4903
+ asset_icon_not_compromised: "windows_desktop.png",
4904
+ asset_description: "Standard Windows Computer"
4905
+ },
4906
+ custom_attributes: null,
4907
+ asset_tags: "agent_id:102",
4908
+ asset_compromise_status_id: null,
4909
+ date_update: null,
4910
+ asset_enrichment: null,
4911
+ case_id: null,
4912
+ user_id: null,
4913
+ asset_type_id: 9,
4914
+ asset_id: 12356,
4915
+ asset_ip: "139.180.134.102",
4916
+ asset_domain: null,
4917
+ asset_uuid: "c60ed7b4-0a0f-4775-a0b1-f7191880d543",
4918
+ analysis_status_id: null,
4919
+ asset_info: null,
4920
+ date_added: null
4921
+ }
4922
+ ],
4923
+ alert_classification_id: null,
4924
+ alert_status_id: 3,
4925
+ alert_severity_id: 5,
4926
+ alert_source_event_time: "2024-01-11T19:20:48.181000",
4927
+ alert_source_content: {
4928
+ index: "wazuh_00002_268",
4929
+ id: "1705000849.1377555541",
4930
+ agent_name: "ANSYDWDC01",
4931
+ agent_ip: "139.180.134.102",
4932
+ agent_id: "102",
4933
+ agent_labels_customer: "00002",
4934
+ rule_id: "92207",
4935
+ rule_level: 12,
4936
+ rule_description: "Executable file dropped in Users\\Public folder",
4937
+ timestamp: "2024-01-11 19:20:52.106",
4938
+ timestamp_utc: "2024-01-11T19:20:48.181Z",
4939
+ time_field: "2024-01-11T19:20:48.181Z",
4940
+ asset_type_id: 9,
4941
+ gl2_source_input: "6459151dea00fd5d3da2df91",
4942
+ data_win_system_level: "4",
4943
+ data_win_system_processID: "2144",
4944
+ rule_mitre_technique: "Ingress Tool Transfer",
4945
+ rule_groups: "sysmon, sysmon_eid11_detections, windows",
4946
+ rule_group1: "sysmon",
4947
+ rule_mail: true,
4948
+ decoder_name: "windows_eventchannel",
4949
+ syslog_level: "ALERT",
4950
+ data_win_system_threadID: "3140",
4951
+ data_win_system_eventRecordID: "18951669",
4952
+ gl2_source_node: "809d9894-1865-4ac7-8204-3226c347cb38",
4953
+ data_win_eventdata_processId: "3608",
4954
+ streams: [
4955
+ "658d6cec5e9a2d550c8354c1",
4956
+ "659f47da5e9a2d550cac9a40",
4957
+ "659f485b5e9a2d550cac9b85",
4958
+ "645a3a6123e5cc30bbc0e5dc",
4959
+ "658d6d435e9a2d550c83558a"
4960
+ ],
4961
+ gl2_remote_ip: "10.255.255.13",
4962
+ data_win_eventdata_creationUtcTime: "2021-07-16 04:42:21.204",
4963
+ agent_ip_geolocation: "1.3078,103.6818",
4964
+ message:
4965
+ '{"true":1705000849.314127,"timestamp":"2024-01-11T19:20:49.298+0000","rule":{"level":12,"description":"Executable file dropped in Users\\\\Public folder","id":"92207","mitre":{"id":["T1105"],"tactic":["Command and Control"],"technique":["Ingress Tool Transfer"]},"firedtimes":1,"mail":true,"groups":["sysmon","sysmon_eid11_detections","windows"]},"agent":{"id":"102","name":"ANSYDWDC01","ip":"139.180.134.102","labels":{"customer":"00002"}},"manager":{"name":"ASHWZHMA"},"id":"1705000849.1377555541","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Microsoft-Windows-Sysmon","providerGuid":"{5770385F-C22A-43E0-BF4C-06F5698FFBD9}","eventID":"11","version":"2","level":"4","task":"11","opcode":"0","keywords":"0x8000000000000000","systemTime":"2024-01-11T19:20:48.181234300Z","eventRecordID":"18951669","processID":"2144","threadID":"3140","channel":"Microsoft-Windows-Sysmon/Operational","computer":"ANSYDWDC01.ANMS.LOCAL","severityValue":"INFORMATION","message":"\\"File created:\\r\\nRuleName: -\\r\\nUtcTime: 2024-01-11 19:20:48.176\\r\\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\\r\\nProcessId: 3608\\r\\nImage: C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe\\r\\nTargetFilename: C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk\\r\\nCreationUtcTime: 2021-07-16 04:42:21.204\\r\\nUser: NT AUTHORITY\\\\SYSTEM\\""},"eventdata":{"utcTime":"2024-01-11 19:20:48.176","processGuid":"{6D0AAEFA-3F8F-65A0-4096-030000004300}","processId":"3608","image":"C:\\\\\\\\Program Files (x86)\\\\\\\\Google\\\\\\\\Update\\\\\\\\Install\\\\\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\\\\\CR_70200.tmp\\\\\\\\setup.exe","targetFilename":"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Desktop\\\\\\\\Google Chrome.lnk","creationUtcTime":"2021-07-16 04:42:21.204","user":"NT AUTHORITY\\\\\\\\SYSTEM"}}},"location":"EventChannel"}',
4966
+ true: 1705000849.314127,
4967
+ rule_firedtimes: 1,
4968
+ data_win_eventdata_image:
4969
+ "C:\\\\Program Files (x86)\\\\Google\\\\Update\\\\Install\\\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\\\CR_70200.tmp\\\\setup.exe",
4970
+ source_reserved_ip: true,
4971
+ agent_ip_city_name: "Singapore",
4972
+ num_hits: 1,
4973
+ manager_name: "ASHWZHMA",
4974
+ agent_ip_country_code: "SG",
4975
+ syslog_type: "wazuh",
4976
+ data_win_system_eventID: "11",
4977
+ msg_timestamp: "2024-01-11T19:20:49.298Z",
4978
+ data_win_eventdata_processGuid: "{6D0AAEFA-3F8F-65A0-4096-030000004300}",
4979
+ gl2_accounted_message_size: 4116,
4980
+ data_win_system_message:
4981
+ '"File created:\r\nRuleName: -\r\nUtcTime: 2024-01-11 19:20:48.176\r\nProcessGuid: {6D0AAEFA-3F8F-65A0-4096-030000004300}\r\nProcessId: 3608\r\nImage: C:\\Program Files (x86)\\Google\\Update\\Install\\{8AAA94DD-11AC-456C-96E1-FEBFF57B0317}\\CR_70200.tmp\\setup.exe\r\nTargetFilename: C:\\Users\\Public\\Desktop\\Google Chrome.lnk\r\nCreationUtcTime: 2021-07-16 04:42:21.204\r\nUser: NT AUTHORITY\\SYSTEM"',
4982
+ process_id: "3608",
4983
+ data_win_eventdata_targetFilename: "C:\\\\Users\\\\Public\\\\Desktop\\\\Google Chrome.lnk",
4984
+ rule_group3: "windows",
4985
+ data_win_system_computer: "ANSYDWDC01.ANMS.LOCAL",
4986
+ data_win_system_channel: "Microsoft-Windows-Sysmon/Operational",
4987
+ data_win_system_providerGuid: "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}",
4988
+ num_matches: 1,
4989
+ source: "10.255.255.13",
4990
+ data_win_system_keywords: "0x8000000000000000",
4991
+ gl2_processing_error:
4992
+ 'Replaced invalid timestamp value in message <88d1c795-b0b6-11ee-93bc-86000046278a> with current time - Value <2024-01-11T19:20:49.298+0000> caused exception: Invalid format: "2024-01-11T19:20:49.298+0000" is malformed at "T19:20:49.298+0000".',
4993
+ data_win_system_task: "11",
4994
+ data_win_system_systemTime: "2024-01-11T19:20:48.181234300Z",
4995
+ gl2_message_id: "01HKWZGPMA0ZVXB7VMFF157JPN",
4996
+ data_win_eventdata_utcTime: "2024-01-11 19:20:48.176",
4997
+ rule_mitre_id: "T1105",
4998
+ data_win_system_providerName: "Microsoft-Windows-Sysmon",
4999
+ rule_group2: "sysmon_eid11_detections",
This file is too large to show in full.
src/components/soc/SocCases/SocCaseItem.vue
+2
-2
@@ -385,7 +385,7 @@ function setReopened() {
385
}
386
387
function deleteCase() {
388
- loadingDetails.value = true
388
+ loadingDelete.value = false
389
emit("deleted")
390
}
391
@@ -492,7 +492,7 @@ onBeforeMount(() => {
492
493
&:not(.embedded) {
494
&:hover {
495
- box-shadow: 0px 0px 0px 1px inset var(--primary-color);
495
+ border-color: var(--primary-color);
496
}
497
}
498
src/components/soc/SocCases/SocCaseItemActions.vue
+2
-3
@@ -26,8 +26,7 @@
26
import { NButton, useDialog, useMessage } from "naive-ui"
27
import Icon from "@/components/common/Icon.vue"
28
import Api from "@/api"
29
-import { computed, h, ref } from "vue"
30
-import { watch } from "vue"
29
+import { computed, watch, ref } from "vue"
30
import { StateName, type SocCase, type SocCaseExt } from "@/types/soc/case.d"
31
32
const emit = defineEmits<{
@@ -131,7 +130,6 @@ function deleteCase() {
130
.deleteCase(caseData.case_id.toString())
131
.then(res => {
132
if (res.data.success) {
134
- emit("deleted")
133
message.success(res.data?.message || "SOC Case deleted.")
134
} else {
135
message.warning(res.data?.message || "An error occurred. Please try again later.")
@@ -141,6 +139,7 @@ function deleteCase() {
139
message.error(err.response?.data?.message || "An error occurred. Please try again later.")
140
})
141
.finally(() => {
142
+ emit("deleted")
143
loadingCaseDelete.value = false
144
})
145
}