1
+import type { MitreEventDetails, MitreTechniqueDetails } from "@/types/mitre.d"
2
+
3
+export const techniques = [
4
+ {
5
+ technique_id: "T1071",
6
+ technique_name: "Application Layer Protocol",
7
+ count: 99423,
8
+ last_seen: "2025-05-09T16:02:20.205496Z",
9
+ tactics: [
10
+ {
11
+ id: "x-mitre-tactic--f72804c5-f15a-449e-a5da-2eecd181f813",
12
+ name: "Command and Control",
13
+ short_name: "command-and-control"
14
+ }
15
+ ]
16
+ },
17
+ {
18
+ technique_id: "T1565.001",
19
+ technique_name: "Stored Data Manipulation",
20
+ count: 47,
21
+ last_seen: "2025-05-09T16:02:20.205614Z",
22
+ tactics: [
23
+ {
24
+ id: "x-mitre-tactic--5569339b-94c2-49ee-afb3-2222936582c8",
25
+ name: "Impact",
26
+ short_name: "impact"
27
+ }
28
+ ]
29
+ },
30
+ {
31
+ technique_id: "T1560",
32
+ technique_name: "Archive Collected Data",
33
+ count: 25,
34
+ last_seen: "2025-05-09T16:02:20.205925Z",
35
+ tactics: [
36
+ {
37
+ id: "x-mitre-tactic--d108ce10-2419-4cf9-a774-46161d6c6cfe",
38
+ name: "Collection",
39
+ short_name: "collection"
40
+ }
41
+ ]
42
+ },
43
+ {
44
+ technique_id: "T1078",
45
+ technique_name: "Valid Accounts",
46
+ count: 16,
47
+ last_seen: "2025-05-09T16:02:20.206013Z",
48
+ tactics: [
49
+ {
50
+ id: "x-mitre-tactic--5bc1d813-693e-4823-9961-abf9af4b0e92",
51
+ name: "Persistence",
52
+ short_name: "persistence"
53
+ },
54
+ {
55
+ id: "x-mitre-tactic--5e29b093-294e-49e9-a803-dab3d73b77dd",
56
+ name: "Privilege Escalation",
57
+ short_name: "privilege-escalation"
58
+ },
59
+ {
60
+ id: "x-mitre-tactic--78b23412-0651-46d7-a540-170a1ce8bd5a",
61
+ name: "Defense Evasion",
62
+ short_name: "defense-evasion"
63
+ },
64
+ {
65
+ id: "x-mitre-tactic--ffd5bcee-6e16-4dd2-8eca-7b3beedf33ca",
66
+ name: "Initial Access",
67
+ short_name: "initial-access"
68
+ }
69
+ ]
70
+ },
71
+ {
72
+ technique_id: "T1222",
73
+ technique_name: "File and Directory Permissions Modification",
74
+ count: 10,
75
+ last_seen: "2025-05-09T16:02:20.206062Z",
76
+ tactics: [
77
+ {
78
+ id: "x-mitre-tactic--78b23412-0651-46d7-a540-170a1ce8bd5a",
79
+ name: "Defense Evasion",
80
+ short_name: "defense-evasion"
81
+ }
82
+ ]
83
+ },
84
+ {
85
+ technique_id: "T1543",
86
+ technique_name: "Create or Modify System Process",
87
+ count: 9,
88
+ last_seen: "2025-05-09T16:02:20.206100Z",
89
+ tactics: [
90
+ {
91
+ id: "x-mitre-tactic--5bc1d813-693e-4823-9961-abf9af4b0e92",
92
+ name: "Persistence",
93
+ short_name: "persistence"
94
+ },
95
+ {
96
+ id: "x-mitre-tactic--5e29b093-294e-49e9-a803-dab3d73b77dd",
97
+ name: "Privilege Escalation",
98
+ short_name: "privilege-escalation"
99
+ }
100
+ ]
101
+ },
102
+ {
103
+ technique_id: "T1078",
104
+ technique_name: "Valid Accounts, Remote Services",
105
+ count: 2,
106
+ last_seen: "2025-05-09T16:02:20.206137Z",
107
+ tactics: [
108
+ {
109
+ id: "x-mitre-tactic--5bc1d813-693e-4823-9961-abf9af4b0e92",
110
+ name: "Persistence",
111
+ short_name: "persistence"
112
+ },
113
+ {
114
+ id: "x-mitre-tactic--5e29b093-294e-49e9-a803-dab3d73b77dd",
115
+ name: "Privilege Escalation",
116
+ short_name: "privilege-escalation"
117
+ },
118
+ {
119
+ id: "x-mitre-tactic--78b23412-0651-46d7-a540-170a1ce8bd5a",
120
+ name: "Defense Evasion",
121
+ short_name: "defense-evasion"
122
+ },
123
+ {
124
+ id: "x-mitre-tactic--ffd5bcee-6e16-4dd2-8eca-7b3beedf33ca",
125
+ name: "Initial Access",
126
+ short_name: "initial-access"
127
+ }
128
+ ]
129
+ },
130
+ {
131
+ technique_id: "T1021",
132
+ technique_name: "Valid Accounts, Remote Services",
133
+ count: 2,
134
+ last_seen: "2025-05-09T16:02:20.206170Z",
135
+ tactics: [
136
+ {
137
+ id: "x-mitre-tactic--7141578b-e50b-4dcc-bfa4-08a8dd689e9e",
138
+ name: "Lateral Movement",
139
+ short_name: "lateral-movement"
140
+ }
141
+ ]
142
+ },
143
+ {
144
+ technique_id: "T1110.001",
145
+ technique_name: "Password Guessing",
146
+ count: 2,
147
+ last_seen: "2025-05-09T16:02:20.206205Z",
148
+ tactics: [
149
+ {
150
+ id: "x-mitre-tactic--2558fd61-8c75-4730-94c4-11926db2a263",
151
+ name: "Credential Access",
152
+ short_name: "credential-access"
153
+ }
154
+ ]
155
+ },
156
+ {
157
+ technique_id: "T1562.001",
158
+ technique_name: "Disable or Modify Tools",
159
+ count: 2,
160
+ last_seen: "2025-05-09T16:02:20.206239Z",
161
+ tactics: [
162
+ {
163
+ id: "x-mitre-tactic--78b23412-0651-46d7-a540-170a1ce8bd5a",
164
+ name: "Defense Evasion",
165
+ short_name: "defense-evasion"
166
+ }
167
+ ]
168
+ },
169
+ {
170
+ technique_id: "T1046",
171
+ technique_name: "Network Service Discovery",
172
+ count: 1,
173
+ last_seen: "2025-05-09T16:02:20.206271Z",
174
+ tactics: [
175
+ {
176
+ id: "x-mitre-tactic--c17c5845-175e-4421-9713-829d0573dbc9",
177
+ name: "Discovery",
178
+ short_name: "discovery"
179
+ }
180
+ ]
181
+ },
182
+ {
183
+ technique_id: "T104X",
184
+ technique_name: "Network Service Discovery",
185
+ count: 0,
186
+ last_seen: "2025-05-09T16:02:20.206271Z",
187
+ tactics: [
188
+ {
189
+ id: "x-mitre-tactic--c17c5845-175e-4421-9713-829d0573dbc9",
190
+ name: "Discovery",
191
+ short_name: "discovery"
192
+ }
193
+ ]
194
+ },
195
+ {
196
+ technique_id: "T1548.003",
197
+ technique_name: "Sudo and Sudo Caching",
198
+ count: 1,
199
+ last_seen: "2025-05-09T16:02:20.206307Z",
200
+ tactics: [
201
+ {
202
+ id: "x-mitre-tactic--5e29b093-294e-49e9-a803-dab3d73b77dd",
203
+ name: "Privilege Escalation",
204
+ short_name: "privilege-escalation"
205
+ },
206
+ {
207
+ id: "x-mitre-tactic--78b23412-0651-46d7-a540-170a1ce8bd5a",
208
+ name: "Defense Evasion",
209
+ short_name: "defense-evasion"
210
+ }
211
+ ]
212
+ }
213
+]
214
+
215
+export const techniqueResultDetails: MitreTechniqueDetails = {
216
+ description:
217
+ "Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.(Citation: volexity_0day_sophos_FW) Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.\n\nIn some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account.(Citation: CISA MFA PrintNightmare)\n\nThe overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.(Citation: TechNet Credential Theft)",
218
+ name: "Valid Accounts",
219
+ id: "attack-pattern--b17a1a56-e99c-403c-8948-561df0cffe81",
220
+ modified_time: new Date("2023-03-30T21:01:51.631000Z"),
221
+ created_time: new Date("2017-05-31T21:31:00.645000Z"),
222
+ tactics: [
223
+ "x-mitre-tactic--5bc1d813-693e-4823-9961-abf9af4b0e92",
224
+ "x-mitre-tactic--5e29b093-294e-49e9-a803-dab3d73b77dd",
225
+ "x-mitre-tactic--78b23412-0651-46d7-a540-170a1ce8bd5a",
226
+ "x-mitre-tactic--ffd5bcee-6e16-4dd2-8eca-7b3beedf33ca"
227
+ ],
228
+ url: "https://attack.mitre.org/techniques/T1078",
229
+ source: "mitre-attack",
230
+ external_id: "T1078",
231
+ references: [
232
+ {
233
+ url: "https://www.cisa.gov/uscert/ncas/alerts/aa22-074a",
234
+ description:
235
+ "Cybersecurity and Infrastructure Security Agency. (2022, March 15). Russian State-Sponsored Cyber Actors Gain Network Access by Exploiting Default Multifactor Authentication Protocols and “PrintNightmare” Vulnerability. Retrieved March 16, 2022.",
236
+ source: "CISA MFA PrintNightmare"
237
+ },
238
+ {
239
+ url: "https://technet.microsoft.com/en-us/library/dn487457.aspx",
240
+ description: "Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved June 3, 2016.",
241
+ source: "TechNet Audit Policy"
242
+ },
243
+ {
244
+ url: "https://technet.microsoft.com/en-us/library/dn535501.aspx",
245
+ description:
246
+ "Microsoft. (2016, April 15). Attractive Accounts for Credential Theft. Retrieved June 3, 2016.",
247
+ source: "TechNet Credential Theft"
248
+ },
249
+ {
250
+ url: "https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/",
251
+ description:
252
+ "Adair, S., Lancaster, T., Volexity Threat Research. (2022, June 15). DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach. Retrieved July 1, 2022.",
253
+ source: "volexity_0day_sophos_FW"
254
+ }
255
+ ],
256
+ mitigations: [
257
+ "course-of-action--25dc1ce8-eb55-4333-ae30-a7cb4f5894a1",
258
+ "course-of-action--2a4f6c11-a4a7-4cb9-b0ef-6ae1bb3a718a",
259
+ "course-of-action--90c218c3-fbf8-4830-98a7-e8cfb7eaa485",
260
+ "course-of-action--93e7968a-9074-4eac-8ae9-9f5200ec3317",
261
+ "course-of-action--9bb9e696-bff8-4ae1-9454-961fc7d91d5f",
262
+ "course-of-action--e3388c78-2a8d-47c2-8422-c1398b324462",
263
+ "course-of-action--f9f9e6ef-bc0a-41ad-ba11-0924e5e84c4c"
264
+ ],
265
+ subtechnique_of: null,
266
+ techniques: null,
267
+ groups: [
268
+ "intrusion-set--06a11b7e-2a36-47fe-8d3e-82c265df3258",
269
+ "intrusion-set--18854f55-ac7c-4634-bd9a-352dd07613b7",
270
+ "intrusion-set--1c63d4ec-0a75-4daa-b1df-0d11af3d3cc1",
271
+ "intrusion-set--222fbd21-fc4f-4b7e-9f85-0e6e3a76c33f",
272
+ "intrusion-set--2a7914cf-dff3-428d-ab0f-1014d1c28aeb",
273
+ "intrusion-set--3753cc21-2dae-4dfb-8481-d004e74502cc",
274
+ "intrusion-set--381fcf73-60f6-4ab2-9991-6af3cbc35192",
275
+ "intrusion-set--38fd6a28-3353-4f2b-bb2b-459fecd5c648",
276
+ "intrusion-set--44e43fad-ffcb-4210-abcf-eaaed9735f80",
277
+ "intrusion-set--4ca1929c-7d64-4aab-b849-badbfc0c760d",
278
+ "intrusion-set--55033a4d-3ffe-46b2-99b4-2c1541e9ce1c",
279
+ "intrusion-set--5cbe0d3b-6fb1-471f-b591-4b192915116d",
280
+ "intrusion-set--5f3d0238-d058-44a9-8812-3dd1b6741a8c",
281
+ "intrusion-set--6713ab67-e25b-49cc-808d-2b36d4fbc35c",
282
+ "intrusion-set--7113eaa5-ba79-4fb3-b68a-398ee9cd698e",
283
+ "intrusion-set--85403903-15e0-4f9f-9be4-a259ecad4022",
284
+ "intrusion-set--899ce53f-13a0-479b-a0e4-67d46e241542",
285
+ "intrusion-set--8c1f0187-0826-4320-bddc-5f326cfcfe2c",
286
+ "intrusion-set--90784c1e-4aba-40eb-9adf-7556235e6384",
287
+ "intrusion-set--9538b1a4-4120-4e2d-bf59-3b11fcab05a4",
288
+ "intrusion-set--a0cb9370-e39b-44d5-9f50-ef78e412b973",
289
+ "intrusion-set--bef4c620-0787-42a8-a96d-b7eb6e85917c",
290
+ "intrusion-set--c21dd6f1-1364-4a70-a1f7-783080ec34ee",
291
+ "intrusion-set--c93fccb1-e8e8-42cf-ae33-2ad1d183913a",
292
+ "intrusion-set--d0b3393b-3bec-4ba3-bda9-199d30db47b6",
293
+ "intrusion-set--d13c8a7f-740b-4efa-a232-de7d6bb05321",
294
+ "intrusion-set--d8bc9788-4f7d-41a9-9e9d-ee1ea18a8cf7",
295
+ "intrusion-set--dd2d9ca6-505b-4860-a604-233685b802c7",
296
+ "intrusion-set--fb366179-766c-4a4a-afa1-52bff1fd601c",
297
+ "intrusion-set--fbd29c89-18ba-4c2d-b792-51c0adee049f",
298
+ "intrusion-set--fbe9387f-34e6-4828-ac28-3080020c597b",
299
+ "intrusion-set--fd19bd82-1b14-49a1-a176-6cdc46b8a826",
300
+ "intrusion-set--fe98767f-9df8-42b9-83c9-004b1dec8647"
301
+ ],
302
+ software: [
303
+ "malware--0efefea5-78da-4022-92bc-d726139e8883",
304
+ "malware--67e6d66b-1b82-4699-b47a-e2efb6268d14",
305
+ "malware--68dca94f-c11d-421e-9287-7c501108e18c",
306
+ "malware--d6e55656-e43f-411f-a7af-45df650471c5",
307
+ "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
308
+ "malware--f8774023-8021-4ece-9aca-383ac89d2759"
309
+ ],
310
+ mitre_detection:
311
+ "Configure robust, consistent account activity audit policies across the enterprise and with externally accessible services.(Citation: TechNet Audit Policy) Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access).\n\nPerform regular audits of domain and local system accounts to detect accounts that may have been created by an adversary for persistence. Checks on these accounts could also include whether default accounts such as Guest have been activated. These audits should also include checks on any appliances and applications for default credentials or SSH keys, and if any are discovered, they should be updated immediately.",
312
+ mitre_version: "2.6",
313
+ deprecated: 1,
314
+ remote_support: 1,
315
+ network_requirements: 1,
316
+ platforms: ["macos", "linux"],
317
+ data_sources: [],
318
+ is_subtechnique: true
319
+}
320
+
321
+export const techniqueAlertsResponse = {
322
+ success: true,
323
+ message: "Found 16941 alerts for MITRE technique T1071 (page 1 of 678)",
324
+ technique_id: "T1071",
325
+ technique_name: "Unknown Technique",
326
+ total_alerts: 16941,
327
+ alerts: [
328
+ {
329
+ data_source_ip: "192.168.100.1",
330
+ data_host_architecture: "x86_64",
331
+ agent_id: "032",
332
+ agent_name: "piHole",
333
+ gl2_remote_ip: "10.255.255.13",
334
+ data_resource: "configuration.apple.com.akadns.net",
335
+ agent_labels_customer: "00001",
336
+ data_ecs_version: "8.0.0",
337
+ timestamp_utc: "2025-05-23T20:24:39.281Z",
338
+ data_host_os_codename: "bullseye",
339
+ syslog_type: "wazuh",
340
+ gl2_source_node: "3b68efa4-3319-4885-a38f-c944f0fcf191",
341
+ id: "1748031882.83790627",
342
+ data_server_port: "53",
343
+ data_dns_question_etld_plus_one: "akadns.net",
344
+ rule_mitre_tactic: "Command and Control",
345
+ gl2_accounted_message_size: 6790,
346
+ data_agent_type: "packetbeat",
347
+ streams: ["660320f176ca320e8393f057"],
348
+ rule_mitre_id: "T1071",
349
+ data_destination_bytes: "161",
350
+ data_event_dataset: "dns",
351
+ "data_@metadata_beat": "packetbeat",
352
+ agent_ip: "192.168.100.3",
353
+ data_source_port: "56852",
354
+ data_host_id: "8986bcccef884a1ebe34f1ccd31b4f50",
355
+ data_event_kind: "event",
356
+ data_network_protocol: "dns",
357
+ dns_response_code: "NOERROR",
358
+ dns_query: "configuration.apple.com.akadns.net",
359
+ data_dns_response_code: "NOERROR",
360
+ data_network_community_id: "1:c3kBWjBq1Y4lt9NUsnCGWqbsdTo=",
361
+ data_dns_flags_truncated_response: "false",
362
+ rule_mail: false,
363
+ data_dns_opt_udp_size: "1232",
364
+ data_event_category: "network",
365
+ data_dns_flags_recursion_available: "true",
366
+ data_dns_opt_version: "0",
367
+ timestamp: "2025-05-23 20:24:43.696",
368
+ data_host_mac: "00-0C-29-09-D5-9B",
369
+ data_agent_id: "9d8db289-3bc9-40d3-92cb-2bd2d9f9434b",
370
+ data_destination_port: "53",
371
+ data_dns_type: "answer",
372
+ traffic_direction: "ingress",
373
+ rule_id: "200300",
374
+ data_dns_question_class: "IN",
375
+ cluster_node: "ASHWZHMA.socfortress.local",
376
+ dst_port: "53",
377
+ "data_@timestamp": "2025-05-23T20:24:39.281Z",
378
+ data_host_os_platform: "debian",
379
+ data_event_duration: "83329433",
380
+ data_host_name: "piHole",
381
+ data_dns_flags_recursion_desired: "true",
382
+ data_dns_question_subdomain: "configuration.apple.com",
383
+ gl2_remote_port: 39934,
384
+ data_host_os_type: "linux",
385
+ source: "10.255.255.13",
386
+ gl2_source_input: "660320f176ca320e8393f030",
387
+ rule_level: 3,
388
+ data_event_type: "connection, protocol",
389
+ data_host_os_family: "debian",
390
+ data_dns_additionals_count: "0",
391
+ data_dns_flags_authentic_data: "false",
392
+ protocol: "udp",
393
+ data_dns_answers:
394
+ "{data=configuration.apple.com.edgekey.net, name=configuration.apple.com.akadns.net, type=CNAME, class=IN, ttl=300}, {type=CNAME, class=IN, ttl=21600, data=e673.dsce9.akamaiedge.net, name=configuration.apple.com.edgekey.net}, {data=96.7.172.24, name=e673.dsce9.akamaiedge.net, type=A, class=IN, ttl=20}",
395
+ data_agent_ephemeral_id: "f64f34f9-15e3-4717-8349-bc5e342d07c3",
396
+ data_event_start: "2025-05-23T20:24:39.281Z",
397
+ rule_description: "Linux: DNS Query to configuration.apple.com.akadns.net",
398
+ data_agent_version: "8.7.1",
399
+ data_related_ip: "192.168.100.1, 192.168.100.3, 96.7.172.24",
400
+ data_status: "OK",
401
+ data_query: "class IN, type A, configuration.apple.com.akadns.net",
402
+ "data_@metadata_type": "_doc",
403
+ data_method: "QUERY",
404
+ data_server_ip: "192.168.100.3",
405
+ data_dns_question_registered_domain: "akadns.net",
406
+ gl2_message_id: "01JVZD3JDGEMHZEJPMJTDHQP5N",
407
+ data_dns_answers_count: "3",
408
+ data_network_type: "ipv4",
409
+ data_dns_opt_ext_rcode: "NOERROR",
410
+ data_client_port: "56852",
411
+ data_network_bytes: "224",
412
+ data_dns_resolved_ip: "96.7.172.24",
413
+ data_host_containerized: "false",
414
+ true: 1748031882.283551,
415
+ data_host_hostname: "piHole",
416
+ rule_groups: "linux, packetbeat, dns",
417
+ data_client_bytes: "63",
418
+ data_dns_question_type: "A",
419
+ data_host_ip: "192.168.100.3, fe80::20c:29ff:fe09:d59b",
420
+ data_destination_ip: "192.168.100.3",
421
+ rule_mitre_technique: "Application Layer Protocol",
422
+ rule_firedtimes: 295,
423
+ data_network_transport: "udp",
424
+ dst_ip: "192.168.100.3",
425
+ src_ip: "192.168.100.1",
426
+ decoder_name: "json",
427
+ syslog_level: "INFO",
428
+ data_dns_op_code: "QUERY",
429
+ data_host_os_version: "11 (bullseye)",
430
+ data_host_os_kernel: "5.10.0-21-amd64",
431
+ cluster_name: "socfortress",
432
+ data_source_bytes: "63",
433
+ gl2_processing_error:
434
+ 'Replaced invalid timestamp value in message <f5f58dd4-3813-11f0-91aa-8600007a2218> with current time - Value <2025-05-23T20:24:42.282+0000> caused exception: Invalid format: "2025-05-23T20:24:42.282+0000" is malformed at "T20:24:42.282+0000".',
435
+ data_dns_opt_do: "true",
436
+ data_dns_authorities_count: "0",
437
+ data_dns_question_name: "configuration.apple.com.akadns.net",
438
+ message:
439
+ '{"true":1748031882.283551,"timestamp":"2025-05-23T20:24:42.282+0000","rule":{"level":3,"description":"Linux: DNS Query to configuration.apple.com.akadns.net","id":"200300","mitre":{"id":["T1071"],"tactic":["Command and Control"],"technique":["Application Layer Protocol"]},"firedtimes":295,"mail":false,"groups":["linux","packetbeat","dns"]},"agent":{"id":"032","name":"piHole","ip":"192.168.100.3","labels":{"customer":"00001"}},"manager":{"name":"ASHWZHMA"},"id":"1748031882.83790627","cluster":{"name":"socfortress","node":"ASHWZHMA.socfortress.local"},"decoder":{"name":"json"},"data":{"status":"OK","@timestamp":"2025-05-23T20:24:39.281Z","@metadata":{"beat":"packetbeat","type":"_doc","version":"8.7.1"},"resource":"configuration.apple.com.akadns.net","method":"QUERY","server":{"ip":"192.168.100.3","port":"53","bytes":"161"},"ecs":{"version":"8.0.0"},"host":{"architecture":"x86_64","name":"piHole","os":{"codename":"bullseye","type":"linux","platform":"debian","version":"11 (bullseye)","family":"debian","name":"Debian GNU/Linux","kernel":"5.10.0-21-amd64"},"id":"8986bcccef884a1ebe34f1ccd31b4f50","containerized":"false","ip":["192.168.100.3","fe80::20c:29ff:fe09:d59b"],"mac":["00-0C-29-09-D5-9B"],"hostname":"piHole"},"agent":{"name":"piHole","type":"packetbeat","version":"8.7.1","ephemeral_id":"f64f34f9-15e3-4717-8349-bc5e342d07c3","id":"9d8db289-3bc9-40d3-92cb-2bd2d9f9434b"},"event":{"end":"2025-05-23T20:24:39.364Z","kind":"event","category":["network"],"type":["connection","protocol"],"dataset":"dns","duration":"83329433","start":"2025-05-23T20:24:39.281Z"},"type":"dns","destination":{"ip":"192.168.100.3","port":"53","bytes":"161"},"dns":{"id":"29374","resolved_ip":["96.7.172.24"],"additionals_count":"0","type":"answer","opt":{"udp_size":"1232","ext_rcode":"NOERROR","do":"true","version":"0"},"authorities_count":"0","answers_count":"3","op_code":"QUERY","flags":{"checking_disabled":"false","authoritative":"false","truncated_response":"false","recursion_desired":"true","recursion_available":"true","authentic_data":"false"},"response_code":"NOERROR","header_flags":["RD","RA","DO"],"question":{"subdomain":"configuration.apple.com","name":"configuration.apple.com.akadns.net","type":"A","class":"IN","etld_plus_one":"akadns.net","registered_domain":"akadns.net","top_level_domain":"net"},"answers":[{"data":"configuration.apple.com.edgekey.net","name":"configuration.apple.com.akadns.net","type":"CNAME","class":"IN","ttl":"300"},{"type":"CNAME","class":"IN","ttl":"21600","data":"e673.dsce9.akamaiedge.net","name":"configuration.apple.com.edgekey.net"},{"data":"96.7.172.24","name":"e673.dsce9.akamaiedge.net","type":"A","class":"IN","ttl":"20"}]},"query":"class IN, type A, configuration.apple.com.akadns.net","client":{"bytes":"63","ip":"192.168.100.1","port":"56852"},"network":{"type":"ipv4","transport":"udp","protocol":"dns","direction":"ingress","community_id":"1:c3kBWjBq1Y4lt9NUsnCGWqbsdTo=","bytes":"224"},"related":{"ip":["192.168.100.1","192.168.100.3","96.7.172.24"]},"source":{"port":"56852","bytes":"63","ip":"192.168.100.1"}},"location":"/tmp/packetbeat/packetbeat-20250523-90.ndjson"}',
440
+ dns_answer: "96.7.172.24",
441
+ data_dns_id: "29374",
442
+ src_port: "56852",
443
+ manager_name: "ASHWZHMA",
444
+ data_dns_question_top_level_domain: "net",
445
+ data_network_direction: "ingress",
446
+ data_event_end: "2025-05-23T20:24:39.364Z",
447
+ data_agent_name: "piHole",
448
+ data_server_bytes: "161",
449
+ data_dns_flags_authoritative: "false",
450
+ data_client_ip: "192.168.100.1",
451
+ data_type: "dns",
452
+ data_dns_header_flags: "RD, RA, DO",
453
+ data_dns_flags_checking_disabled: "false",
454
+ location: "/tmp/packetbeat/packetbeat-20250523-90.ndjson",
455
+ "data_@metadata_version": "8.7.1",
456
+ data_host_os_name: "Debian GNU/Linux",
457
+ rule_group3: "dns",
458
+ msg_timestamp: "2025-05-23T20:24:42.282Z",
459
+ rule_group2: "packetbeat",
460
+ rule_group1: "linux"
461
+ },
462
+ {
463
+ data_source_ip: "192.168.100.1",
464
+ data_host_architecture: "x86_64",
465
+ agent_id: "032",
466
+ agent_name: "piHole",
467
+ gl2_remote_ip: "10.255.255.13",
468
+ data_resource: "e673.dsce9.akamaiedge.net",
469
+ agent_labels_customer: "00001",
470
+ data_ecs_version: "8.0.0",
471
+ timestamp_utc: "2025-05-23T20:24:39.365Z",
472
+ data_host_os_codename: "bullseye",
473
+ syslog_type: "wazuh",
474
+ gl2_source_node: "3b68efa4-3319-4885-a38f-c944f0fcf191",
475
+ id: "1748031882.83787816",
476
+ data_server_port: "53",
477
+ data_dns_question_etld_plus_one: "akamaiedge.net",
478
+ rule_mitre_tactic: "Command and Control",
479
+ gl2_accounted_message_size: 6217,
480
+ data_agent_type: "packetbeat",
481
+ streams: ["660320f176ca320e8393f057"],
482
+ rule_mitre_id: "T1071",
483
+ data_destination_bytes: "70",
484
+ data_event_dataset: "dns",
485
+ "data_@metadata_beat": "packetbeat",
486
+ agent_ip: "192.168.100.3",
487
+ data_source_port: "6412",
488
+ data_host_id: "8986bcccef884a1ebe34f1ccd31b4f50",
489
+ data_event_kind: "event",
490
+ data_network_protocol: "dns",
491
+ dns_response_code: "NOERROR",
492
+ dns_query: "e673.dsce9.akamaiedge.net",
493
+ data_dns_response_code: "NOERROR",
494
+ data_network_community_id: "1:HBo2k5NK+I6PNOc3BZguhbjy1lg=",
495
+ data_dns_flags_truncated_response: "false",
496
+ rule_mail: false,
497
+ data_dns_opt_udp_size: "1232",
498
+ data_event_category: "network",
499
+ data_dns_flags_recursion_available: "true",
500
+ data_dns_opt_version: "0",
501
+ timestamp: "2025-05-23 20:24:43.055",
502
+ data_host_mac: "00-0C-29-09-D5-9B",
503
+ data_agent_id: "9d8db289-3bc9-40d3-92cb-2bd2d9f9434b",
504
+ data_destination_port: "53",
505
+ data_dns_type: "answer",
506
+ traffic_direction: "ingress",
507
+ rule_id: "200300",
508
+ data_dns_question_class: "IN",
509
+ cluster_node: "ASHWZHMA.socfortress.local",
510
+ dst_port: "53",
511
+ "data_@timestamp": "2025-05-23T20:24:39.365Z",
512
+ data_event_duration: "14214021",
513
+ data_host_os_platform: "debian",
514
+ data_dns_flags_recursion_desired: "true",
515
+ data_host_name: "piHole",
516
+ data_dns_question_subdomain: "e673.dsce9",
517
+ gl2_remote_port: 39934,
518
+ data_host_os_type: "linux",
519
+ source: "10.255.255.13",
520
+ gl2_source_input: "660320f176ca320e8393f030",
521
+ rule_level: 3,
522
+ data_event_type: "connection, protocol",
523
+ data_host_os_family: "debian",
524
+ data_dns_additionals_count: "0",
525
+ data_dns_flags_authentic_data: "false",
526
+ protocol: "udp",
527
+ data_dns_answers: "{ttl=14, data=23.203.24.27, name=e673.dsce9.akamaiedge.net, type=A, class=IN}",
528
+ data_event_start: "2025-05-23T20:24:39.365Z",
529
+ data_agent_ephemeral_id: "f64f34f9-15e3-4717-8349-bc5e342d07c3",
530
+ rule_description: "Linux: DNS Query to e673.dsce9.akamaiedge.net",
531
+ data_related_ip: "192.168.100.1, 192.168.100.3, 23.203.24.27",
532
+ data_agent_version: "8.7.1",
533
+ data_status: "OK",
534
+ data_query: "class IN, type A, e673.dsce9.akamaiedge.net",
535
+ "data_@metadata_type": "_doc",
536
+ data_server_ip: "192.168.100.3",
537
+ data_method: "QUERY",
538
+ data_dns_question_registered_domain: "akamaiedge.net",
539
+ gl2_message_id: "01JVZD3HSFBX25DM8ZBYKKCCN9",
540
+ data_dns_answers_count: "1",
541
+ data_network_type: "ipv4",
542
+ data_dns_opt_ext_rcode: "NOERROR",
543
+ data_client_port: "6412",
544
+ data_network_bytes: "124",
545
+ data_dns_resolved_ip: "23.203.24.27",
546
+ data_host_containerized: "false",
547
+ true: 1748031882.283367,
548
+ data_host_hostname: "piHole",
549
+ rule_groups: "linux, packetbeat, dns",
550
+ data_client_bytes: "54",
551
+ data_dns_question_type: "A",
552
+ data_destination_ip: "192.168.100.3",
553
+ data_host_ip: "192.168.100.3, fe80::20c:29ff:fe09:d59b",
554
+ rule_mitre_technique: "Application Layer Protocol",
555
+ rule_firedtimes: 294,
556
+ data_network_transport: "udp",
557
+ dst_ip: "192.168.100.3",
558
+ src_ip: "192.168.100.1",
559
+ decoder_name: "json",
560
+ syslog_level: "INFO",
561
+ data_dns_op_code: "QUERY",
562
+ data_host_os_version: "11 (bullseye)",
563
+ data_host_os_kernel: "5.10.0-21-amd64",
564
+ cluster_name: "socfortress",
565
+ data_source_bytes: "54",
566
+ gl2_processing_error:
567
+ 'Replaced invalid timestamp value in message <f5f58dd3-3813-11f0-91aa-8600007a2218> with current time - Value <2025-05-23T20:24:42.282+0000> caused exception: Invalid format: "2025-05-23T20:24:42.282+0000" is malformed at "T20:24:42.282+0000".',
568
+ data_dns_opt_do: "true",
569
+ data_dns_authorities_count: "0",
570
+ data_dns_question_name: "e673.dsce9.akamaiedge.net",
571
+ message:
572
+ '{"true":1748031882.283367,"timestamp":"2025-05-23T20:24:42.282+0000","rule":{"level":3,"description":"Linux: DNS Query to e673.dsce9.akamaiedge.net","id":"200300","mitre":{"id":["T1071"],"tactic":["Command and Control"],"technique":["Application Layer Protocol"]},"firedtimes":294,"mail":false,"groups":["linux","packetbeat","dns"]},"agent":{"id":"032","name":"piHole","ip":"192.168.100.3","labels":{"customer":"00001"}},"manager":{"name":"ASHWZHMA"},"id":"1748031882.83787816","cluster":{"name":"socfortress","node":"ASHWZHMA.socfortress.local"},"decoder":{"name":"json"},"data":{"status":"OK","@timestamp":"2025-05-23T20:24:39.365Z","@metadata":{"beat":"packetbeat","type":"_doc","version":"8.7.1"},"destination":{"port":"53","bytes":"70","ip":"192.168.100.3"},"server":{"bytes":"70","ip":"192.168.100.3","port":"53"},"event":{"end":"2025-05-23T20:24:39.379Z","kind":"event","category":["network"],"type":["connection","protocol"],"dataset":"dns","duration":"14214021","start":"2025-05-23T20:24:39.365Z"},"source":{"ip":"192.168.100.1","port":"6412","bytes":"54"},"query":"class IN, type A, e673.dsce9.akamaiedge.net","method":"QUERY","resource":"e673.dsce9.akamaiedge.net","type":"dns","dns":{"authorities_count":"0","id":"36717","response_code":"NOERROR","flags":{"authentic_data":"false","checking_disabled":"false","authoritative":"false","truncated_response":"false","recursion_desired":"true","recursion_available":"true"},"opt":{"do":"true","version":"0","udp_size":"1232","ext_rcode":"NOERROR"},"type":"answer","op_code":"QUERY","answers_count":"1","answers":[{"ttl":"14","data":"23.203.24.27","name":"e673.dsce9.akamaiedge.net","type":"A","class":"IN"}],"additionals_count":"0","header_flags":["RD","RA","DO"],"question":{"etld_plus_one":"akamaiedge.net","registered_domain":"akamaiedge.net","top_level_domain":"net","subdomain":"e673.dsce9","name":"e673.dsce9.akamaiedge.net","type":"A","class":"IN"},"resolved_ip":["23.203.24.27"]},"client":{"ip":"192.168.100.1","port":"6412","bytes":"54"},"network":{"bytes":"124","type":"ipv4","transport":"udp","protocol":"dns","direction":"ingress","community_id":"1:HBo2k5NK+I6PNOc3BZguhbjy1lg="},"related":{"ip":["192.168.100.1","192.168.100.3","23.203.24.27"]},"agent":{"name":"piHole","type":"packetbeat","version":"8.7.1","ephemeral_id":"f64f34f9-15e3-4717-8349-bc5e342d07c3","id":"9d8db289-3bc9-40d3-92cb-2bd2d9f9434b"},"ecs":{"version":"8.0.0"},"host":{"containerized":"false","name":"piHole","ip":["192.168.100.3","fe80::20c:29ff:fe09:d59b"],"mac":["00-0C-29-09-D5-9B"],"hostname":"piHole","architecture":"x86_64","os":{"name":"Debian GNU/Linux","kernel":"5.10.0-21-amd64","codename":"bullseye","type":"linux","platform":"debian","version":"11 (bullseye)","family":"debian"},"id":"8986bcccef884a1ebe34f1ccd31b4f50"}},"location":"/tmp/packetbeat/packetbeat-20250523-90.ndjson"}',
573
+ dns_answer: "23.203.24.27",
574
+ data_dns_id: "36717",
575
+ src_port: "6412",
576
+ manager_name: "ASHWZHMA",
577
+ data_dns_question_top_level_domain: "net",
578
+ data_network_direction: "ingress",
579
+ data_event_end: "2025-05-23T20:24:39.379Z",
580
+ data_agent_name: "piHole",
581
+ data_server_bytes: "70",
582
+ data_dns_flags_authoritative: "false",
583
+ data_client_ip: "192.168.100.1",
584
+ data_type: "dns",
585
+ data_dns_header_flags: "RD, RA, DO",
586
+ data_dns_flags_checking_disabled: "false",
587
+ location: "/tmp/packetbeat/packetbeat-20250523-90.ndjson",
588
+ "data_@metadata_version": "8.7.1",
589
+ data_host_os_name: "Debian GNU/Linux",
590
+ rule_group3: "dns",
591
+ msg_timestamp: "2025-05-23T20:24:42.282Z",
592
+ rule_group2: "packetbeat",
593
+ rule_group1: "linux"
594
+ },
595
+ {
596
+ data_source_ip: "192.168.100.3",
597
+ data_host_architecture: "x86_64",
598
+ agent_id: "032",
599
+ agent_name: "piHole",
600
+ gl2_remote_ip: "10.255.255.13",
601
+ data_resource: "e673.dsce9.akamaiedge.net",
602
+ agent_labels_customer: "00001",
603
+ data_ecs_version: "8.0.0",
604
+ timestamp_utc: "2025-05-23T20:24:39.365Z",
605
+ data_host_os_codename: "bullseye",
606
+ syslog_type: "wazuh",
607
+ gl2_source_node: "3b68efa4-3319-4885-a38f-c944f0fcf191",
608
+ id: "1748031882.83793735",
609
+ data_server_port: "53",
610
+ data_dns_question_etld_plus_one: "akamaiedge.net",
611
+ rule_mitre_tactic: "Command and Control",
612
+ gl2_accounted_message_size: 6177,
613
+ data_agent_type: "packetbeat",
614
+ streams: ["660320f176ca320e8393f057"],
615
+ rule_mitre_id: "T1071",
616
+ data_destination_bytes: "70",
617
+ data_event_dataset: "dns",
618
+ "data_@metadata_beat": "packetbeat",
619
+ agent_ip: "192.168.100.3",
620
+ data_source_port: "40999",
621
+ data_host_id: "8986bcccef884a1ebe34f1ccd31b4f50",
622
+ data_event_kind: "event",
623
+ data_network_protocol: "dns",
624
+ dns_response_code: "NOERROR",
625
+ dns_query: "e673.dsce9.akamaiedge.net",
626
+ data_dns_response_code: "NOERROR",
627
+ data_network_community_id: "1:MV4kAmot/Pl2lVf7gcKfTi6Js+Q=",
628
+ data_dns_flags_truncated_response: "false",
629
+ rule_mail: false,
630
+ data_dns_opt_udp_size: "1232",
631
+ data_event_category: "network",
632
+ data_dns_flags_recursion_available: "true",
633
+ data_dns_opt_version: "0",
634
+ timestamp: "2025-05-23 20:24:43.055",
635
+ data_host_mac: "00-0C-29-09-D5-9B",
636
+ data_agent_id: "9d8db289-3bc9-40d3-92cb-2bd2d9f9434b",
637
+ data_destination_port: "53",
638
+ data_dns_type: "answer",
639
+ traffic_direction: "egress",
640
+ rule_id: "200300",
641
+ data_dns_question_class: "IN",
642
+ cluster_node: "ASHWZHMA.socfortress.local",
643
+ dst_port: "53",
644
+ "data_@timestamp": "2025-05-23T20:24:39.365Z",
645
+ data_host_os_platform: "debian",
646
+ data_event_duration: "14121063",
647
+ data_dns_flags_recursion_desired: "true",
648
+ data_host_name: "piHole",
649
+ data_dns_question_subdomain: "e673.dsce9",
650
+ gl2_remote_port: 39934,
651
+ data_host_os_type: "linux",
652
+ source: "10.255.255.13",
653
+ gl2_source_input: "660320f176ca320e8393f030",
654
+ rule_level: 3,
655
+ data_event_type: "connection, protocol",
656
+ data_host_os_family: "debian",
657
+ data_dns_additionals_count: "0",
658
+ data_dns_flags_authentic_data: "false",
659
+ protocol: "udp",
660
+ data_dns_answers: "{data=23.203.24.27, name=e673.dsce9.akamaiedge.net, type=A, class=IN, ttl=14}",
661
+ data_event_start: "2025-05-23T20:24:39.365Z",
662
+ data_agent_ephemeral_id: "f64f34f9-15e3-4717-8349-bc5e342d07c3",
663
+ rule_description: "Linux: DNS Query to e673.dsce9.akamaiedge.net",
664
+ data_related_ip: "192.168.100.3, 1.1.1.3, 23.203.24.27",
665
+ data_agent_version: "8.7.1",
666
+ data_status: "OK",
667
+ data_query: "class IN, type A, e673.dsce9.akamaiedge.net",
668
+ "data_@metadata_type": "_doc",
669
+ data_server_ip: "1.1.1.3",
670
+ data_dns_question_registered_domain: "akamaiedge.net",
671
+ data_method: "QUERY",
672
+ gl2_message_id: "01JVZD3HSFFBP2GCAREGTN6HMK",
673
+ data_dns_answers_count: "1",
674
+ data_network_type: "ipv4",
675
+ data_dns_opt_ext_rcode: "NOERROR",
676
+ data_client_port: "40999",
677
+ data_network_bytes: "124",
678
+ data_dns_resolved_ip: "23.203.24.27",
679
+ data_host_containerized: "false",
680
+ true: 1748031882.955625,
681
+ data_host_hostname: "piHole",
682
+ rule_groups: "linux, packetbeat, dns",
683
+ data_client_bytes: "54",
684
+ data_dns_question_type: "A",
685
+ data_host_ip: "192.168.100.3, fe80::20c:29ff:fe09:d59b",
686
+ data_destination_ip: "1.1.1.3",
687
+ rule_mitre_technique: "Application Layer Protocol",
688
+ rule_firedtimes: 296,
689
+ data_network_transport: "udp",
690
+ dst_ip: "1.1.1.3",
691
+ src_ip: "192.168.100.3",
692
+ decoder_name: "json",
693
+ syslog_level: "INFO",
694
+ data_dns_op_code: "QUERY",
695
+ data_host_os_version: "11 (bullseye)",
696
+ data_host_os_kernel: "5.10.0-21-amd64",
697
+ cluster_name: "socfortress",
698
+ data_source_bytes: "54",
699
+ gl2_processing_error:
700
+ 'Replaced invalid timestamp value in message <f5f58dd5-3813-11f0-91aa-8600007a2218> with current time - Value <2025-05-23T20:24:42.282+0000> caused exception: Invalid format: "2025-05-23T20:24:42.282+0000" is malformed at "T20:24:42.282+0000".',
701
+ data_dns_opt_do: "true",
702
+ data_dns_authorities_count: "0",
703
+ data_dns_question_name: "e673.dsce9.akamaiedge.net",
704
+ message:
705
+ '{"true":1748031882.955625,"timestamp":"2025-05-23T20:24:42.282+0000","rule":{"level":3,"description":"Linux: DNS Query to e673.dsce9.akamaiedge.net","id":"200300","mitre":{"id":["T1071"],"tactic":["Command and Control"],"technique":["Application Layer Protocol"]},"firedtimes":296,"mail":false,"groups":["linux","packetbeat","dns"]},"agent":{"id":"032","name":"piHole","ip":"192.168.100.3","labels":{"customer":"00001"}},"manager":{"name":"ASHWZHMA"},"id":"1748031882.83793735","cluster":{"name":"socfortress","node":"ASHWZHMA.socfortress.local"},"decoder":{"name":"json"},"data":{"status":"OK","@timestamp":"2025-05-23T20:24:39.365Z","@metadata":{"beat":"packetbeat","type":"_doc","version":"8.7.1"},"ecs":{"version":"8.0.0"},"client":{"bytes":"54","ip":"192.168.100.3","port":"40999"},"server":{"ip":"1.1.1.3","port":"53","bytes":"70"},"dns":{"resolved_ip":["23.203.24.27"],"op_code":"QUERY","flags":{"checking_disabled":"false","authoritative":"false","truncated_response":"false","recursion_desired":"true","recursion_available":"true","authentic_data":"false"},"answers":[{"data":"23.203.24.27","name":"e673.dsce9.akamaiedge.net","type":"A","class":"IN","ttl":"14"}],"authorities_count":"0","type":"answer","response_code":"NOERROR","header_flags":["RD","RA","DO"],"question":{"subdomain":"e673.dsce9","name":"e673.dsce9.akamaiedge.net","type":"A","class":"IN","etld_plus_one":"akamaiedge.net","registered_domain":"akamaiedge.net","top_level_domain":"net"},"opt":{"do":"true","version":"0","udp_size":"1232","ext_rcode":"NOERROR"},"id":"35268","answers_count":"1","additionals_count":"0"},"resource":"e673.dsce9.akamaiedge.net","host":{"architecture":"x86_64","os":{"codename":"bullseye","type":"linux","platform":"debian","version":"11 (bullseye)","family":"debian","name":"Debian GNU/Linux","kernel":"5.10.0-21-amd64"},"id":"8986bcccef884a1ebe34f1ccd31b4f50","name":"piHole","containerized":"false","ip":["192.168.100.3","fe80::20c:29ff:fe09:d59b"],"mac":["00-0C-29-09-D5-9B"],"hostname":"piHole"},"event":{"start":"2025-05-23T20:24:39.365Z","end":"2025-05-23T20:24:39.379Z","kind":"event","category":["network"],"type":["connection","protocol"],"dataset":"dns","duration":"14121063"},"destination":{"ip":"1.1.1.3","port":"53","bytes":"70"},"query":"class IN, type A, e673.dsce9.akamaiedge.net","source":{"ip":"192.168.100.3","port":"40999","bytes":"54"},"related":{"ip":["192.168.100.3","1.1.1.3","23.203.24.27"]},"agent":{"id":"9d8db289-3bc9-40d3-92cb-2bd2d9f9434b","name":"piHole","type":"packetbeat","version":"8.7.1","ephemeral_id":"f64f34f9-15e3-4717-8349-bc5e342d07c3"},"method":"QUERY","type":"dns","network":{"protocol":"dns","direction":"egress","community_id":"1:MV4kAmot/Pl2lVf7gcKfTi6Js+Q=","bytes":"124","type":"ipv4","transport":"udp"}},"location":"/tmp/packetbeat/packetbeat-20250523-90.ndjson"}',
706
+ dns_answer: "23.203.24.27",
707
+ data_dns_id: "35268",
708
+ src_port: "40999",
709
+ manager_name: "ASHWZHMA",
710
+ data_dns_question_top_level_domain: "net",
711
+ data_network_direction: "egress",
712
+ data_event_end: "2025-05-23T20:24:39.379Z",
713
+ data_agent_name: "piHole",
714
+ data_client_ip: "192.168.100.3",
715
+ data_server_bytes: "70",
716
+ data_dns_flags_authoritative: "false",
717
+ data_dns_header_flags: "RD, RA, DO",
718
+ data_type: "dns",
719
+ data_dns_flags_checking_disabled: "false",
720
+ location: "/tmp/packetbeat/packetbeat-20250523-90.ndjson",
721
+ "data_@metadata_version": "8.7.1",
722
+ data_host_os_name: "Debian GNU/Linux",
723
+ rule_group3: "dns",
724
+ msg_timestamp: "2025-05-23T20:24:42.282Z",
725
+ rule_group2: "packetbeat",
726
+ rule_group1: "linux"
727
+ },
728
+ {
729
+ data_source_ip: "192.168.100.1",
730
+ data_host_architecture: "x86_64",
731
+ agent_id: "032",
732
+ agent_name: "piHole",
733
+ gl2_remote_ip: "10.255.255.13",
734
+ data_resource: "api.coinbase.com",
735
+ agent_labels_customer: "00001",
736
+ data_ecs_version: "8.0.0",
737
+ timestamp_utc: "2025-05-23T20:24:33.880Z",
738
+ data_host_os_codename: "bullseye",
739
+ syslog_type: "wazuh",
740
+ gl2_source_node: "3b68efa4-3319-4885-a38f-c944f0fcf191",
741
+ id: "1748031876.83781905",
742
+ data_dns_question_etld_plus_one: "coinbase.com",
743
+ data_server_port: "53",
744
+ rule_mitre_tactic: "Command and Control",
745
+ gl2_accounted_message_size: 6537,
746
+ data_agent_type: "packetbeat",
747
+ streams: ["660320f176ca320e8393f057"],
748
+ rule_mitre_id: "T1071",
749
+ data_destination_bytes: "101",
750
+ data_event_dataset: "dns",
751
+ "data_@metadata_beat": "packetbeat",
752
+ agent_ip: "192.168.100.3",
753
+ data_source_port: "8819",
754
+ data_host_id: "8986bcccef884a1ebe34f1ccd31b4f50",
755
+ data_event_kind: "event",
756
+ data_network_protocol: "dns",
757
+ dns_response_code: "NOERROR",
758
+ dns_query: "api.coinbase.com",
759
+ data_dns_response_code: "NOERROR",
760
+ data_network_community_id: "1:3pXnmtDLbo/xBY/ZfO1IbbPnnt0=",
761
+ data_dns_flags_truncated_response: "false",
762
+ rule_mail: false,
763
+ data_dns_opt_udp_size: "1232",
764
+ data_event_category: "network",
765
+ data_dns_flags_recursion_available: "true",
766
+ data_dns_opt_version: "0",
767
+ timestamp: "2025-05-23 20:24:38.056",
768
+ data_host_mac: "00-0C-29-09-D5-9B",
769
+ data_agent_id: "9d8db289-3bc9-40d3-92cb-2bd2d9f9434b",
770
+ data_destination_port: "53",
771
+ data_dns_type: "answer",
772
+ traffic_direction: "ingress",
773
+ rule_id: "200300",
774
+ data_dns_question_class: "IN",
775
+ cluster_node: "ASHWZHMA.socfortress.local",
776
+ dst_port: "53",
777
+ "data_@timestamp": "2025-05-23T20:24:33.880Z",
778
+ data_event_duration: "17771034",
779
+ data_host_os_platform: "debian",
780
+ data_dns_flags_recursion_desired: "true",
781
+ data_host_name: "piHole",
782
+ data_dns_question_subdomain: "api",
783
+ gl2_remote_port: 39928,
784
+ data_host_os_type: "linux",
785
+ source: "10.255.255.13",
786
+ gl2_source_input: "660320f176ca320e8393f030",
787
+ rule_level: 3,
788
+ data_event_type: "connection, protocol",
789
+ data_host_os_family: "debian",
790
+ data_dns_additionals_count: "0",
791
+ data_dns_flags_authentic_data: "false",
792
+ protocol: "udp",
793
+ data_dns_answers:
794
+ "{data=2606:4700:4400::6812:230f, name=api.coinbase.com, type=AAAA, class=IN, ttl=300}, {data=2606:4700:4400::ac40:98f1, name=api.coinbase.com, type=AAAA, class=IN, ttl=300}",
795
+ data_event_start: "2025-05-23T20:24:33.880Z",
796
+ data_agent_ephemeral_id: "f64f34f9-15e3-4717-8349-bc5e342d07c3",
797
+ rule_description: "Linux: DNS Query to api.coinbase.com",
798
+ data_agent_version: "8.7.1",
799
+ data_related_ip: "192.168.100.1, 192.168.100.3, 2606:4700:4400::6812:230f, 2606:4700:4400::ac40:98f1",
800
+ data_status: "OK",
801
+ data_query: "class IN, type AAAA, api.coinbase.com",
802
+ "data_@metadata_type": "_doc",
803
+ data_dns_question_registered_domain: "coinbase.com",
804
+ data_method: "QUERY",
805
+ data_server_ip: "192.168.100.3",
806
+ gl2_message_id: "01JVZD3CX8PMYGGT699MWPN15D",
807
+ data_dns_answers_count: "2",
808
+ data_network_type: "ipv4",
809
+ data_dns_opt_ext_rcode: "NOERROR",
810
+ data_client_port: "8819",
811
+ data_network_bytes: "146",
812
+ data_dns_resolved_ip: "2606:4700:4400::6812:230f, 2606:4700:4400::ac40:98f1",
813
+ data_host_containerized: "false",
814
+ true: 1748031876.269145,
815
+ data_host_hostname: "piHole",
816
+ rule_groups: "linux, packetbeat, dns",
817
+ data_client_bytes: "45",
818
+ data_dns_question_type: "AAAA",
819
+ data_destination_ip: "192.168.100.3",
820
+ data_host_ip: "192.168.100.3, fe80::20c:29ff:fe09:d59b",
821
+ rule_mitre_technique: "Application Layer Protocol",
822
+ rule_firedtimes: 292,
823
+ data_network_transport: "udp",
824
+ dst_ip: "192.168.100.3",
825
+ src_ip: "192.168.100.1",
826
+ decoder_name: "json",
827
+ syslog_level: "INFO",
828
+ data_dns_op_code: "QUERY",
829
+ data_host_os_version: "11 (bullseye)",
830
+ data_host_os_kernel: "5.10.0-21-amd64",
831
+ cluster_name: "socfortress",
832
+ data_source_bytes: "45",
833
+ gl2_processing_error:
834
+ 'Replaced invalid timestamp value in message <f2fac463-3813-11f0-91aa-8600007a2218> with current time - Value <2025-05-23T20:24:36.268+0000> caused exception: Invalid format: "2025-05-23T20:24:36.268+0000" is malformed at "T20:24:36.268+0000".',
835
+ data_dns_opt_do: "true",
836
+ data_dns_authorities_count: "0",
837
+ data_dns_question_name: "api.coinbase.com",
838
+ message:
839
+ '{"true":1748031876.269145,"timestamp":"2025-05-23T20:24:36.268+0000","rule":{"level":3,"description":"Linux: DNS Query to api.coinbase.com","id":"200300","mitre":{"id":["T1071"],"tactic":["Command and Control"],"technique":["Application Layer Protocol"]},"firedtimes":292,"mail":false,"groups":["linux","packetbeat","dns"]},"agent":{"id":"032","name":"piHole","ip":"192.168.100.3","labels":{"customer":"00001"}},"manager":{"name":"ASHWZHMA"},"id":"1748031876.83781905","cluster":{"name":"socfortress","node":"ASHWZHMA.socfortress.local"},"decoder":{"name":"json"},"data":{"status":"OK","@timestamp":"2025-05-23T20:24:33.880Z","@metadata":{"beat":"packetbeat","type":"_doc","version":"8.7.1"},"resource":"api.coinbase.com","dns":{"authorities_count":"0","additionals_count":"0","type":"answer","op_code":"QUERY","id":"42058","response_code":"NOERROR","answers_count":"2","resolved_ip":["2606:4700:4400::6812:230f","2606:4700:4400::ac40:98f1"],"flags":{"truncated_response":"false","recursion_desired":"true","recursion_available":"true","authentic_data":"false","checking_disabled":"false","authoritative":"false"},"header_flags":["RD","RA","DO"],"question":{"class":"IN","etld_plus_one":"coinbase.com","registered_domain":"coinbase.com","top_level_domain":"com","subdomain":"api","name":"api.coinbase.com","type":"AAAA"},"opt":{"version":"0","udp_size":"1232","ext_rcode":"NOERROR","do":"true"},"answers":[{"data":"2606:4700:4400::6812:230f","name":"api.coinbase.com","type":"AAAA","class":"IN","ttl":"300"},{"data":"2606:4700:4400::ac40:98f1","name":"api.coinbase.com","type":"AAAA","class":"IN","ttl":"300"}]},"method":"QUERY","type":"dns","event":{"category":["network"],"type":["connection","protocol"],"dataset":"dns","duration":"17771034","start":"2025-05-23T20:24:33.880Z","end":"2025-05-23T20:24:33.898Z","kind":"event"},"ecs":{"version":"8.0.0"},"destination":{"port":"53","bytes":"101","ip":"192.168.100.3"},"host":{"containerized":"false","ip":["192.168.100.3","fe80::20c:29ff:fe09:d59b"],"name":"piHole","mac":["00-0C-29-09-D5-9B"],"hostname":"piHole","architecture":"x86_64","os":{"kernel":"5.10.0-21-amd64","codename":"bullseye","type":"linux","platform":"debian","version":"11 (bullseye)","family":"debian","name":"Debian GNU/Linux"},"id":"8986bcccef884a1ebe34f1ccd31b4f50"},"source":{"ip":"192.168.100.1","port":"8819","bytes":"45"},"server":{"ip":"192.168.100.3","port":"53","bytes":"101"},"agent":{"type":"packetbeat","version":"8.7.1","ephemeral_id":"f64f34f9-15e3-4717-8349-bc5e342d07c3","id":"9d8db289-3bc9-40d3-92cb-2bd2d9f9434b","name":"piHole"},"network":{"type":"ipv4","transport":"udp","protocol":"dns","direction":"ingress","community_id":"1:3pXnmtDLbo/xBY/ZfO1IbbPnnt0=","bytes":"146"},"client":{"ip":"192.168.100.1","port":"8819","bytes":"45"},"related":{"ip":["192.168.100.1","192.168.100.3","2606:4700:4400::6812:230f","2606:4700:4400::ac40:98f1"]},"query":"class IN, type AAAA, api.coinbase.com"},"location":"/tmp/packetbeat/packetbeat-20250523-90.ndjson"}',
840
+ dns_answer: "2606:4700:4400::6812:230f, 2606:4700:4400::ac40:98f1",
841
+ data_dns_id: "42058",
842
+ src_port: "8819",
843
+ manager_name: "ASHWZHMA",
844
+ data_dns_question_top_level_domain: "com",
845
+ data_network_direction: "ingress",
846
+ data_event_end: "2025-05-23T20:24:33.898Z",
847
+ data_agent_name: "piHole",
848
+ data_dns_flags_authoritative: "false",
849
+ data_server_bytes: "101",
850
+ data_client_ip: "192.168.100.1",
851
+ data_dns_header_flags: "RD, RA, DO",
852
+ data_type: "dns",
853
+ data_dns_flags_checking_disabled: "false",
854
+ location: "/tmp/packetbeat/packetbeat-20250523-90.ndjson",
855
+ "data_@metadata_version": "8.7.1",
856
+ data_host_os_name: "Debian GNU/Linux",
857
+ rule_group3: "dns",
858
+ msg_timestamp: "2025-05-23T20:24:36.268Z",
859
+ rule_group2: "packetbeat",
860
+ rule_group1: "linux"
861
+ },
862
+ {
863
+ data_source_ip: "192.168.100.3",
864
+ data_host_architecture: "x86_64",
865
+ agent_id: "032",
866
+ agent_name: "piHole",
867
+ gl2_remote_ip: "10.255.255.13",
868
+ data_resource: "github.com",
869
+ agent_labels_customer: "00001",
870
+ data_ecs_version: "8.0.0",
871
+ timestamp_utc: "2025-05-23T20:24:31.373Z",
872
+ data_host_os_codename: "bullseye",
873
+ syslog_type: "wazuh",
874
+ gl2_source_node: "3b68efa4-3319-4885-a38f-c944f0fcf191",
875
+ id: "1748031874.83775437",
876
+ data_server_port: "53",
877
+ data_dns_question_etld_plus_one: "github.com",
878
+ rule_mitre_tactic: "Command and Control",
879
+ gl2_accounted_message_size: 5932,
880
+ data_agent_type: "packetbeat",
881
+ streams: ["660320f176ca320e8393f057"],
882
+ rule_mitre_id: "T1071",
883
+ data_destination_bytes: "55",
884
+ data_event_dataset: "dns",
885
+ "data_@metadata_beat": "packetbeat",
886
+ agent_ip: "192.168.100.3",
887
+ data_source_port: "56650",
888
+ data_host_id: "8986bcccef884a1ebe34f1ccd31b4f50",
889
+ data_event_kind: "event",
890
+ data_network_protocol: "dns",
891
+ dns_response_code: "NOERROR",
892
+ dns_query: "github.com",
893
+ data_dns_response_code: "NOERROR",
894
+ data_network_community_id: "1:njv02kf9+WW6JlYlcSaxjqsSfqI=",
895
+ data_dns_flags_truncated_response: "false",
896
+ rule_mail: false,
897
+ data_dns_opt_udp_size: "1232",
898
+ data_event_category: "network",
899
+ data_dns_flags_recursion_available: "true",
900
+ data_dns_opt_version: "0",
901
+ timestamp: "2025-05-23 20:24:38.056",
902
+ data_host_mac: "00-0C-29-09-D5-9B",
903
+ data_agent_id: "9d8db289-3bc9-40d3-92cb-2bd2d9f9434b",
904
+ data_destination_port: "53",
905
+ data_dns_type: "answer",
906
+ traffic_direction: "egress",
907
+ rule_id: "200300",
908
+ data_dns_question_class: "IN",
909
+ cluster_node: "ASHWZHMA.socfortress.local",
910
+ dst_port: "53",
911
+ "data_@timestamp": "2025-05-23T20:24:31.373Z",
912
+ data_event_duration: "15729989",
913
+ data_host_os_platform: "debian",
914
+ data_dns_flags_recursion_desired: "true",
915
+ data_host_name: "piHole",
916
+ gl2_remote_port: 39928,
917
+ data_host_os_type: "linux",
918
+ source: "10.255.255.13",
919
+ gl2_source_input: "660320f176ca320e8393f030",
920
+ rule_level: 3,
921
+ data_event_type: "connection, protocol",
922
+ data_host_os_family: "debian",
923
+ data_dns_additionals_count: "0",
924
+ data_dns_flags_authentic_data: "false",
925
+ protocol: "udp",
926
+ data_dns_answers: "{name=github.com, type=A, class=IN, ttl=54, data=140.82.114.4}",
927
+ data_event_start: "2025-05-23T20:24:31.373Z",
928
+ data_agent_ephemeral_id: "f64f34f9-15e3-4717-8349-bc5e342d07c3",
929
+ rule_description: "Linux: DNS Query to github.com",
930
+ data_related_ip: "192.168.100.3, 1.1.1.3, 140.82.114.4",
931
+ data_agent_version: "8.7.1",
932
+ data_status: "OK",
933
+ data_query: "class IN, type A, github.com",
934
+ "data_@metadata_type": "_doc",
935
+ data_server_ip: "1.1.1.3",
936
+ data_method: "QUERY",
937
+ data_dns_question_registered_domain: "github.com",
938
+ gl2_message_id: "01JVZD3CX8TTGERKKB0MZHWP29",
939
+ data_dns_answers_count: "1",
940
+ data_network_type: "ipv4",
941
+ data_dns_opt_ext_rcode: "NOERROR",
942
+ data_client_port: "56650",
943
+ data_network_bytes: "94",
944
+ data_dns_resolved_ip: "140.82.114.4",
945
+ data_host_containerized: "false",
946
+ true: 1748031874.268436,
947
+ data_host_hostname: "piHole",
948
+ rule_groups: "linux, packetbeat, dns",
949
+ data_client_bytes: "39",
950
+ data_dns_question_type: "A",
951
+ data_destination_ip: "1.1.1.3",
952
+ data_host_ip: "192.168.100.3, fe80::20c:29ff:fe09:d59b",
953
+ rule_mitre_technique: "Application Layer Protocol",
954
+ rule_firedtimes: 290,
955
+ data_network_transport: "udp",
956
+ dst_ip: "1.1.1.3",
957
+ src_ip: "192.168.100.3",
958
+ decoder_name: "json",
959
+ syslog_level: "INFO",
960
+ data_dns_op_code: "QUERY",
961
+ data_host_os_version: "11 (bullseye)",
962
+ data_host_os_kernel: "5.10.0-21-amd64",
963
+ cluster_name: "socfortress",
964
+ data_source_bytes: "39",
965
+ gl2_processing_error:
966
+ 'Replaced invalid timestamp value in message <f2fac460-3813-11f0-91aa-8600007a2218> with current time - Value <2025-05-23T20:24:34.266+0000> caused exception: Invalid format: "2025-05-23T20:24:34.266+0000" is malformed at "T20:24:34.266+0000".',
967
+ data_dns_opt_do: "true",
968
+ data_dns_authorities_count: "0",
969
+ data_dns_question_name: "github.com",
970
+ message:
971
+ '{"true":1748031874.268436,"timestamp":"2025-05-23T20:24:34.266+0000","rule":{"level":3,"description":"Linux: DNS Query to github.com","id":"200300","mitre":{"id":["T1071"],"tactic":["Command and Control"],"technique":["Application Layer Protocol"]},"firedtimes":290,"mail":false,"groups":["linux","packetbeat","dns"]},"agent":{"id":"032","name":"piHole","ip":"192.168.100.3","labels":{"customer":"00001"}},"manager":{"name":"ASHWZHMA"},"id":"1748031874.83775437","cluster":{"name":"socfortress","node":"ASHWZHMA.socfortress.local"},"decoder":{"name":"json"},"data":{"status":"OK","@timestamp":"2025-05-23T20:24:31.373Z","@metadata":{"beat":"packetbeat","type":"_doc","version":"8.7.1"},"event":{"type":["connection","protocol"],"dataset":"dns","duration":"15729989","start":"2025-05-23T20:24:31.373Z","end":"2025-05-23T20:24:31.389Z","kind":"event","category":["network"]},"resource":"github.com","client":{"ip":"192.168.100.3","port":"56650","bytes":"39"},"related":{"ip":["192.168.100.3","1.1.1.3","140.82.114.4"]},"query":"class IN, type A, github.com","ecs":{"version":"8.0.0"},"server":{"ip":"1.1.1.3","port":"53","bytes":"55"},"type":"dns","destination":{"ip":"1.1.1.3","port":"53","bytes":"55"},"method":"QUERY","dns":{"type":"answer","id":"10393","resolved_ip":["140.82.114.4"],"authorities_count":"0","header_flags":["RD","RA","DO"],"question":{"registered_domain":"github.com","top_level_domain":"com","name":"github.com","type":"A","class":"IN","etld_plus_one":"github.com"},"answers_count":"1","answers":[{"name":"github.com","type":"A","class":"IN","ttl":"54","data":"140.82.114.4"}],"additionals_count":"0","op_code":"QUERY","flags":{"authoritative":"false","truncated_response":"false","recursion_desired":"true","recursion_available":"true","authentic_data":"false","checking_disabled":"false"},"response_code":"NOERROR","opt":{"do":"true","version":"0","udp_size":"1232","ext_rcode":"NOERROR"}},"host":{"name":"piHole","containerized":"false","ip":["192.168.100.3","fe80::20c:29ff:fe09:d59b"],"mac":["00-0C-29-09-D5-9B"],"hostname":"piHole","architecture":"x86_64","os":{"type":"linux","platform":"debian","version":"11 (bullseye)","family":"debian","name":"Debian GNU/Linux","kernel":"5.10.0-21-amd64","codename":"bullseye"},"id":"8986bcccef884a1ebe34f1ccd31b4f50"},"network":{"community_id":"1:njv02kf9+WW6JlYlcSaxjqsSfqI=","bytes":"94","type":"ipv4","transport":"udp","protocol":"dns","direction":"egress"},"source":{"ip":"192.168.100.3","port":"56650","bytes":"39"},"agent":{"ephemeral_id":"f64f34f9-15e3-4717-8349-bc5e342d07c3","id":"9d8db289-3bc9-40d3-92cb-2bd2d9f9434b","name":"piHole","type":"packetbeat","version":"8.7.1"}},"location":"/tmp/packetbeat/packetbeat-20250523-90.ndjson"}',
972
+ dns_answer: "140.82.114.4",
973
+ data_dns_id: "10393",
974
+ src_port: "56650",
975
+ manager_name: "ASHWZHMA",
976
+ data_dns_question_top_level_domain: "com",
977
+ data_network_direction: "egress",
978
+ data_event_end: "2025-05-23T20:24:31.389Z",
979
+ data_agent_name: "piHole",
980
+ data_client_ip: "192.168.100.3",
981
+ data_server_bytes: "55",
982
+ data_dns_flags_authoritative: "false",
983
+ data_type: "dns",
984
+ data_dns_header_flags: "RD, RA, DO",
985
+ data_dns_flags_checking_disabled: "false",
986
+ location: "/tmp/packetbeat/packetbeat-20250523-90.ndjson",
987
+ "data_@metadata_version": "8.7.1",
988
+ data_host_os_name: "Debian GNU/Linux",
989
+ rule_group3: "dns",
990
+ msg_timestamp: "2025-05-23T20:24:34.266Z",
991
+ rule_group2: "packetbeat",
992
+ rule_group1: "linux"
993
+ },
994
+ {
995
+ data_source_ip: "192.168.100.3",
996
+ data_host_architecture: "x86_64",
997
+ agent_id: "032",
998
+ agent_name: "piHole",
999
+ gl2_remote_ip: "10.255.255.13",
1000
+ data_resource: "api.coinbase.com",
1001
+ agent_labels_customer: "00001",
1002
+ data_ecs_version: "8.0.0",
1003
+ timestamp_utc: "2025-05-23T20:24:33.880Z",
1004
+ data_host_os_codename: "bullseye",
1005
+ syslog_type: "wazuh",
1006
+ gl2_source_node: "3b68efa4-3319-4885-a38f-c944f0fcf191",
1007
+ id: "1748031876.83784869",
1008
+ data_server_port: "53",
1009
+ data_dns_question_etld_plus_one: "coinbase.com",
1010
+ rule_mitre_tactic: "Command and Control",
1011
+ gl2_accounted_message_size: 6497,
1012
+ data_agent_type: "packetbeat",
1013
+ streams: ["660320f176ca320e8393f057"],
1014
+ rule_mitre_id: "T1071",
1015
+ data_destination_bytes: "101",
1016
+ data_event_dataset: "dns",
1017
+ "data_@metadata_beat": "packetbeat",
1018
+ agent_ip: "192.168.100.3",
1019
+ data_source_port: "52260",
1020
+ data_host_id: "8986bcccef884a1ebe34f1ccd31b4f50",
1021
+ data_event_kind: "event",
1022
+ data_network_protocol: "dns",
1023
+ dns_response_code: "NOERROR",
1024
+ dns_query: "api.coinbase.com",
1025
+ data_dns_response_code: "NOERROR",
1026
+ data_network_community_id: "1:cHbmaBX78sZuvoLLR5j5BGNbP8s=",
1027
+ data_dns_flags_truncated_response: "false",
1028
+ rule_mail: false,
1029
+ data_dns_opt_udp_size: "1232",
1030
+ data_event_category: "network",
1031
+ data_dns_flags_recursion_available: "true",
1032
+ data_dns_opt_version: "0",
1033
+ timestamp: "2025-05-23 20:24:38.056",
1034
+ data_host_mac: "00-0C-29-09-D5-9B",
1035
+ data_agent_id: "9d8db289-3bc9-40d3-92cb-2bd2d9f9434b",
1036
+ data_destination_port: "53",
1037
+ data_dns_type: "answer",
1038
+ traffic_direction: "egress",
1039
+ rule_id: "200300",
1040
+ data_dns_question_class: "IN",
1041
+ cluster_node: "ASHWZHMA.socfortress.local",
1042
+ dst_port: "53",
1043
+ "data_@timestamp": "2025-05-23T20:24:33.880Z",
1044
+ data_event_duration: "17582186",
1045
+ data_host_os_platform: "debian",
1046
+ data_dns_flags_recursion_desired: "true",
1047
+ data_host_name: "piHole",
1048
+ data_dns_question_subdomain: "api",
1049
+ gl2_remote_port: 39928,
1050
+ data_host_os_type: "linux",
1051
+ source: "10.255.255.13",
1052
+ gl2_source_input: "660320f176ca320e8393f030",
1053
+ rule_level: 3,
1054
+ data_event_type: "connection, protocol",
1055
+ data_host_os_family: "debian",
1056
+ data_dns_additionals_count: "0",
1057
+ data_dns_flags_authentic_data: "false",
1058
+ protocol: "udp",
1059
+ data_dns_answers:
1060
+ "{type=AAAA, class=IN, ttl=300, data=2606:4700:4400::6812:230f, name=api.coinbase.com}, {ttl=300, data=2606:4700:4400::ac40:98f1, name=api.coinbase.com, type=AAAA, class=IN}",
1061
+ data_agent_ephemeral_id: "f64f34f9-15e3-4717-8349-bc5e342d07c3",
1062
+ data_event_start: "2025-05-23T20:24:33.880Z",
1063
+ rule_description: "Linux: DNS Query to api.coinbase.com",
1064
+ data_agent_version: "8.7.1",
1065
+ data_related_ip: "192.168.100.3, 1.1.1.3, 2606:4700:4400::6812:230f, 2606:4700:4400::ac40:98f1",
1066
+ data_status: "OK",
1067
+ data_query: "class IN, type AAAA, api.coinbase.com",
1068
+ "data_@metadata_type": "_doc",
1069
+ data_server_ip: "1.1.1.3",
1070
+ data_method: "QUERY",
1071
+ data_dns_question_registered_domain: "coinbase.com",
1072
+ gl2_message_id: "01JVZD3CX862P7A9S72EMX9GTA",
1073
+ data_dns_answers_count: "2",
1074
+ data_network_type: "ipv4",
1075
+ data_dns_opt_ext_rcode: "NOERROR",
1076
+ data_client_port: "52260",
1077
+ data_network_bytes: "146",
1078
+ data_dns_resolved_ip: "2606:4700:4400::6812:230f, 2606:4700:4400::ac40:98f1",
1079
+ data_host_containerized: "false",
1080
+ true: 1748031876.954916,
1081
+ data_host_hostname: "piHole",
1082
+ rule_groups: "linux, packetbeat, dns",
1083
+ data_client_bytes: "45",
1084
+ data_dns_question_type: "AAAA",
1085
+ data_destination_ip: "1.1.1.3",
1086
+ data_host_ip: "192.168.100.3, fe80::20c:29ff:fe09:d59b",
1087
+ rule_mitre_technique: "Application Layer Protocol",
1088
+ rule_firedtimes: 293,
1089
+ data_network_transport: "udp",
1090
+ dst_ip: "1.1.1.3",
1091
+ src_ip: "192.168.100.3",
1092
+ decoder_name: "json",
1093
+ syslog_level: "INFO",
1094
+ data_dns_op_code: "QUERY",
1095
+ data_host_os_version: "11 (bullseye)",
1096
+ data_host_os_kernel: "5.10.0-21-amd64",
1097
+ cluster_name: "socfortress",
1098
+ data_source_bytes: "45",
1099
+ gl2_processing_error:
1100
+ 'Replaced invalid timestamp value in message <f2fac464-3813-11f0-91aa-8600007a2218> with current time - Value <2025-05-23T20:24:36.268+0000> caused exception: Invalid format: "2025-05-23T20:24:36.268+0000" is malformed at "T20:24:36.268+0000".',
1101
+ data_dns_opt_do: "true",
1102
+ data_dns_authorities_count: "0",
1103
+ data_dns_question_name: "api.coinbase.com",
1104
+ message:
1105
+ '{"true":1748031876.954916,"timestamp":"2025-05-23T20:24:36.268+0000","rule":{"level":3,"description":"Linux: DNS Query to api.coinbase.com","id":"200300","mitre":{"id":["T1071"],"tactic":["Command and Control"],"technique":["Application Layer Protocol"]},"firedtimes":293,"mail":false,"groups":["linux","packetbeat","dns"]},"agent":{"id":"032","name":"piHole","ip":"192.168.100.3","labels":{"customer":"00001"}},"manager":{"name":"ASHWZHMA"},"id":"1748031876.83784869","cluster":{"name":"socfortress","node":"ASHWZHMA.socfortress.local"},"decoder":{"name":"json"},"data":{"status":"OK","@timestamp":"2025-05-23T20:24:33.880Z","@metadata":{"beat":"packetbeat","type":"_doc","version":"8.7.1"},"client":{"ip":"192.168.100.3","port":"52260","bytes":"45"},"server":{"ip":"1.1.1.3","port":"53","bytes":"101"},"agent":{"name":"piHole","type":"packetbeat","version":"8.7.1","ephemeral_id":"f64f34f9-15e3-4717-8349-bc5e342d07c3","id":"9d8db289-3bc9-40d3-92cb-2bd2d9f9434b"},"source":{"ip":"192.168.100.3","port":"52260","bytes":"45"},"method":"QUERY","type":"dns","related":{"ip":["192.168.100.3","1.1.1.3","2606:4700:4400::6812:230f","2606:4700:4400::ac40:98f1"]},"destination":{"ip":"1.1.1.3","port":"53","bytes":"101"},"resource":"api.coinbase.com","dns":{"authorities_count":"0","op_code":"QUERY","opt":{"udp_size":"1232","ext_rcode":"NOERROR","do":"true","version":"0"},"additionals_count":"0","header_flags":["RD","RA","DO"],"resolved_ip":["2606:4700:4400::6812:230f","2606:4700:4400::ac40:98f1"],"flags":{"truncated_response":"false","recursion_desired":"true","recursion_available":"true","authentic_data":"false","checking_disabled":"false","authoritative":"false"},"response_code":"NOERROR","question":{"name":"api.coinbase.com","type":"AAAA","class":"IN","etld_plus_one":"coinbase.com","registered_domain":"coinbase.com","top_level_domain":"com","subdomain":"api"},"answers":[{"type":"AAAA","class":"IN","ttl":"300","data":"2606:4700:4400::6812:230f","name":"api.coinbase.com"},{"ttl":"300","data":"2606:4700:4400::ac40:98f1","name":"api.coinbase.com","type":"AAAA","class":"IN"}],"type":"answer","id":"57215","answers_count":"2"},"ecs":{"version":"8.0.0"},"network":{"type":"ipv4","transport":"udp","protocol":"dns","direction":"egress","community_id":"1:cHbmaBX78sZuvoLLR5j5BGNbP8s=","bytes":"146"},"query":"class IN, type AAAA, api.coinbase.com","event":{"end":"2025-05-23T20:24:33.897Z","kind":"event","category":["network"],"type":["connection","protocol"],"dataset":"dns","duration":"17582186","start":"2025-05-23T20:24:33.880Z"},"host":{"hostname":"piHole","architecture":"x86_64","os":{"codename":"bullseye","type":"linux","platform":"debian","version":"11 (bullseye)","family":"debian","name":"Debian GNU/Linux","kernel":"5.10.0-21-amd64"},"id":"8986bcccef884a1ebe34f1ccd31b4f50","containerized":"false","ip":["192.168.100.3","fe80::20c:29ff:fe09:d59b"],"mac":["00-0C-29-09-D5-9B"],"name":"piHole"}},"location":"/tmp/packetbeat/packetbeat-20250523-90.ndjson"}',
1106
+ dns_answer: "2606:4700:4400::6812:230f, 2606:4700:4400::ac40:98f1",
1107
+ data_dns_id: "57215",
1108
+ src_port: "52260",
1109
+ manager_name: "ASHWZHMA",
1110
+ data_dns_question_top_level_domain: "com",
1111
+ data_network_direction: "egress",
1112
+ data_event_end: "2025-05-23T20:24:33.897Z",
1113
+ data_agent_name: "piHole",
1114
+ data_client_ip: "192.168.100.3",
1115
+ data_server_bytes: "101",
1116
+ data_dns_flags_authoritative: "false",
1117
+ data_type: "dns",
1118
+ data_dns_header_flags: "RD, RA, DO",
1119
+ data_dns_flags_checking_disabled: "false",
1120
+ location: "/tmp/packetbeat/packetbeat-20250523-90.ndjson",
1121
+ "data_@metadata_version": "8.7.1",
1122
+ data_host_os_name: "Debian GNU/Linux",
1123
+ rule_group3: "dns",
1124
+ msg_timestamp: "2025-05-23T20:24:36.268Z",
1125
+ rule_group2: "packetbeat",
1126
+ rule_group1: "linux"
1127
+ },
1128
+ {
1129
+ data_source_ip: "192.168.100.1",
1130
+ data_host_architecture: "x86_64",
1131
+ agent_id: "032",
1132
+ agent_name: "piHole",
1133
+ gl2_remote_ip: "10.255.255.13",
1134
+ data_resource: "github.com",
1135
+ agent_labels_customer: "00001",
1136
+ data_ecs_version: "8.0.0",
1137
+ timestamp_utc: "2025-05-23T20:24:31.373Z",
1138
+ data_host_os_codename: "bullseye",
1139
+ syslog_type: "wazuh",
1140
+ gl2_source_node: "3b68efa4-3319-4885-a38f-c944f0fcf191",
1141
+ id: "1748031874.83778122",
1142
+ data_dns_question_etld_plus_one: "github.com",
1143
+ data_server_port: "53",
1144
+ rule_mitre_tactic: "Command and Control",
1145
+ gl2_accounted_message_size: 5977,
1146
+ data_agent_type: "packetbeat",
1147
+ streams: ["660320f176ca320e8393f057"],
1148
+ rule_mitre_id: "T1071",
1149
+ data_destination_bytes: "55",
1150
+ data_event_dataset: "dns",
1151
+ "data_@metadata_beat": "packetbeat",
1152
+ agent_ip: "192.168.100.3",
1153
+ data_source_port: "12080",
1154
+ data_host_id: "8986bcccef884a1ebe34f1ccd31b4f50",
1155
+ data_event_kind: "event",
1156
+ data_network_protocol: "dns",
1157
+ dns_response_code: "NOERROR",
1158
+ dns_query: "github.com",
1159
+ data_dns_response_code: "NOERROR",
1160
+ data_network_community_id: "1:aPgg+uDBf3W03gGqIHpeYZ0dTWE=",
1161
+ data_dns_flags_truncated_response: "false",
1162
+ rule_mail: false,
1163
+ data_dns_opt_udp_size: "1232",
1164
+ data_event_category: "network",
1165
+ data_dns_flags_recursion_available: "true",
1166
+ data_dns_opt_version: "0",
1167
+ timestamp: "2025-05-23 20:24:38.056",
1168
+ data_host_mac: "00-0C-29-09-D5-9B",
1169
+ data_agent_id: "9d8db289-3bc9-40d3-92cb-2bd2d9f9434b",
1170
+ data_destination_port: "53",
1171
+ data_dns_type: "answer",
1172
+ traffic_direction: "ingress",
1173
+ rule_id: "200300",
1174
+ data_dns_question_class: "IN",
1175
+ cluster_node: "ASHWZHMA.socfortress.local",
1176
+ dst_port: "53",
1177
+ "data_@timestamp": "2025-05-23T20:24:31.373Z",
1178
+ data_host_os_platform: "debian",
1179
+ data_event_duration: "15844018",
1180
+ data_host_name: "piHole",
1181
+ data_dns_flags_recursion_desired: "true",
1182
+ gl2_remote_port: 39928,
1183
+ data_host_os_type: "linux",
1184
+ source: "10.255.255.13",
1185
+ gl2_source_input: "660320f176ca320e8393f030",
1186
+ rule_level: 3,
1187
+ data_event_type: "connection, protocol",
1188
+ data_host_os_family: "debian",
1189
+ data_dns_additionals_count: "0",
1190
+ data_dns_flags_authentic_data: "false",
1191
+ protocol: "udp",
1192
+ data_dns_answers: "{ttl=54, data=140.82.114.4, name=github.com, type=A, class=IN}",
1193
+ data_agent_ephemeral_id: "f64f34f9-15e3-4717-8349-bc5e342d07c3",
1194
+ data_event_start: "2025-05-23T20:24:31.373Z",
1195
+ rule_description: "Linux: DNS Query to github.com",
1196
+ data_agent_version: "8.7.1",
1197
+ data_related_ip: "192.168.100.1, 192.168.100.3, 140.82.114.4",
1198
+ data_status: "OK",
1199
+ data_query: "class IN, type A, github.com",
1200
+ "data_@metadata_type": "_doc",
1201
+ data_method: "QUERY",
1202
+ data_dns_question_registered_domain: "github.com",
1203
+ data_server_ip: "192.168.100.3",
1204
+ gl2_message_id: "01JVZD3CX8DWEFZMWSK79H3XSX",
1205
+ data_dns_answers_count: "1",
1206
+ data_network_type: "ipv4",
1207
+ data_dns_opt_ext_rcode: "NOERROR",
1208
+ data_client_port: "12080",
1209
+ data_network_bytes: "94",
1210
+ data_dns_resolved_ip: "140.82.114.4",
1211
+ data_host_containerized: "false",
1212
+ true: 1748031874.954571,
1213
+ data_host_hostname: "piHole",
1214
+ rule_groups: "linux, packetbeat, dns",
1215
+ data_client_bytes: "39",
1216
+ data_dns_question_type: "A",
1217
+ data_host_ip: "192.168.100.3, fe80::20c:29ff:fe09:d59b",
1218
+ data_destination_ip: "192.168.100.3",
1219
+ rule_mitre_technique: "Application Layer Protocol",
1220
+ rule_firedtimes: 291,
1221
+ data_network_transport: "udp",
1222
+ dst_ip: "192.168.100.3",
1223
+ src_ip: "192.168.100.1",
1224
+ decoder_name: "json",
1225
+ syslog_level: "INFO",
1226
+ data_dns_op_code: "QUERY",
1227
+ data_host_os_version: "11 (bullseye)",
1228
+ data_host_os_kernel: "5.10.0-21-amd64",
1229
+ cluster_name: "socfortress",
1230
+ data_source_bytes: "39",
1231
+ gl2_processing_error:
1232
+ 'Replaced invalid timestamp value in message <f2fac461-3813-11f0-91aa-8600007a2218> with current time - Value <2025-05-23T20:24:34.266+0000> caused exception: Invalid format: "2025-05-23T20:24:34.266+0000" is malformed at "T20:24:34.266+0000".',
1233
+ data_dns_opt_do: "true",
1234
+ data_dns_authorities_count: "0",
1235
+ data_dns_question_name: "github.com",
1236
+ message:
1237
+ '{"true":1748031874.954571,"timestamp":"2025-05-23T20:24:34.266+0000","rule":{"level":3,"description":"Linux: DNS Query to github.com","id":"200300","mitre":{"id":["T1071"],"tactic":["Command and Control"],"technique":["Application Layer Protocol"]},"firedtimes":291,"mail":false,"groups":["linux","packetbeat","dns"]},"agent":{"id":"032","name":"piHole","ip":"192.168.100.3","labels":{"customer":"00001"}},"manager":{"name":"ASHWZHMA"},"id":"1748031874.83778122","cluster":{"name":"socfortress","node":"ASHWZHMA.socfortress.local"},"decoder":{"name":"json"},"data":{"status":"OK","@timestamp":"2025-05-23T20:24:31.373Z","@metadata":{"beat":"packetbeat","type":"_doc","version":"8.7.1"},"agent":{"ephemeral_id":"f64f34f9-15e3-4717-8349-bc5e342d07c3","id":"9d8db289-3bc9-40d3-92cb-2bd2d9f9434b","name":"piHole","type":"packetbeat","version":"8.7.1"},"host":{"os":{"codename":"bullseye","type":"linux","platform":"debian","version":"11 (bullseye)","family":"debian","name":"Debian GNU/Linux","kernel":"5.10.0-21-amd64"},"id":"8986bcccef884a1ebe34f1ccd31b4f50","containerized":"false","ip":["192.168.100.3","fe80::20c:29ff:fe09:d59b"],"mac":["00-0C-29-09-D5-9B"],"name":"piHole","hostname":"piHole","architecture":"x86_64"},"type":"dns","destination":{"bytes":"55","ip":"192.168.100.3","port":"53"},"client":{"bytes":"39","ip":"192.168.100.1","port":"12080"},"method":"QUERY","dns":{"additionals_count":"0","type":"answer","flags":{"authoritative":"false","truncated_response":"false","recursion_desired":"true","recursion_available":"true","authentic_data":"false","checking_disabled":"false"},"header_flags":["RD","RA","DO"],"resolved_ip":["140.82.114.4"],"op_code":"QUERY","authorities_count":"0","question":{"name":"github.com","type":"A","class":"IN","etld_plus_one":"github.com","registered_domain":"github.com","top_level_domain":"com"},"opt":{"ext_rcode":"NOERROR","do":"true","version":"0","udp_size":"1232"},"answers_count":"1","answers":[{"ttl":"54","data":"140.82.114.4","name":"github.com","type":"A","class":"IN"}],"id":"15400","response_code":"NOERROR"},"ecs":{"version":"8.0.0"},"source":{"port":"12080","bytes":"39","ip":"192.168.100.1"},"network":{"protocol":"dns","direction":"ingress","community_id":"1:aPgg+uDBf3W03gGqIHpeYZ0dTWE=","bytes":"94","type":"ipv4","transport":"udp"},"query":"class IN, type A, github.com","resource":"github.com","event":{"start":"2025-05-23T20:24:31.373Z","end":"2025-05-23T20:24:31.389Z","kind":"event","category":["network"],"type":["connection","protocol"],"dataset":"dns","duration":"15844018"},"server":{"ip":"192.168.100.3","port":"53","bytes":"55"},"related":{"ip":["192.168.100.1","192.168.100.3","140.82.114.4"]}},"location":"/tmp/packetbeat/packetbeat-20250523-90.ndjson"}',
1238
+ dns_answer: "140.82.114.4",
1239
+ data_dns_id: "15400",
1240
+ src_port: "12080",
1241
+ manager_name: "ASHWZHMA",
1242
+ data_dns_question_top_level_domain: "com",
1243
+ data_network_direction: "ingress",
1244
+ data_event_end: "2025-05-23T20:24:31.389Z",
1245
+ data_agent_name: "piHole",
1246
+ data_client_ip: "192.168.100.1",
1247
+ data_dns_flags_authoritative: "false",
1248
+ data_server_bytes: "55",
1249
+ data_type: "dns",
1250
+ data_dns_header_flags: "RD, RA, DO",
1251
+ data_dns_flags_checking_disabled: "false",
1252
+ location: "/tmp/packetbeat/packetbeat-20250523-90.ndjson",
1253
+ "data_@metadata_version": "8.7.1",
1254
+ data_host_os_name: "Debian GNU/Linux",
1255
+ rule_group3: "dns",
1256
+ msg_timestamp: "2025-05-23T20:24:34.266Z",
1257
+ rule_group2: "packetbeat",
1258
+ rule_group1: "linux"
1259
+ },
1260
+ {
1261
+ data_source_ip: "192.168.100.1",
1262
+ data_host_architecture: "x86_64",
1263
+ agent_id: "032",
1264
+ agent_name: "piHole",
1265
+ gl2_remote_ip: "10.255.255.13",
1266
+ data_resource: "default.exp-tas.com",
1267
+ agent_labels_customer: "00001",
1268
+ data_ecs_version: "8.0.0",
1269
+ timestamp_utc: "2025-05-23T20:24:25.086Z",
1270
+ data_host_os_codename: "bullseye",
1271
+ syslog_type: "wazuh",
1272
+ gl2_source_node: "3b68efa4-3319-4885-a38f-c944f0fcf191",
1273
+ id: "1748031866.83767213",
1274
+ data_dns_question_etld_plus_one: "exp-tas.com",
1275
+ data_server_port: "53",
1276
+ rule_mitre_tactic: "Command and Control",
1277
+ gl2_accounted_message_size: 6100,
1278
+ data_agent_type: "packetbeat",
1279
+ streams: ["660320f176ca320e8393f057"],
1280
+ rule_mitre_id: "T1071",
1281
+ data_destination_bytes: "64",
1282
+ data_event_dataset: "dns",
1283
+ "data_@metadata_beat": "packetbeat",
1284
+ agent_ip: "192.168.100.3",
1285
+ data_source_port: "30943",
1286
+ data_host_id: "8986bcccef884a1ebe34f1ccd31b4f50",
1287
+ data_event_kind: "event",
1288
+ data_network_protocol: "dns",
1289
+ dns_response_code: "NOERROR",
1290
+ dns_query: "default.exp-tas.com",
1291
+ data_dns_response_code: "NOERROR",
1292
+ data_network_community_id: "1:vnUwNaG0YFdp/V8rH3Gxab1UxfA=",
1293
+ data_dns_flags_truncated_response: "false",
1294
+ rule_mail: false,
1295
+ data_dns_opt_udp_size: "1232",
1296
+ data_event_category: "network",
1297
+ data_dns_flags_recursion_available: "true",
1298
+ data_dns_opt_version: "0",
1299
+ timestamp: "2025-05-23 20:24:28.691",
1300
+ data_host_mac: "00-0C-29-09-D5-9B",
1301
+ data_agent_id: "9d8db289-3bc9-40d3-92cb-2bd2d9f9434b",
1302
+ data_destination_port: "53",
1303
+ data_dns_type: "answer",
1304
+ traffic_direction: "ingress",
1305
+ rule_id: "200300",
1306
+ data_dns_question_class: "IN",
1307
+ cluster_node: "ASHWZHMA.socfortress.local",
1308
+ dst_port: "53",
1309
+ "data_@timestamp": "2025-05-23T20:24:25.086Z",
1310
+ data_event_duration: "59506",
1311
+ data_host_os_platform: "debian",
1312
+ data_dns_flags_recursion_desired: "true",
1313
+ data_host_name: "piHole",
1314
+ data_dns_question_subdomain: "default",
1315
+ gl2_remote_port: 40570,
1316
+ data_host_os_type: "linux",
1317
+ source: "10.255.255.13",
1318
+ gl2_source_input: "660320f176ca320e8393f030",
1319
+ rule_level: 3,
1320
+ data_event_type: "connection, protocol",
1321
+ data_host_os_family: "debian",
1322
+ data_dns_additionals_count: "0",
1323
+ data_dns_flags_authentic_data: "false",
1324
+ protocol: "udp",
1325
+ data_dns_answers: "{name=default.exp-tas.com, type=A, class=IN, ttl=2, data=0.0.0.0}",
1326
+ data_event_start: "2025-05-23T20:24:25.086Z",
1327
+ data_agent_ephemeral_id: "f64f34f9-15e3-4717-8349-bc5e342d07c3",
1328
+ rule_description: "Linux: DNS Query to default.exp-tas.com",
1329
+ data_related_ip: "192.168.100.1, 192.168.100.3, 0.0.0.0",
1330
+ data_agent_version: "8.7.1",
1331
+ data_status: "OK",
1332
+ data_query: "class IN, type A, default.exp-tas.com",
1333
+ "data_@metadata_type": "_doc",
1334
+ data_dns_question_registered_domain: "exp-tas.com",
1335
+ data_method: "QUERY",
1336
+ data_server_ip: "192.168.100.3",
1337
+ gl2_message_id: "01JVZD33RKQ2PMXYA8A89RSNK1",
1338
+ data_dns_answers_count: "1",
1339
+ data_network_type: "ipv4",
1340
+ data_dns_opt_ext_rcode: "NOERROR",
1341
+ data_client_port: "30943",
1342
+ data_network_bytes: "112",
1343
+ data_dns_resolved_ip: "0.0.0.0",
1344
+ data_host_containerized: "false",
1345
+ true: 1748031866.296917,
1346
+ data_host_hostname: "piHole",
1347
+ rule_groups: "linux, packetbeat, dns",
1348
+ data_client_bytes: "48",
1349
+ data_dns_question_type: "A",
1350
+ data_destination_ip: "192.168.100.3",
1351
+ data_host_ip: "192.168.100.3, fe80::20c:29ff:fe09:d59b",
1352
+ rule_mitre_technique: "Application Layer Protocol",
1353
+ rule_firedtimes: 287,
1354
+ data_network_transport: "udp",
1355
+ dst_ip: "192.168.100.3",
1356
+ src_ip: "192.168.100.1",
1357
+ decoder_name: "json",
1358
+ syslog_level: "INFO",
1359
+ data_dns_op_code: "QUERY",
1360
+ data_host_os_version: "11 (bullseye)",
1361
+ data_host_os_kernel: "5.10.0-21-amd64",
1362
+ cluster_name: "socfortress",
1363
+ data_source_bytes: "48",
1364
+ gl2_processing_error:
1365
+ 'Replaced invalid timestamp value in message <ed04bc54-3813-11f0-91aa-8600007a2218> with current time - Value <2025-05-23T20:24:26.259+0000> caused exception: Invalid format: "2025-05-23T20:24:26.259+0000" is malformed at "T20:24:26.259+0000".',
1366
+ data_dns_opt_do: "true",
1367
+ data_dns_authorities_count: "0",
1368
+ data_dns_question_name: "default.exp-tas.com",
1369
+ message:
1370
+ '{"true":1748031866.296917,"timestamp":"2025-05-23T20:24:26.259+0000","rule":{"level":3,"description":"Linux: DNS Query to default.exp-tas.com","id":"200300","mitre":{"id":["T1071"],"tactic":["Command and Control"],"technique":["Application Layer Protocol"]},"firedtimes":287,"mail":false,"groups":["linux","packetbeat","dns"]},"agent":{"id":"032","name":"piHole","ip":"192.168.100.3","labels":{"customer":"00001"}},"manager":{"name":"ASHWZHMA"},"id":"1748031866.83767213","cluster":{"name":"socfortress","node":"ASHWZHMA.socfortress.local"},"decoder":{"name":"json"},"data":{"status":"OK","@timestamp":"2025-05-23T20:24:25.086Z","@metadata":{"beat":"packetbeat","type":"_doc","version":"8.7.1"},"resource":"default.exp-tas.com","dns":{"answers":[{"name":"default.exp-tas.com","type":"A","class":"IN","ttl":"2","data":"0.0.0.0"}],"resolved_ip":["0.0.0.0"],"additionals_count":"0","flags":{"authentic_data":"false","checking_disabled":"false","authoritative":"true","truncated_response":"false","recursion_desired":"true","recursion_available":"true"},"opt":{"do":"true","version":"0","udp_size":"1232","ext_rcode":"NOERROR"},"answers_count":"1","type":"answer","question":{"name":"default.exp-tas.com","type":"A","class":"IN","etld_plus_one":"exp-tas.com","registered_domain":"exp-tas.com","top_level_domain":"com","subdomain":"default"},"authorities_count":"0","id":"3874","response_code":"NOERROR","op_code":"QUERY","header_flags":["AA","RD","RA","DO"]},"query":"class IN, type A, default.exp-tas.com","network":{"transport":"udp","protocol":"dns","direction":"ingress","community_id":"1:vnUwNaG0YFdp/V8rH3Gxab1UxfA=","bytes":"112","type":"ipv4"},"event":{"duration":"59506","start":"2025-05-23T20:24:25.086Z","end":"2025-05-23T20:24:25.086Z","kind":"event","category":["network"],"type":["connection","protocol"],"dataset":"dns"},"method":"QUERY","destination":{"ip":"192.168.100.3","port":"53","bytes":"64"},"client":{"bytes":"48","ip":"192.168.100.1","port":"30943"},"host":{"containerized":"false","ip":["192.168.100.3","fe80::20c:29ff:fe09:d59b"],"mac":["00-0C-29-09-D5-9B"],"name":"piHole","hostname":"piHole","architecture":"x86_64","os":{"type":"linux","platform":"debian","version":"11 (bullseye)","family":"debian","name":"Debian GNU/Linux","kernel":"5.10.0-21-amd64","codename":"bullseye"},"id":"8986bcccef884a1ebe34f1ccd31b4f50"},"type":"dns","source":{"ip":"192.168.100.1","port":"30943","bytes":"48"},"ecs":{"version":"8.0.0"},"related":{"ip":["192.168.100.1","192.168.100.3","0.0.0.0"]},"agent":{"ephemeral_id":"f64f34f9-15e3-4717-8349-bc5e342d07c3","id":"9d8db289-3bc9-40d3-92cb-2bd2d9f9434b","name":"piHole","type":"packetbeat","version":"8.7.1"},"server":{"ip":"192.168.100.3","port":"53","bytes":"64"}},"location":"/tmp/packetbeat/packetbeat-20250523-90.ndjson"}',
1371
+ dns_answer: "0.0.0.0",
1372
+ data_dns_id: "3874",
1373
+ src_port: "30943",
1374
+ manager_name: "ASHWZHMA",
1375
+ data_dns_question_top_level_domain: "com",
1376
+ data_network_direction: "ingress",
1377
+ data_event_end: "2025-05-23T20:24:25.086Z",
1378
+ data_agent_name: "piHole",
1379
+ data_dns_flags_authoritative: "true",
1380
+ data_client_ip: "192.168.100.1",
1381
+ data_server_bytes: "64",
1382
+ data_dns_header_flags: "AA, RD, RA, DO",
1383
+ data_type: "dns",
1384
+ data_dns_flags_checking_disabled: "false",
1385
+ location: "/tmp/packetbeat/packetbeat-20250523-90.ndjson",
1386
+ "data_@metadata_version": "8.7.1",
1387
+ data_host_os_name: "Debian GNU/Linux",
1388
+ rule_group3: "dns",
1389
+ msg_timestamp: "2025-05-23T20:24:26.259Z",
1390
+ rule_group2: "packetbeat",
1391
+ rule_group1: "linux"
1392
+ },
1393
+ {
1394
+ data_source_ip: "192.168.100.3",
1395
+ data_host_architecture: "x86_64",
1396
+ agent_id: "032",
1397
+ agent_name: "piHole",
1398
+ gl2_remote_ip: "10.255.255.13",
1399
+ data_resource: "api.github.com",
1400
+ agent_labels_customer: "00001",
1401
+ data_ecs_version: "8.0.0",
1402
+ timestamp_utc: "2025-05-23T20:24:25.391Z",
1403
+ data_host_os_codename: "bullseye",
1404
+ syslog_type: "wazuh",
1405
+ gl2_source_node: "3b68efa4-3319-4885-a38f-c944f0fcf191",
1406
+ id: "1748031866.83769971",
1407
+ data_server_port: "53",
1408
+ data_dns_question_etld_plus_one: "github.com",
1409
+ rule_mitre_tactic: "Command and Control",
1410
+ gl2_accounted_message_size: 6026,
1411
+ data_agent_type: "packetbeat",
1412
+ streams: ["660320f176ca320e8393f057"],
1413
+ rule_mitre_id: "T1071",
1414
+ data_destination_bytes: "59",
1415
+ data_event_dataset: "dns",
1416
+ "data_@metadata_beat": "packetbeat",
1417
+ agent_ip: "192.168.100.3",
1418
+ data_source_port: "41851",
1419
+ data_host_id: "8986bcccef884a1ebe34f1ccd31b4f50",
1420
+ data_event_kind: "event",
1421
+ data_network_protocol: "dns",
1422
+ dns_response_code: "NOERROR",
1423
+ dns_query: "api.github.com",
1424
+ data_dns_response_code: "NOERROR",
1425
+ data_network_community_id: "1:Qv+ZQxBe6Mp2YnOq4At/7f+jvHM=",
1426
+ data_dns_flags_truncated_response: "false",
1427
+ rule_mail: false,
1428
+ data_dns_opt_udp_size: "1232",
1429
+ data_event_category: "network",
1430
+ data_dns_flags_recursion_available: "true",
1431
+ data_dns_opt_version: "0",
1432
+ timestamp: "2025-05-23 20:24:28.055",
1433
+ data_host_mac: "00-0C-29-09-D5-9B",
1434
+ data_agent_id: "9d8db289-3bc9-40d3-92cb-2bd2d9f9434b",
1435
+ data_destination_port: "53",
1436
+ data_dns_type: "answer",
1437
+ traffic_direction: "egress",
1438
+ rule_id: "200300",
1439
+ data_dns_question_class: "IN",
1440
+ cluster_node: "ASHWZHMA.socfortress.local",
1441
+ dst_port: "53",
1442
+ "data_@timestamp": "2025-05-23T20:24:25.391Z",
1443
+ data_host_os_platform: "debian",
1444
+ data_event_duration: "12390708",
1445
+ data_host_name: "piHole",
1446
+ data_dns_flags_recursion_desired: "true",
1447
+ data_dns_question_subdomain: "api",
1448
+ gl2_remote_port: 40570,
1449
+ data_host_os_type: "linux",
1450
+ source: "10.255.255.13",
1451
+ gl2_source_input: "660320f176ca320e8393f030",
1452
+ rule_level: 3,
1453
+ data_event_type: "connection, protocol",
1454
+ data_host_os_family: "debian",
1455
+ data_dns_additionals_count: "0",
1456
+ data_dns_flags_authentic_data: "false",
1457
+ protocol: "udp",
1458
+ data_dns_answers: "{class=IN, ttl=45, data=140.82.112.6, name=api.github.com, type=A}",
1459
+ data_agent_ephemeral_id: "f64f34f9-15e3-4717-8349-bc5e342d07c3",
1460
+ data_event_start: "2025-05-23T20:24:25.391Z",
1461
+ rule_description: "Linux: DNS Query to api.github.com",
1462
+ data_agent_version: "8.7.1",
1463
+ data_related_ip: "192.168.100.3, 1.1.1.3, 140.82.112.6",
1464
+ data_status: "OK",
1465
+ data_query: "class IN, type A, api.github.com",
1466
+ "data_@metadata_type": "_doc",
1467
+ data_method: "QUERY",
1468
+ data_server_ip: "1.1.1.3",
1469
+ data_dns_question_registered_domain: "github.com",
1470
+ gl2_message_id: "01JVZD334QAK44WW31X0PRKNCW",
1471
+ data_dns_answers_count: "1",
1472
+ data_network_type: "ipv4",
1473
+ data_dns_opt_ext_rcode: "NOERROR",
1474
+ data_client_port: "41851",
1475
+ data_network_bytes: "102",
1476
+ data_dns_resolved_ip: "140.82.112.6",
1477
+ data_host_containerized: "false",
1478
+ true: 1748031866.297121,
1479
+ data_host_hostname: "piHole",
1480
+ rule_groups: "linux, packetbeat, dns",
1481
+ data_client_bytes: "43",
1482
+ data_dns_question_type: "A",
1483
+ data_host_ip: "192.168.100.3, fe80::20c:29ff:fe09:d59b",
1484
+ data_destination_ip: "1.1.1.3",
1485
+ rule_mitre_technique: "Application Layer Protocol",
1486
+ rule_firedtimes: 289,
1487
+ data_network_transport: "udp",
1488
+ dst_ip: "1.1.1.3",
1489
+ src_ip: "192.168.100.3",
1490
+ decoder_name: "json",
1491
+ syslog_level: "INFO",
1492
+ data_dns_op_code: "QUERY",
1493
+ data_host_os_version: "11 (bullseye)",
1494
+ data_host_os_kernel: "5.10.0-21-amd64",
1495
+ cluster_name: "socfortress",
1496
+ data_source_bytes: "43",
1497
+ gl2_processing_error:
1498
+ 'Replaced invalid timestamp value in message <ed04e360-3813-11f0-91aa-8600007a2218> with current time - Value <2025-05-23T20:24:26.296+0000> caused exception: Invalid format: "2025-05-23T20:24:26.296+0000" is malformed at "T20:24:26.296+0000".',
1499
+ data_dns_opt_do: "true",
1500
+ data_dns_authorities_count: "0",
1501
+ data_dns_question_name: "api.github.com",
1502
+ message:
1503
+ '{"true":1748031866.297121,"timestamp":"2025-05-23T20:24:26.296+0000","rule":{"level":3,"description":"Linux: DNS Query to api.github.com","id":"200300","mitre":{"id":["T1071"],"tactic":["Command and Control"],"technique":["Application Layer Protocol"]},"firedtimes":289,"mail":false,"groups":["linux","packetbeat","dns"]},"agent":{"id":"032","name":"piHole","ip":"192.168.100.3","labels":{"customer":"00001"}},"manager":{"name":"ASHWZHMA"},"id":"1748031866.83769971","cluster":{"name":"socfortress","node":"ASHWZHMA.socfortress.local"},"decoder":{"name":"json"},"data":{"status":"OK","@timestamp":"2025-05-23T20:24:25.391Z","@metadata":{"beat":"packetbeat","type":"_doc","version":"8.7.1"},"host":{"architecture":"x86_64","os":{"version":"11 (bullseye)","family":"debian","name":"Debian GNU/Linux","kernel":"5.10.0-21-amd64","codename":"bullseye","type":"linux","platform":"debian"},"name":"piHole","id":"8986bcccef884a1ebe34f1ccd31b4f50","containerized":"false","ip":["192.168.100.3","fe80::20c:29ff:fe09:d59b"],"mac":["00-0C-29-09-D5-9B"],"hostname":"piHole"},"agent":{"name":"piHole","type":"packetbeat","version":"8.7.1","ephemeral_id":"f64f34f9-15e3-4717-8349-bc5e342d07c3","id":"9d8db289-3bc9-40d3-92cb-2bd2d9f9434b"},"event":{"start":"2025-05-23T20:24:25.391Z","end":"2025-05-23T20:24:25.403Z","kind":"event","category":["network"],"type":["connection","protocol"],"dataset":"dns","duration":"12390708"},"resource":"api.github.com","client":{"ip":"192.168.100.3","port":"41851","bytes":"43"},"related":{"ip":["192.168.100.3","1.1.1.3","140.82.112.6"]},"method":"QUERY","source":{"ip":"192.168.100.3","port":"41851","bytes":"43"},"server":{"ip":"1.1.1.3","port":"53","bytes":"59"},"ecs":{"version":"8.0.0"},"dns":{"additionals_count":"0","resolved_ip":["140.82.112.6"],"op_code":"QUERY","flags":{"checking_disabled":"false","authoritative":"false","truncated_response":"false","recursion_desired":"true","recursion_available":"true","authentic_data":"false"},"opt":{"do":"true","version":"0","udp_size":"1232","ext_rcode":"NOERROR"},"answers_count":"1","answers":[{"class":"IN","ttl":"45","data":"140.82.112.6","name":"api.github.com","type":"A"}],"authorities_count":"0","type":"answer","id":"21292","header_flags":["RD","RA","DO"],"question":{"registered_domain":"github.com","top_level_domain":"com","subdomain":"api","name":"api.github.com","type":"A","class":"IN","etld_plus_one":"github.com"},"response_code":"NOERROR"},"network":{"direction":"egress","community_id":"1:Qv+ZQxBe6Mp2YnOq4At/7f+jvHM=","bytes":"102","type":"ipv4","transport":"udp","protocol":"dns"},"type":"dns","destination":{"bytes":"59","ip":"1.1.1.3","port":"53"},"query":"class IN, type A, api.github.com"},"location":"/tmp/packetbeat/packetbeat-20250523-90.ndjson"}',
1504
+ dns_answer: "140.82.112.6",
1505
+ data_dns_id: "21292",
1506
+ src_port: "41851",
1507
+ manager_name: "ASHWZHMA",
1508
+ data_dns_question_top_level_domain: "com",
1509
+ data_network_direction: "egress",
1510
+ data_event_end: "2025-05-23T20:24:25.403Z",
1511
+ data_agent_name: "piHole",
1512
+ data_client_ip: "192.168.100.3",
1513
+ data_server_bytes: "59",
1514
+ data_dns_flags_authoritative: "false",
1515
+ data_dns_header_flags: "RD, RA, DO",
1516
+ data_type: "dns",
1517
+ data_dns_flags_checking_disabled: "false",
1518
+ location: "/tmp/packetbeat/packetbeat-20250523-90.ndjson",
1519
+ "data_@metadata_version": "8.7.1",
1520
+ data_host_os_name: "Debian GNU/Linux",
1521
+ rule_group3: "dns",
1522
+ msg_timestamp: "2025-05-23T20:24:26.296Z",
1523
+ rule_group2: "packetbeat",
1524
+ rule_group1: "linux"
1525
+ },
1526
+ {
1527
+ data_source_ip: "192.168.100.1",
1528
+ data_host_architecture: "x86_64",
1529
+ agent_id: "032",
1530
+ agent_name: "piHole",
1531
+ gl2_remote_ip: "10.255.255.13",
1532
+ data_resource: "api.github.com",
1533
+ agent_labels_customer: "00001",
1534
+ data_ecs_version: "8.0.0",
1535
+ timestamp_utc: "2025-05-23T20:24:25.391Z",
1536
+ data_host_os_codename: "bullseye",
1537
+ syslog_type: "wazuh",
1538
+ gl2_source_node: "3b68efa4-3319-4885-a38f-c944f0fcf191",
1539
+ id: "1748031866.83772695",
1540
+ data_dns_question_etld_plus_one: "github.com",
1541
+ data_server_port: "53",
1542
+ rule_mitre_tactic: "Command and Control",
1543
+ gl2_accounted_message_size: 6069,
1544
+ data_agent_type: "packetbeat",
1545
+ streams: ["660320f176ca320e8393f057"],
1546
+ rule_mitre_id: "T1071",
1547
+ data_destination_bytes: "59",
1548
+ data_event_dataset: "dns",
1549
+ "data_@metadata_beat": "packetbeat",
1550
+ agent_ip: "192.168.100.3",
1551
+ data_source_port: "16098",
1552
+ data_host_id: "8986bcccef884a1ebe34f1ccd31b4f50",
1553
+ data_event_kind: "event",
1554
+ data_network_protocol: "dns",
1555
+ dns_response_code: "NOERROR",
1556
+ dns_query: "api.github.com",
1557
+ data_dns_response_code: "NOERROR",
1558
+ data_network_community_id: "1:SAwm+c+9j+fNsGX6uGF/2a4zktU=",
1559
+ data_dns_flags_truncated_response: "false",
1560
+ rule_mail: false,
1561
+ data_dns_opt_udp_size: "1232",
1562
+ data_event_category: "network",
1563
+ data_dns_flags_recursion_available: "true",
1564
+ data_dns_opt_version: "0",
1565
+ timestamp: "2025-05-23 20:24:28.055",
1566
+ data_host_mac: "00-0C-29-09-D5-9B",
1567
+ data_agent_id: "9d8db289-3bc9-40d3-92cb-2bd2d9f9434b",
1568
+ data_destination_port: "53",
1569
+ data_dns_type: "answer",
1570
+ traffic_direction: "ingress",
1571
+ rule_id: "200300",
1572
+ data_dns_question_class: "IN",
1573
+ cluster_node: "ASHWZHMA.socfortress.local",
1574
+ dst_port: "53",
1575
+ "data_@timestamp": "2025-05-23T20:24:25.391Z",
1576
+ data_event_duration: "12538930",
1577
+ data_host_os_platform: "debian",
1578
+ data_dns_flags_recursion_desired: "true",
1579
+ data_host_name: "piHole",
1580
+ data_dns_question_subdomain: "api",
1581
+ gl2_remote_port: 40570,
1582
+ data_host_os_type: "linux",
1583
+ source: "10.255.255.13",
1584
+ gl2_source_input: "660320f176ca320e8393f030",
1585
+ rule_level: 3,
1586
+ data_event_type: "connection, protocol",
1587
+ data_host_os_family: "debian",
1588
+ data_dns_additionals_count: "0",
1589
+ data_dns_flags_authentic_data: "false",
1590
+ protocol: "udp",
1591
+ data_dns_answers: "{data=140.82.112.6, name=api.github.com, type=A, class=IN, ttl=45}",
1592
+ data_agent_ephemeral_id: "f64f34f9-15e3-4717-8349-bc5e342d07c3",
1593
+ data_event_start: "2025-05-23T20:24:25.391Z",
1594
+ rule_description: "Linux: DNS Query to api.github.com",
1595
+ data_agent_version: "8.7.1",
1596
+ data_related_ip: "192.168.100.1, 192.168.100.3, 140.82.112.6",
1597
+ data_status: "OK",
1598
+ data_query: "class IN, type A, api.github.com",
1599
+ "data_@metadata_type": "_doc",
1600
+ data_method: "QUERY",
1601
+ data_dns_question_registered_domain: "github.com",
1602
+ data_server_ip: "192.168.100.3",
1603
+ gl2_message_id: "01JVZD334Q5T1XWE1HMBFF0DVX",
1604
+ data_dns_answers_count: "1",
1605
+ data_network_type: "ipv4",
1606
+ data_dns_opt_ext_rcode: "NOERROR",
1607
+ data_client_port: "16098",
1608
+ data_network_bytes: "102",
1609
+ data_dns_resolved_ip: "140.82.112.6",
1610
+ data_host_containerized: "false",
1611
+ true: 1748031866.953483,
1612
+ data_host_hostname: "piHole",
1613
+ rule_groups: "linux, packetbeat, dns",
1614
+ data_client_bytes: "43",
1615
+ data_dns_question_type: "A",
1616
+ data_host_ip: "192.168.100.3, fe80::20c:29ff:fe09:d59b",
1617
+ data_destination_ip: "192.168.100.3",
1618
+ rule_mitre_technique: "Application Layer Protocol",
1619
+ rule_firedtimes: 288,
1620
+ data_network_transport: "udp",
1621
+ dst_ip: "192.168.100.3",
1622
+ src_ip: "192.168.100.1",
1623
+ decoder_name: "json",
1624
+ syslog_level: "INFO",
1625
+ data_dns_op_code: "QUERY",
1626
+ data_host_os_version: "11 (bullseye)",
1627
+ data_host_os_kernel: "5.10.0-21-amd64",
1628
+ cluster_name: "socfortress",
1629
+ data_source_bytes: "43",
1630
+ gl2_processing_error:
1631
+ 'Replaced invalid timestamp value in message <ed04e361-3813-11f0-91aa-8600007a2218> with current time - Value <2025-05-23T20:24:26.296+0000> caused exception: Invalid format: "2025-05-23T20:24:26.296+0000" is malformed at "T20:24:26.296+0000".',
1632
+ data_dns_opt_do: "true",
1633
+ data_dns_authorities_count: "0",
1634
+ data_dns_question_name: "api.github.com",
1635
+ message:
1636
+ '{"true":1748031866.953483,"timestamp":"2025-05-23T20:24:26.296+0000","rule":{"level":3,"description":"Linux: DNS Query to api.github.com","id":"200300","mitre":{"id":["T1071"],"tactic":["Command and Control"],"technique":["Application Layer Protocol"]},"firedtimes":288,"mail":false,"groups":["linux","packetbeat","dns"]},"agent":{"id":"032","name":"piHole","ip":"192.168.100.3","labels":{"customer":"00001"}},"manager":{"name":"ASHWZHMA"},"id":"1748031866.83772695","cluster":{"name":"socfortress","node":"ASHWZHMA.socfortress.local"},"decoder":{"name":"json"},"data":{"status":"OK","@timestamp":"2025-05-23T20:24:25.391Z","@metadata":{"beat":"packetbeat","type":"_doc","version":"8.7.1"},"type":"dns","agent":{"name":"piHole","type":"packetbeat","version":"8.7.1","ephemeral_id":"f64f34f9-15e3-4717-8349-bc5e342d07c3","id":"9d8db289-3bc9-40d3-92cb-2bd2d9f9434b"},"method":"QUERY","dns":{"header_flags":["RD","RA","DO"],"additionals_count":"0","id":"1842","question":{"etld_plus_one":"github.com","registered_domain":"github.com","top_level_domain":"com","subdomain":"api","name":"api.github.com","type":"A","class":"IN"},"answers":[{"data":"140.82.112.6","name":"api.github.com","type":"A","class":"IN","ttl":"45"}],"op_code":"QUERY","response_code":"NOERROR","answers_count":"1","flags":{"checking_disabled":"false","authoritative":"false","truncated_response":"false","recursion_desired":"true","recursion_available":"true","authentic_data":"false"},"resolved_ip":["140.82.112.6"],"authorities_count":"0","type":"answer","opt":{"udp_size":"1232","ext_rcode":"NOERROR","do":"true","version":"0"}},"resource":"api.github.com","network":{"protocol":"dns","direction":"ingress","community_id":"1:SAwm+c+9j+fNsGX6uGF/2a4zktU=","bytes":"102","type":"ipv4","transport":"udp"},"query":"class IN, type A, api.github.com","source":{"ip":"192.168.100.1","port":"16098","bytes":"43"},"related":{"ip":["192.168.100.1","192.168.100.3","140.82.112.6"]},"event":{"dataset":"dns","duration":"12538930","start":"2025-05-23T20:24:25.391Z","end":"2025-05-23T20:24:25.403Z","kind":"event","category":["network"],"type":["connection","protocol"]},"server":{"port":"53","bytes":"59","ip":"192.168.100.3"},"ecs":{"version":"8.0.0"},"host":{"ip":["192.168.100.3","fe80::20c:29ff:fe09:d59b"],"mac":["00-0C-29-09-D5-9B"],"hostname":"piHole","architecture":"x86_64","os":{"version":"11 (bullseye)","family":"debian","name":"Debian GNU/Linux","kernel":"5.10.0-21-amd64","codename":"bullseye","type":"linux","platform":"debian"},"id":"8986bcccef884a1ebe34f1ccd31b4f50","containerized":"false","name":"piHole"},"destination":{"ip":"192.168.100.3","port":"53","bytes":"59"},"client":{"port":"16098","bytes":"43","ip":"192.168.100.1"}},"location":"/tmp/packetbeat/packetbeat-20250523-90.ndjson"}',
1637
+ dns_answer: "140.82.112.6",
1638
+ data_dns_id: "1842",
1639
+ src_port: "16098",
1640
+ manager_name: "ASHWZHMA",
1641
+ data_dns_question_top_level_domain: "com",
1642
+ data_network_direction: "ingress",
1643
+ data_event_end: "2025-05-23T20:24:25.403Z",
1644
+ data_agent_name: "piHole",
1645
+ data_dns_flags_authoritative: "false",
1646
+ data_server_bytes: "59",
1647
+ data_client_ip: "192.168.100.1",
1648
+ data_type: "dns",
1649
+ data_dns_header_flags: "RD, RA, DO",
1650
+ data_dns_flags_checking_disabled: "false",
1651
+ location: "/tmp/packetbeat/packetbeat-20250523-90.ndjson",
1652
+ "data_@metadata_version": "8.7.1",
1653
+ data_host_os_name: "Debian GNU/Linux",
1654
+ rule_group3: "dns",
1655
+ msg_timestamp: "2025-05-23T20:24:26.296Z",
1656
+ rule_group2: "packetbeat",
1657
+ rule_group1: "linux"
1658
+ },
1659
+ {
1660
+ data_source_ip: "192.168.100.3",
1661
+ data_host_architecture: "x86_64",
1662
+ agent_id: "032",
1663
+ agent_name: "piHole",
1664
+ gl2_remote_ip: "10.255.255.13",
1665
+ data_resource: "clientservices.googleapis.com",
1666
+ agent_labels_customer: "00001",
1667
+ data_ecs_version: "8.0.0",
1668
+ timestamp_utc: "2025-05-23T20:24:16.968Z",
1669
+ data_host_os_codename: "bullseye",
1670
+ syslog_type: "wazuh",
1671
+ gl2_source_node: "3b68efa4-3319-4885-a38f-c944f0fcf191",
1672
+ id: "1748031858.83757535",
1673
+ data_dns_question_etld_plus_one: "clientservices.googleapis.com",
1674
+ data_server_port: "53",
1675
+ rule_mitre_tactic: "Command and Control",
1676
+ gl2_accounted_message_size: 6255,
1677
+ data_agent_type: "packetbeat",
1678
+ streams: ["660320f176ca320e8393f057"],
1679
+ rule_mitre_id: "T1071",
1680
+ data_destination_bytes: "74",
1681
+ data_event_dataset: "dns",
1682
+ "data_@metadata_beat": "packetbeat",
1683
+ agent_ip: "192.168.100.3",
1684
+ data_source_port: "39875",
1685
+ data_host_id: "8986bcccef884a1ebe34f1ccd31b4f50",
1686
+ data_event_kind: "event",
1687
+ data_network_protocol: "dns",
1688
+ dns_response_code: "NOERROR",
1689
+ dns_query: "clientservices.googleapis.com",
1690
+ data_dns_response_code: "NOERROR",
1691
+ data_network_community_id: "1:gqNtlcfR7YF76W/Vl1c5Rfg8Tyk=",
1692
+ data_dns_flags_truncated_response: "false",
1693
+ rule_mail: false,
1694
+ data_dns_opt_udp_size: "1232",
1695
+ data_event_category: "network",
1696
+ data_dns_flags_recursion_available: "true",
1697
+ data_dns_opt_version: "0",
1698
+ timestamp: "2025-05-23 20:24:23.055",
1699
+ data_host_mac: "00-0C-29-09-D5-9B",
1700
+ data_agent_id: "9d8db289-3bc9-40d3-92cb-2bd2d9f9434b",
1701
+ data_destination_port: "53",
1702
+ data_dns_type: "answer",
1703
+ traffic_direction: "egress",
1704
+ rule_id: "200300",
1705
+ data_dns_question_class: "IN",
1706
+ cluster_node: "ASHWZHMA.socfortress.local",
1707
+ dst_port: "53",
1708
+ "data_@timestamp": "2025-05-23T20:24:16.968Z",
1709
+ data_event_duration: "12495689",
1710
+ data_host_os_platform: "debian",
1711
+ data_dns_flags_recursion_desired: "true",
1712
+ data_host_name: "piHole",
1713
+ gl2_remote_port: 51720,
1714
+ data_host_os_type: "linux",
1715
+ source: "10.255.255.13",
1716
+ gl2_source_input: "660320f176ca320e8393f030",
1717
+ rule_level: 3,
1718
+ data_event_type: "connection, protocol",
1719
+ data_host_os_family: "debian",
1720
+ data_dns_additionals_count: "0",
1721
+ data_dns_flags_authentic_data: "false",
1722
+ protocol: "udp",
1723
+ data_dns_answers: "{class=IN, ttl=203, data=142.251.186.94, name=clientservices.googleapis.com, type=A}",
1724
+ data_event_start: "2025-05-23T20:24:16.968Z",
1725
+ data_agent_ephemeral_id: "f64f34f9-15e3-4717-8349-bc5e342d07c3",
1726
+ rule_description: "Linux: DNS Query to clientservices.googleapis.com",
1727
+ data_related_ip: "192.168.100.3, 1.1.1.3, 142.251.186.94",
1728
+ data_agent_version: "8.7.1",
1729
+ data_status: "OK",
1730
+ data_query: "class IN, type A, clientservices.googleapis.com",
1731
+ "data_@metadata_type": "_doc",
1732
+ data_dns_question_registered_domain: "clientservices.googleapis.com",
1733
+ data_server_ip: "1.1.1.3",
1734
+ data_method: "QUERY",
1735
+ gl2_message_id: "01JVZD2Y8F9QG7T66B5765KXZ6",
1736
+ data_dns_answers_count: "1",
1737
+ data_network_type: "ipv4",
1738
+ data_dns_opt_ext_rcode: "NOERROR",
1739
+ data_client_port: "39875",
1740
+ data_network_bytes: "132",
1741
+ data_dns_resolved_ip: "142.251.186.94",
1742
+ data_host_containerized: "false",
1743
+ true: 1748031858.256838,
1744
+ data_host_hostname: "piHole",
1745
+ rule_groups: "linux, packetbeat, dns",
1746
+ data_client_bytes: "58",
1747
+ data_dns_question_type: "A",
1748
+ data_host_ip: "192.168.100.3, fe80::20c:29ff:fe09:d59b",
1749
+ data_destination_ip: "1.1.1.3",
1750
+ rule_mitre_technique: "Application Layer Protocol",
1751
+ rule_firedtimes: 284,
1752
+ data_network_transport: "udp",
1753
+ dst_ip: "1.1.1.3",
1754
+ src_ip: "192.168.100.3",
1755
+ decoder_name: "json",
1756
+ syslog_level: "INFO",
1757
+ data_dns_op_code: "QUERY",
1758
+ data_host_os_version: "11 (bullseye)",
1759
+ data_host_os_kernel: "5.10.0-21-amd64",
1760
+ cluster_name: "socfortress",
1761
+ data_source_bytes: "58",
1762
+ gl2_processing_error:
1763
+ 'Replaced invalid timestamp value in message <ea09cbd3-3813-11f0-91aa-8600007a2218> with current time - Value <2025-05-23T20:24:18.256+0000> caused exception: Invalid format: "2025-05-23T20:24:18.256+0000" is malformed at "T20:24:18.256+0000".',
1764
+ data_dns_opt_do: "true",
1765
+ data_dns_authorities_count: "0",
1766
+ data_dns_question_name: "clientservices.googleapis.com",
1767
+ message:
1768
+ '{"true":1748031858.256838,"timestamp":"2025-05-23T20:24:18.256+0000","rule":{"level":3,"description":"Linux: DNS Query to clientservices.googleapis.com","id":"200300","mitre":{"id":["T1071"],"tactic":["Command and Control"],"technique":["Application Layer Protocol"]},"firedtimes":284,"mail":false,"groups":["linux","packetbeat","dns"]},"agent":{"id":"032","name":"piHole","ip":"192.168.100.3","labels":{"customer":"00001"}},"manager":{"name":"ASHWZHMA"},"id":"1748031858.83757535","cluster":{"name":"socfortress","node":"ASHWZHMA.socfortress.local"},"decoder":{"name":"json"},"data":{"status":"OK","@timestamp":"2025-05-23T20:24:16.968Z","@metadata":{"beat":"packetbeat","type":"_doc","version":"8.7.1"},"event":{"duration":"12495689","start":"2025-05-23T20:24:16.968Z","end":"2025-05-23T20:24:16.981Z","kind":"event","category":["network"],"type":["connection","protocol"],"dataset":"dns"},"related":{"ip":["192.168.100.3","1.1.1.3","142.251.186.94"]},"network":{"bytes":"132","type":"ipv4","transport":"udp","protocol":"dns","direction":"egress","community_id":"1:gqNtlcfR7YF76W/Vl1c5Rfg8Tyk="},"client":{"ip":"192.168.100.3","port":"39875","bytes":"58"},"ecs":{"version":"8.0.0"},"source":{"ip":"192.168.100.3","port":"39875","bytes":"58"},"query":"class IN, type A, clientservices.googleapis.com","dns":{"authorities_count":"0","op_code":"QUERY","opt":{"do":"true","version":"0","udp_size":"1232","ext_rcode":"NOERROR"},"flags":{"recursion_available":"true","authentic_data":"false","checking_disabled":"false","authoritative":"false","truncated_response":"false","recursion_desired":"true"},"header_flags":["RD","RA","DO"],"answers_count":"1","response_code":"NOERROR","resolved_ip":["142.251.186.94"],"id":"9779","question":{"name":"clientservices.googleapis.com","type":"A","class":"IN","etld_plus_one":"clientservices.googleapis.com","registered_domain":"clientservices.googleapis.com","top_level_domain":"googleapis.com"},"answers":[{"class":"IN","ttl":"203","data":"142.251.186.94","name":"clientservices.googleapis.com","type":"A"}],"additionals_count":"0","type":"answer"},"host":{"architecture":"x86_64","os":{"platform":"debian","version":"11 (bullseye)","family":"debian","name":"Debian GNU/Linux","kernel":"5.10.0-21-amd64","codename":"bullseye","type":"linux"},"id":"8986bcccef884a1ebe34f1ccd31b4f50","containerized":"false","ip":["192.168.100.3","fe80::20c:29ff:fe09:d59b"],"mac":["00-0C-29-09-D5-9B"],"name":"piHole","hostname":"piHole"},"agent":{"version":"8.7.1","ephemeral_id":"f64f34f9-15e3-4717-8349-bc5e342d07c3","id":"9d8db289-3bc9-40d3-92cb-2bd2d9f9434b","name":"piHole","type":"packetbeat"},"server":{"bytes":"74","ip":"1.1.1.3","port":"53"},"destination":{"ip":"1.1.1.3","port":"53","bytes":"74"},"type":"dns","resource":"clientservices.googleapis.com","method":"QUERY"},"location":"/tmp/packetbeat/packetbeat-20250523-90.ndjson"}',
1769
+ dns_answer: "142.251.186.94",
1770
+ data_dns_id: "9779",
1771
+ src_port: "39875",
1772
+ manager_name: "ASHWZHMA",
1773
+ data_network_direction: "egress",
1774
+ data_dns_question_top_level_domain: "googleapis.com",
1775
+ data_event_end: "2025-05-23T20:24:16.981Z",
1776
+ data_agent_name: "piHole",
1777
+ data_client_ip: "192.168.100.3",
1778
+ data_dns_flags_authoritative: "false",
1779
+ data_server_bytes: "74",
1780
+ data_dns_header_flags: "RD, RA, DO",
1781
+ data_type: "dns",
1782
+ data_dns_flags_checking_disabled: "false",
1783
+ location: "/tmp/packetbeat/packetbeat-20250523-90.ndjson",
1784
+ "data_@metadata_version": "8.7.1",
1785
+ data_host_os_name: "Debian GNU/Linux",
1786
+ rule_group3: "dns",
1787
+ msg_timestamp: "2025-05-23T20:24:18.256Z",
1788
+ rule_group2: "packetbeat",
1789
+ rule_group1: "linux"
1790
+ },
1791
+ {
1792
+ data_source_ip: "192.168.100.3",
1793
+ data_host_architecture: "x86_64",
1794
+ agent_id: "032",
1795
+ agent_name: "piHole",
1796
+ gl2_remote_ip: "10.255.255.13",
1797
+ data_resource: "clientservices.googleapis.com",
1798
+ agent_labels_customer: "00001",
1799
+ data_ecs_version: "8.0.0",
1800
+ timestamp_utc: "2025-05-23T20:24:16.968Z",
1801
+ data_host_os_codename: "bullseye",
1802
+ syslog_type: "wazuh",
1803
+ gl2_source_node: "3b68efa4-3319-4885-a38f-c944f0fcf191",
1804
+ id: "1748031858.83763262",
1805
+ data_server_port: "53",
1806
+ data_dns_question_etld_plus_one: "clientservices.googleapis.com",
1807
+ rule_mitre_tactic: "Command and Control",
1808
+ gl2_accounted_message_size: 6336,
1809
+ data_agent_type: "packetbeat",
1810
+ streams: ["660320f176ca320e8393f057"],
1811
+ rule_mitre_id: "T1071",
1812
+ data_destination_bytes: "86",
1813
+ data_event_dataset: "dns",
1814
+ "data_@metadata_beat": "packetbeat",
1815
+ agent_ip: "192.168.100.3",
1816
+ data_source_port: "58871",
1817
+ data_host_id: "8986bcccef884a1ebe34f1ccd31b4f50",
1818
+ data_event_kind: "event",
1819
+ data_network_protocol: "dns",
1820
+ dns_response_code: "NOERROR",
1821
+ dns_query: "clientservices.googleapis.com",
1822
+ data_dns_response_code: "NOERROR",
1823
+ data_network_community_id: "1:ykrdpoGjkUiCgojr1rKBDgiEppw=",
1824
+ data_dns_flags_truncated_response: "false",
1825
+ rule_mail: false,
1826
+ data_dns_opt_udp_size: "1232",
1827
+ data_event_category: "network",
1828
+ data_dns_flags_recursion_available: "true",
1829
+ data_dns_opt_version: "0",
1830
+ timestamp: "2025-05-23 20:24:23.055",
1831
+ data_host_mac: "00-0C-29-09-D5-9B",
1832
+ data_agent_id: "9d8db289-3bc9-40d3-92cb-2bd2d9f9434b",
1833
+ data_destination_port: "53",
1834
+ data_dns_type: "answer",
1835
+ traffic_direction: "egress",
1836
+ rule_id: "200300",
1837
+ data_dns_question_class: "IN",
1838
+ cluster_node: "ASHWZHMA.socfortress.local",
1839
+ dst_port: "53",
1840
+ "data_@timestamp": "2025-05-23T20:24:16.968Z",
1841
+ data_host_os_platform: "debian",
1842
+ data_event_duration: "10913100",
1843
+ data_dns_flags_recursion_desired: "true",
1844
+ data_host_name: "piHole",
1845
+ gl2_remote_port: 51720,
1846
+ data_host_os_type: "linux",
1847
+ source: "10.255.255.13",
1848
+ gl2_source_input: "660320f176ca320e8393f030",
1849
+ rule_level: 3,
1850
+ data_event_type: "connection, protocol",
1851
+ data_host_os_family: "debian",
1852
+ data_dns_additionals_count: "0",
1853
+ data_dns_flags_authentic_data: "false",
1854
+ protocol: "udp",
1855
+ data_dns_answers:
1856
+ "{name=clientservices.googleapis.com, type=AAAA, class=IN, ttl=54, data=2607:f8b0:4023:1006::5e}",
1857
+ data_agent_ephemeral_id: "f64f34f9-15e3-4717-8349-bc5e342d07c3",
1858
+ data_event_start: "2025-05-23T20:24:16.968Z",
1859
+ rule_description: "Linux: DNS Query to clientservices.googleapis.com",
1860
+ data_agent_version: "8.7.1",
1861
+ data_related_ip: "192.168.100.3, 1.1.1.3, 2607:f8b0:4023:1006::5e",
1862
+ data_status: "OK",
1863
+ data_query: "class IN, type AAAA, clientservices.googleapis.com",
1864
+ "data_@metadata_type": "_doc",
1865
+ data_server_ip: "1.1.1.3",
1866
+ data_dns_question_registered_domain: "clientservices.googleapis.com",
1867
+ data_method: "QUERY",
1868
+ gl2_message_id: "01JVZD2Y8F3NKJF9TQN2STXTRP",
1869
+ data_dns_answers_count: "1",
1870
+ data_network_type: "ipv4",
1871
+ data_dns_opt_ext_rcode: "NOERROR",
1872
+ data_client_port: "58871",
1873
+ data_network_bytes: "144",
1874
+ data_dns_resolved_ip: "2607:f8b0:4023:1006::5e",
1875
+ data_host_containerized: "false",
1876
+ true: 1748031858.952529,
1877
+ data_host_hostname: "piHole",
1878
+ rule_groups: "linux, packetbeat, dns",
1879
+ data_client_bytes: "58",
1880
+ data_dns_question_type: "AAAA",
1881
+ data_destination_ip: "1.1.1.3",
1882
+ data_host_ip: "192.168.100.3, fe80::20c:29ff:fe09:d59b",
1883
+ rule_mitre_technique: "Application Layer Protocol",
1884
+ rule_firedtimes: 286,
1885
+ data_network_transport: "udp",
1886
+ dst_ip: "1.1.1.3",
1887
+ src_ip: "192.168.100.3",
1888
+ decoder_name: "json",
1889
+ syslog_level: "INFO",
1890
+ data_dns_op_code: "QUERY",
1891
+ data_host_os_version: "11 (bullseye)",
1892
+ data_host_os_kernel: "5.10.0-21-amd64",
1893
+ cluster_name: "socfortress",
1894
+ data_source_bytes: "58",
1895
+ gl2_processing_error:
1896
+ 'Replaced invalid timestamp value in message <ea09cbd5-3813-11f0-91aa-8600007a2218> with current time - Value <2025-05-23T20:24:18.255+0000> caused exception: Invalid format: "2025-05-23T20:24:18.255+0000" is malformed at "T20:24:18.255+0000".',
1897
+ data_dns_opt_do: "true",
1898
+ data_dns_authorities_count: "0",
1899
+ data_dns_question_name: "clientservices.googleapis.com",
1900
+ message:
1901
+ '{"true":1748031858.952529,"timestamp":"2025-05-23T20:24:18.255+0000","rule":{"level":3,"description":"Linux: DNS Query to clientservices.googleapis.com","id":"200300","mitre":{"id":["T1071"],"tactic":["Command and Control"],"technique":["Application Layer Protocol"]},"firedtimes":286,"mail":false,"groups":["linux","packetbeat","dns"]},"agent":{"id":"032","name":"piHole","ip":"192.168.100.3","labels":{"customer":"00001"}},"manager":{"name":"ASHWZHMA"},"id":"1748031858.83763262","cluster":{"name":"socfortress","node":"ASHWZHMA.socfortress.local"},"decoder":{"name":"json"},"data":{"status":"OK","@timestamp":"2025-05-23T20:24:16.968Z","@metadata":{"beat":"packetbeat","type":"_doc","version":"8.7.1"},"destination":{"bytes":"86","ip":"1.1.1.3","port":"53"},"server":{"ip":"1.1.1.3","port":"53","bytes":"86"},"dns":{"additionals_count":"0","id":"48715","opt":{"version":"0","udp_size":"1232","ext_rcode":"NOERROR","do":"true"},"answers":[{"name":"clientservices.googleapis.com","type":"AAAA","class":"IN","ttl":"54","data":"2607:f8b0:4023:1006::5e"}],"flags":{"recursion_available":"true","authentic_data":"false","checking_disabled":"false","authoritative":"false","truncated_response":"false","recursion_desired":"true"},"answers_count":"1","authorities_count":"0","resolved_ip":["2607:f8b0:4023:1006::5e"],"type":"answer","header_flags":["RD","RA","DO"],"question":{"top_level_domain":"googleapis.com","name":"clientservices.googleapis.com","type":"AAAA","class":"IN","etld_plus_one":"clientservices.googleapis.com","registered_domain":"clientservices.googleapis.com"},"op_code":"QUERY","response_code":"NOERROR"},"ecs":{"version":"8.0.0"},"host":{"containerized":"false","name":"piHole","ip":["192.168.100.3","fe80::20c:29ff:fe09:d59b"],"mac":["00-0C-29-09-D5-9B"],"hostname":"piHole","architecture":"x86_64","os":{"platform":"debian","version":"11 (bullseye)","family":"debian","name":"Debian GNU/Linux","kernel":"5.10.0-21-amd64","codename":"bullseye","type":"linux"},"id":"8986bcccef884a1ebe34f1ccd31b4f50"},"agent":{"id":"9d8db289-3bc9-40d3-92cb-2bd2d9f9434b","name":"piHole","type":"packetbeat","version":"8.7.1","ephemeral_id":"f64f34f9-15e3-4717-8349-bc5e342d07c3"},"method":"QUERY","query":"class IN, type AAAA, clientservices.googleapis.com","related":{"ip":["192.168.100.3","1.1.1.3","2607:f8b0:4023:1006::5e"]},"client":{"port":"58871","bytes":"58","ip":"192.168.100.3"},"resource":"clientservices.googleapis.com","type":"dns","network":{"type":"ipv4","transport":"udp","protocol":"dns","direction":"egress","community_id":"1:ykrdpoGjkUiCgojr1rKBDgiEppw=","bytes":"144"},"event":{"start":"2025-05-23T20:24:16.968Z","end":"2025-05-23T20:24:16.979Z","kind":"event","category":["network"],"type":["connection","protocol"],"dataset":"dns","duration":"10913100"},"source":{"ip":"192.168.100.3","port":"58871","bytes":"58"}},"location":"/tmp/packetbeat/packetbeat-20250523-90.ndjson"}',
1902
+ dns_answer: "2607:f8b0:4023:1006::5e",
1903
+ data_dns_id: "48715",
1904
+ src_port: "58871",
1905
+ manager_name: "ASHWZHMA",
1906
+ data_dns_question_top_level_domain: "googleapis.com",
1907
+ data_network_direction: "egress",
1908
+ data_event_end: "2025-05-23T20:24:16.979Z",
1909
+ data_agent_name: "piHole",
1910
+ data_server_bytes: "86",
1911
+ data_dns_flags_authoritative: "false",
1912
+ data_client_ip: "192.168.100.3",
1913
+ data_dns_header_flags: "RD, RA, DO",
1914
+ data_type: "dns",
1915
+ data_dns_flags_checking_disabled: "false",
1916
+ location: "/tmp/packetbeat/packetbeat-20250523-90.ndjson",
1917
+ "data_@metadata_version": "8.7.1",
1918
+ data_host_os_name: "Debian GNU/Linux",
1919
+ rule_group3: "dns",
1920
+ msg_timestamp: "2025-05-23T20:24:18.255Z",
1921
+ rule_group2: "packetbeat",
1922
+ rule_group1: "linux"
1923
+ },
1924
+ {
1925
+ data_source_ip: "192.168.100.1",
1926
+ data_host_architecture: "x86_64",
1927
+ agent_id: "032",
1928
+ agent_name: "piHole",
1929
+ gl2_remote_ip: "10.255.255.13",
1930
+ data_resource: "clientservices.googleapis.com",
1931
+ agent_labels_customer: "00001",
1932
+ data_ecs_version: "8.0.0",
1933
+ timestamp_utc: "2025-05-23T20:24:16.968Z",
1934
+ data_host_os_codename: "bullseye",
1935
+ syslog_type: "wazuh",
1936
+ gl2_source_node: "3b68efa4-3319-4885-a38f-c944f0fcf191",
1937
+ id: "1748031858.83760371",
1938
+ data_dns_question_etld_plus_one: "clientservices.googleapis.com",
1939
+ data_server_port: "53",
1940
+ rule_mitre_tactic: "Command and Control",
1941
+ gl2_accounted_message_size: 6381,
1942
+ data_agent_type: "packetbeat",
1943
+ streams: ["660320f176ca320e8393f057"],
1944
+ rule_mitre_id: "T1071",
1945
+ data_destination_bytes: "86",
1946
+ data_event_dataset: "dns",
1947
+ "data_@metadata_beat": "packetbeat",
1948
+ agent_ip: "192.168.100.3",
1949
+ data_source_port: "43099",
1950
+ data_host_id: "8986bcccef884a1ebe34f1ccd31b4f50",
1951
+ data_event_kind: "event",
1952
+ data_network_protocol: "dns",
1953
+ dns_response_code: "NOERROR",
1954
+ dns_query: "clientservices.googleapis.com",
1955
+ data_dns_response_code: "NOERROR",
1956
+ data_network_community_id: "1:T5KKxFzRKrYGd3zpS/XejHoi9AM=",
1957
+ data_dns_flags_truncated_response: "false",
1958
+ rule_mail: false,
1959
+ data_dns_opt_udp_size: "1232",
1960
+ data_event_category: "network",
1961
+ data_dns_flags_recursion_available: "true",
1962
+ data_dns_opt_version: "0",
1963
+ timestamp: "2025-05-23 20:24:23.055",
1964
+ data_host_mac: "00-0C-29-09-D5-9B",
1965
+ data_agent_id: "9d8db289-3bc9-40d3-92cb-2bd2d9f9434b",
1966
+ data_destination_port: "53",
1967
+ data_dns_type: "answer",
1968
+ traffic_direction: "ingress",
1969
+ rule_id: "200300",
1970
+ data_dns_question_class: "IN",
1971
+ cluster_node: "ASHWZHMA.socfortress.local",
1972
+ dst_port: "53",
1973
+ "data_@timestamp": "2025-05-23T20:24:16.968Z",
1974
+ data_event_duration: "11235860",
1975
+ data_host_os_platform: "debian",
1976
+ data_dns_flags_recursion_desired: "true",
1977
+ data_host_name: "piHole",
1978
+ gl2_remote_port: 51720,
1979
+ data_host_os_type: "linux",
1980
+ source: "10.255.255.13",
1981
+ gl2_source_input: "660320f176ca320e8393f030",
1982
+ rule_level: 3,
1983
+ data_event_type: "connection, protocol",
1984
+ data_host_os_family: "debian",
1985
+ data_dns_additionals_count: "0",
1986
+ data_dns_flags_authentic_data: "false",
1987
+ protocol: "udp",
1988
+ data_dns_answers:
1989
+ "{data=2607:f8b0:4023:1006::5e, name=clientservices.googleapis.com, type=AAAA, class=IN, ttl=54}",
1990
+ data_event_start: "2025-05-23T20:24:16.968Z",
1991
+ data_agent_ephemeral_id: "f64f34f9-15e3-4717-8349-bc5e342d07c3",
1992
+ rule_description: "Linux: DNS Query to clientservices.googleapis.com",
1993
+ data_related_ip: "192.168.100.1, 192.168.100.3, 2607:f8b0:4023:1006::5e",
1994
+ data_agent_version: "8.7.1",
1995
+ data_status: "OK",
1996
+ data_query: "class IN, type AAAA, clientservices.googleapis.com",
1997
+ "data_@metadata_type": "_doc",
1998
+ data_dns_question_registered_domain: "clientservices.googleapis.com",
1999
+ data_server_ip: "192.168.100.3",
2000
+ data_method: "QUERY",
2001
+ gl2_message_id: "01JVZD2Y8F8T46KKT8KDH9EYB0",
2002
+ data_dns_answers_count: "1",
2003
+ data_network_type: "ipv4",
2004
+ data_dns_opt_ext_rcode: "NOERROR",
2005
+ data_client_port: "43099",
2006
+ data_network_bytes: "144",
2007
+ data_dns_resolved_ip: "2607:f8b0:4023:1006::5e",
2008
+ data_host_containerized: "false",
2009
+ true: 1748031858.257044,
2010
+ data_host_hostname: "piHole",
2011
+ rule_groups: "linux, packetbeat, dns",
2012
+ data_client_bytes: "58",
2013
+ data_dns_question_type: "AAAA",
2014
+ data_host_ip: "192.168.100.3, fe80::20c:29ff:fe09:d59b",
2015
+ data_destination_ip: "192.168.100.3",
2016
+ rule_mitre_technique: "Application Layer Protocol",
2017
+ rule_firedtimes: 285,
2018
+ data_network_transport: "udp",
2019
+ dst_ip: "192.168.100.3",
2020
+ src_ip: "192.168.100.1",
2021
+ decoder_name: "json",
2022
+ syslog_level: "INFO",
2023
+ data_dns_op_code: "QUERY",
2024
+ data_host_os_version: "11 (bullseye)",
2025
+ data_host_os_kernel: "5.10.0-21-amd64",
2026
+ cluster_name: "socfortress",
2027
+ data_source_bytes: "58",
2028
+ gl2_processing_error:
2029
+ 'Replaced invalid timestamp value in message <ea09cbd4-3813-11f0-91aa-8600007a2218> with current time - Value <2025-05-23T20:24:18.255+0000> caused exception: Invalid format: "2025-05-23T20:24:18.255+0000" is malformed at "T20:24:18.255+0000".',
2030
+ data_dns_opt_do: "true",
2031
+ data_dns_authorities_count: "0",
2032
+ data_dns_question_name: "clientservices.googleapis.com",
2033
+ message:
2034
+ '{"true":1748031858.257044,"timestamp":"2025-05-23T20:24:18.255+0000","rule":{"level":3,"description":"Linux: DNS Query to clientservices.googleapis.com","id":"200300","mitre":{"id":["T1071"],"tactic":["Command and Control"],"technique":["Application Layer Protocol"]},"firedtimes":285,"mail":false,"groups":["linux","packetbeat","dns"]},"agent":{"id":"032","name":"piHole","ip":"192.168.100.3","labels":{"customer":"00001"}},"manager":{"name":"ASHWZHMA"},"id":"1748031858.83760371","cluster":{"name":"socfortress","node":"ASHWZHMA.socfortress.local"},"decoder":{"name":"json"},"data":{"status":"OK","@timestamp":"2025-05-23T20:24:16.968Z","@metadata":{"beat":"packetbeat","type":"_doc","version":"8.7.1"},"client":{"ip":"192.168.100.1","port":"43099","bytes":"58"},"event":{"duration":"11235860","start":"2025-05-23T20:24:16.968Z","end":"2025-05-23T20:24:16.979Z","kind":"event","category":["network"],"type":["connection","protocol"],"dataset":"dns"},"dns":{"resolved_ip":["2607:f8b0:4023:1006::5e"],"id":"37478","header_flags":["RD","RA","DO"],"answers":[{"data":"2607:f8b0:4023:1006::5e","name":"clientservices.googleapis.com","type":"AAAA","class":"IN","ttl":"54"}],"answers_count":"1","response_code":"NOERROR","question":{"type":"AAAA","class":"IN","etld_plus_one":"clientservices.googleapis.com","registered_domain":"clientservices.googleapis.com","top_level_domain":"googleapis.com","name":"clientservices.googleapis.com"},"opt":{"version":"0","udp_size":"1232","ext_rcode":"NOERROR","do":"true"},"op_code":"QUERY","authorities_count":"0","additionals_count":"0","type":"answer","flags":{"authoritative":"false","truncated_response":"false","recursion_desired":"true","recursion_available":"true","authentic_data":"false","checking_disabled":"false"}},"related":{"ip":["192.168.100.1","192.168.100.3","2607:f8b0:4023:1006::5e"]},"host":{"architecture":"x86_64","os":{"kernel":"5.10.0-21-amd64","codename":"bullseye","type":"linux","platform":"debian","version":"11 (bullseye)","family":"debian","name":"Debian GNU/Linux"},"id":"8986bcccef884a1ebe34f1ccd31b4f50","containerized":"false","ip":["192.168.100.3","fe80::20c:29ff:fe09:d59b"],"name":"piHole","mac":["00-0C-29-09-D5-9B"],"hostname":"piHole"},"agent":{"id":"9d8db289-3bc9-40d3-92cb-2bd2d9f9434b","name":"piHole","type":"packetbeat","version":"8.7.1","ephemeral_id":"f64f34f9-15e3-4717-8349-bc5e342d07c3"},"query":"class IN, type AAAA, clientservices.googleapis.com","source":{"bytes":"58","ip":"192.168.100.1","port":"43099"},"server":{"ip":"192.168.100.3","port":"53","bytes":"86"},"type":"dns","network":{"protocol":"dns","direction":"ingress","community_id":"1:T5KKxFzRKrYGd3zpS/XejHoi9AM=","bytes":"144","type":"ipv4","transport":"udp"},"destination":{"bytes":"86","ip":"192.168.100.3","port":"53"},"ecs":{"version":"8.0.0"},"method":"QUERY","resource":"clientservices.googleapis.com"},"location":"/tmp/packetbeat/packetbeat-20250523-90.ndjson"}',
2035
+ dns_answer: "2607:f8b0:4023:1006::5e",
2036
+ data_dns_id: "37478",
2037
+ src_port: "43099",
2038
+ manager_name: "ASHWZHMA",
2039
+ data_dns_question_top_level_domain: "googleapis.com",
2040
+ data_network_direction: "ingress",
2041
+ data_event_end: "2025-05-23T20:24:16.979Z",
2042
+ data_agent_name: "piHole",
2043
+ data_client_ip: "192.168.100.1",
2044
+ data_dns_flags_authoritative: "false",
2045
+ data_server_bytes: "86",
2046
+ data_dns_header_flags: "RD, RA, DO",
2047
+ data_type: "dns",
2048
+ data_dns_flags_checking_disabled: "false",
2049
+ location: "/tmp/packetbeat/packetbeat-20250523-90.ndjson",
2050
+ "data_@metadata_version": "8.7.1",
2051
+ data_host_os_name: "Debian GNU/Linux",
2052
+ rule_group3: "dns",
2053
+ msg_timestamp: "2025-05-23T20:24:18.255Z",
2054
+ rule_group2: "packetbeat",
2055
+ rule_group1: "linux"
2056
+ },
2057
+ {
2058
+ data_source_ip: "192.168.100.1",
2059
+ data_host_architecture: "x86_64",
2060
+ agent_id: "032",
2061
+ agent_name: "piHole",
2062
+ gl2_remote_ip: "10.255.255.13",
2063
+ data_resource: "192071-ipv4.gr.global.aa-rt.sharepoint.com",
2064
+ agent_labels_customer: "00001",
2065
+ data_ecs_version: "8.0.0",
2066
+ timestamp_utc: "2025-05-23T20:24:05.953Z",
2067
+ data_host_os_codename: "bullseye",
2068
+ syslog_type: "wazuh",
2069
+ gl2_source_node: "3b68efa4-3319-4885-a38f-c944f0fcf191",
2070
+ id: "1748031848.83751517",
2071
+ data_server_port: "53",
2072
+ data_dns_question_etld_plus_one: "sharepoint.com",
2073
+ rule_mitre_tactic: "Command and Control",
2074
+ gl2_accounted_message_size: 6754,
2075
+ data_agent_type: "packetbeat",
2076
+ streams: ["660320f176ca320e8393f057"],
2077
+ rule_mitre_id: "T1071",
2078
+ data_destination_bytes: "130",
2079
+ data_event_dataset: "dns",
2080
+ "data_@metadata_beat": "packetbeat",
2081
+ agent_ip: "192.168.100.3",
2082
+ data_source_port: "23048",
2083
+ data_host_id: "8986bcccef884a1ebe34f1ccd31b4f50",
2084
+ data_event_kind: "event",
2085
+ data_network_protocol: "dns",
2086
+ dns_response_code: "NOERROR",
2087
+ dns_query: "192071-ipv4.gr.global.aa-rt.sharepoint.com",
2088
+ data_dns_response_code: "NOERROR",
2089
+ data_network_community_id: "1:m9QwZxOBfLQh63euZxFGEUKc91E=",
2090
+ data_dns_flags_truncated_response: "false",
2091
+ rule_mail: false,
2092
+ data_dns_opt_udp_size: "1232",
2093
+ data_event_category: "network",
2094
+ data_dns_flags_recursion_available: "true",
2095
+ data_dns_opt_version: "0",
2096
+ timestamp: "2025-05-23 20:24:13.652",
2097
+ data_host_mac: "00-0C-29-09-D5-9B",
2098
+ data_agent_id: "9d8db289-3bc9-40d3-92cb-2bd2d9f9434b",
2099
+ data_destination_port: "53",
2100
+ data_dns_type: "answer",
2101
+ traffic_direction: "ingress",
2102
+ rule_id: "200300",
2103
+ data_dns_question_class: "IN",
2104
+ cluster_node: "ASHWZHMA.socfortress.local",
2105
+ dst_port: "53",
2106
+ "data_@timestamp": "2025-05-23T20:24:05.953Z",
2107
+ data_host_os_platform: "debian",
2108
+ data_event_duration: "26399654",
2109
+ data_host_name: "piHole",
2110
+ data_dns_flags_recursion_desired: "true",
2111
+ data_dns_question_subdomain: "192071-ipv4.gr.global.aa-rt",
2112
+ gl2_remote_port: 53306,
2113
+ data_host_os_type: "linux",
2114
+ source: "10.255.255.13",
2115
+ gl2_source_input: "660320f176ca320e8393f030",
2116
+ rule_level: 3,
2117
+ data_event_type: "connection, protocol",
2118
+ data_host_os_family: "debian",
2119
+ data_dns_additionals_count: "0",
2120
+ data_dns_flags_authentic_data: "false",
2121
+ protocol: "udp",
2122
+ data_dns_answers:
2123
+ "{name=192071-ipv4.gr.global.aa-rt.sharepoint.com, type=CNAME, class=IN, ttl=59, data=192071-ipv4.farm.dprodmgd105.aa-rt.sharepoint.com}, {class=IN, ttl=3599, data=52.104.26.41, name=192071-ipv4.farm.dprodmgd105.aa-rt.sharepoint.com, type=A}",
2124
+ data_event_start: "2025-05-23T20:24:05.953Z",
2125
+ data_agent_ephemeral_id: "f64f34f9-15e3-4717-8349-bc5e342d07c3",
2126
+ rule_description: "Linux: DNS Query to 192071-ipv4.gr.global.aa-rt.sharepoint.com",
2127
+ data_related_ip: "192.168.100.1, 192.168.100.3, 52.104.26.41",
2128
+ data_agent_version: "8.7.1",
2129
+ data_status: "OK",
2130
+ data_query: "class IN, type A, 192071-ipv4.gr.global.aa-rt.sharepoint.com",
2131
+ "data_@metadata_type": "_doc",
2132
+ data_method: "QUERY",
2133
+ data_server_ip: "192.168.100.3",
2134
+ data_dns_question_registered_domain: "sharepoint.com",
2135
+ gl2_message_id: "01JVZD2N2MRENTMM587X0BVQEJ",
2136
+ data_dns_answers_count: "2",
2137
+ data_network_type: "ipv4",
2138
+ data_dns_opt_ext_rcode: "NOERROR",
2139
+ data_client_port: "23048",
2140
+ data_network_bytes: "201",
2141
+ data_dns_resolved_ip: "52.104.26.41",
2142
+ data_host_containerized: "false",
2143
+ true: 1748031848.951349,
2144
+ data_host_hostname: "piHole",
2145
+ rule_groups: "linux, packetbeat, dns",
2146
+ data_client_bytes: "71",
2147
+ data_dns_question_type: "A",
2148
+ data_host_ip: "192.168.100.3, fe80::20c:29ff:fe09:d59b",
2149
+ data_destination_ip: "192.168.100.3",
2150
+ rule_mitre_technique: "Application Layer Protocol",
2151
+ rule_firedtimes: 281,
2152
+ data_network_transport: "udp",
2153
+ dst_ip: "192.168.100.3",
2154
+ src_ip: "192.168.100.1",
2155
+ decoder_name: "json",
2156
+ syslog_level: "INFO",
2157
+ data_dns_op_code: "QUERY",
2158
+ data_host_os_version: "11 (bullseye)",
2159
+ data_host_os_kernel: "5.10.0-21-amd64",
2160
+ cluster_name: "socfortress",
2161
+ data_source_bytes: "71",
2162
+ gl2_processing_error:
2163
+ 'Replaced invalid timestamp value in message <e41411e2-3813-11f0-91aa-8600007a2218> with current time - Value <2025-05-23T20:24:08.282+0000> caused exception: Invalid format: "2025-05-23T20:24:08.282+0000" is malformed at "T20:24:08.282+0000".',
2164
+ data_dns_opt_do: "true",
2165
+ data_dns_authorities_count: "0",
2166
+ data_dns_question_name: "192071-ipv4.gr.global.aa-rt.sharepoint.com",
2167
+ message:
2168
+ '{"true":1748031848.951349,"timestamp":"2025-05-23T20:24:08.282+0000","rule":{"level":3,"description":"Linux: DNS Query to 192071-ipv4.gr.global.aa-rt.sharepoint.com","id":"200300","mitre":{"id":["T1071"],"tactic":["Command and Control"],"technique":["Application Layer Protocol"]},"firedtimes":281,"mail":false,"groups":["linux","packetbeat","dns"]},"agent":{"id":"032","name":"piHole","ip":"192.168.100.3","labels":{"customer":"00001"}},"manager":{"name":"ASHWZHMA"},"id":"1748031848.83751517","cluster":{"name":"socfortress","node":"ASHWZHMA.socfortress.local"},"decoder":{"name":"json"},"data":{"status":"OK","@timestamp":"2025-05-23T20:24:05.953Z","@metadata":{"beat":"packetbeat","type":"_doc","version":"8.7.1"},"method":"QUERY","server":{"port":"53","bytes":"130","ip":"192.168.100.3"},"host":{"ip":["192.168.100.3","fe80::20c:29ff:fe09:d59b"],"mac":["00-0C-29-09-D5-9B"],"hostname":"piHole","architecture":"x86_64","name":"piHole","os":{"type":"linux","platform":"debian","version":"11 (bullseye)","family":"debian","name":"Debian GNU/Linux","kernel":"5.10.0-21-amd64","codename":"bullseye"},"id":"8986bcccef884a1ebe34f1ccd31b4f50","containerized":"false"},"event":{"dataset":"dns","duration":"26399654","start":"2025-05-23T20:24:05.953Z","end":"2025-05-23T20:24:05.980Z","kind":"event","category":["network"],"type":["connection","protocol"]},"query":"class IN, type A, 192071-ipv4.gr.global.aa-rt.sharepoint.com","source":{"bytes":"71","ip":"192.168.100.1","port":"23048"},"related":{"ip":["192.168.100.1","192.168.100.3","52.104.26.41"]},"network":{"direction":"ingress","community_id":"1:m9QwZxOBfLQh63euZxFGEUKc91E=","bytes":"201","type":"ipv4","transport":"udp","protocol":"dns"},"destination":{"ip":"192.168.100.3","port":"53","bytes":"130"},"type":"dns","agent":{"type":"packetbeat","version":"8.7.1","ephemeral_id":"f64f34f9-15e3-4717-8349-bc5e342d07c3","id":"9d8db289-3bc9-40d3-92cb-2bd2d9f9434b","name":"piHole"},"dns":{"opt":{"udp_size":"1232","ext_rcode":"NOERROR","do":"true","version":"0"},"op_code":"QUERY","additionals_count":"0","answers_count":"2","response_code":"NOERROR","flags":{"authentic_data":"false","checking_disabled":"false","authoritative":"false","truncated_response":"false","recursion_desired":"true","recursion_available":"true"},"header_flags":["RD","RA","DO"],"question":{"registered_domain":"sharepoint.com","top_level_domain":"com","subdomain":"192071-ipv4.gr.global.aa-rt","name":"192071-ipv4.gr.global.aa-rt.sharepoint.com","type":"A","class":"IN","etld_plus_one":"sharepoint.com"},"resolved_ip":["52.104.26.41"],"authorities_count":"0","id":"57613","answers":[{"name":"192071-ipv4.gr.global.aa-rt.sharepoint.com","type":"CNAME","class":"IN","ttl":"59","data":"192071-ipv4.farm.dprodmgd105.aa-rt.sharepoint.com"},{"class":"IN","ttl":"3599","data":"52.104.26.41","name":"192071-ipv4.farm.dprodmgd105.aa-rt.sharepoint.com","type":"A"}],"type":"answer"},"client":{"bytes":"71","ip":"192.168.100.1","port":"23048"},"ecs":{"version":"8.0.0"},"resource":"192071-ipv4.gr.global.aa-rt.sharepoint.com"},"location":"/tmp/packetbeat/packetbeat-20250523-90.ndjson"}',
2169
+ dns_answer: "52.104.26.41",
2170
+ data_dns_id: "57613",
2171
+ src_port: "23048",
2172
+ manager_name: "ASHWZHMA",
2173
+ data_network_direction: "ingress",
2174
+ data_dns_question_top_level_domain: "com",
2175
+ data_event_end: "2025-05-23T20:24:05.980Z",
2176
+ data_agent_name: "piHole",
2177
+ data_server_bytes: "130",
2178
+ data_dns_flags_authoritative: "false",
2179
+ data_client_ip: "192.168.100.1",
2180
+ data_type: "dns",
2181
+ data_dns_header_flags: "RD, RA, DO",
2182
+ data_dns_flags_checking_disabled: "false",
2183
+ location: "/tmp/packetbeat/packetbeat-20250523-90.ndjson",
2184
+ "data_@metadata_version": "8.7.1",
2185
+ data_host_os_name: "Debian GNU/Linux",
2186
+ rule_group3: "dns",
2187
+ msg_timestamp: "2025-05-23T20:24:08.282Z",
2188
+ rule_group2: "packetbeat",
2189
+ rule_group1: "linux"
2190
+ },
2191
+ {
2192
+ data_source_ip: "192.168.100.3",
2193
+ data_host_architecture: "x86_64",
2194
+ agent_id: "032",
2195
+ agent_name: "piHole",
2196
+ gl2_remote_ip: "10.255.255.13",
2197
+ data_resource: "192071-ipv4.gr.global.aa-rt.sharepoint.com",
2198
+ agent_labels_customer: "00001",
2199
+ data_ecs_version: "8.0.0",
2200
+ timestamp_utc: "2025-05-23T20:24:05.925Z",
2201
+ data_host_os_codename: "bullseye",
2202
+ syslog_type: "wazuh",
2203
+ gl2_source_node: "3b68efa4-3319-4885-a38f-c944f0fcf191",
2204
+ id: "1748031848.83748458",
2205
+ data_server_port: "53",
2206
+ data_dns_question_etld_plus_one: "sharepoint.com",
2207
+ rule_mitre_tactic: "Command and Control",
2208
+ gl2_accounted_message_size: 6709,
2209
+ data_agent_type: "packetbeat",
2210
+ streams: ["660320f176ca320e8393f057"],
2211
+ rule_mitre_id: "T1071",
2212
+ data_destination_bytes: "130",
2213
+ data_event_dataset: "dns",
2214
+ "data_@metadata_beat": "packetbeat",
2215
+ agent_ip: "192.168.100.3",
2216
+ data_source_port: "36086",
2217
+ data_host_id: "8986bcccef884a1ebe34f1ccd31b4f50",
2218
+ data_event_kind: "event",
2219
+ data_network_protocol: "dns",
2220
+ dns_response_code: "NOERROR",
2221
+ dns_query: "192071-ipv4.gr.global.aa-rt.sharepoint.com",
2222
+ data_dns_response_code: "NOERROR",
2223
+ data_network_community_id: "1:5iZvTrF7flgUj6breYQizRYkGeA=",
2224
+ data_dns_flags_truncated_response: "false",
2225
+ rule_mail: false,
2226
+ data_dns_opt_udp_size: "1232",
2227
+ data_event_category: "network",
2228
+ data_dns_flags_recursion_available: "true",
2229
+ data_dns_opt_version: "0",
2230
+ timestamp: "2025-05-23 20:24:13.652",
2231
+ data_host_mac: "00-0C-29-09-D5-9B",
2232
+ data_agent_id: "9d8db289-3bc9-40d3-92cb-2bd2d9f9434b",
2233
+ data_destination_port: "53",
2234
+ data_dns_type: "answer",
2235
+ traffic_direction: "egress",
2236
+ rule_id: "200300",
2237
+ data_dns_question_class: "IN",
2238
+ cluster_node: "ASHWZHMA.socfortress.local",
2239
+ dst_port: "53",
2240
+ "data_@timestamp": "2025-05-23T20:24:05.925Z",
2241
+ data_event_duration: "54290460",
2242
+ data_host_os_platform: "debian",
2243
+ data_host_name: "piHole",
2244
+ data_dns_flags_recursion_desired: "true",
2245
+ data_dns_question_subdomain: "192071-ipv4.gr.global.aa-rt",
2246
+ gl2_remote_port: 53306,
2247
+ data_host_os_type: "linux",
2248
+ source: "10.255.255.13",
2249
+ gl2_source_input: "660320f176ca320e8393f030",
2250
+ rule_level: 3,
2251
+ data_event_type: "connection, protocol",
2252
+ data_host_os_family: "debian",
2253
+ data_dns_additionals_count: "0",
2254
+ data_dns_flags_authentic_data: "false",
2255
+ protocol: "udp",
2256
+ data_dns_answers:
2257
+ "{name=192071-ipv4.gr.global.aa-rt.sharepoint.com, type=CNAME, class=IN, ttl=59, data=192071-ipv4.farm.dprodmgd105.aa-rt.sharepoint.com}, {type=A, class=IN, ttl=3599, data=52.104.26.41, name=192071-ipv4.farm.dprodmgd105.aa-rt.sharepoint.com}",
2258
+ data_event_start: "2025-05-23T20:24:05.925Z",
2259
+ data_agent_ephemeral_id: "f64f34f9-15e3-4717-8349-bc5e342d07c3",
2260
+ rule_description: "Linux: DNS Query to 192071-ipv4.gr.global.aa-rt.sharepoint.com",
2261
+ data_related_ip: "192.168.100.3, 1.1.1.3, 52.104.26.41",
2262
+ data_agent_version: "8.7.1",
2263
+ data_status: "OK",
2264
+ data_query: "class IN, type A, 192071-ipv4.gr.global.aa-rt.sharepoint.com",
2265
+ "data_@metadata_type": "_doc",
2266
+ data_server_ip: "1.1.1.3",
2267
+ data_method: "QUERY",
2268
+ data_dns_question_registered_domain: "sharepoint.com",
2269
+ gl2_message_id: "01JVZD2N2MHH1Q2XGV51KGCEMC",
2270
+ data_dns_answers_count: "2",
2271
+ data_network_type: "ipv4",
2272
+ data_dns_opt_ext_rcode: "NOERROR",
2273
+ data_client_port: "36086",
2274
+ data_network_bytes: "201",
2275
+ data_dns_resolved_ip: "52.104.26.41",
2276
+ data_host_containerized: "false",
2277
+ true: 1748031848.283055,
2278
+ data_host_hostname: "piHole",
2279
+ rule_groups: "linux, packetbeat, dns",
2280
+ data_client_bytes: "71",
2281
+ data_dns_question_type: "A",
2282
+ data_host_ip: "192.168.100.3, fe80::20c:29ff:fe09:d59b",
2283
+ data_destination_ip: "1.1.1.3",
2284
+ rule_mitre_technique: "Application Layer Protocol",
2285
+ rule_firedtimes: 282,
2286
+ data_network_transport: "udp",
2287
+ dst_ip: "1.1.1.3",
2288
+ src_ip: "192.168.100.3",
2289
+ decoder_name: "json",
2290
+ syslog_level: "INFO",
2291
+ data_dns_op_code: "QUERY",
2292
+ data_host_os_version: "11 (bullseye)",
2293
+ data_host_os_kernel: "5.10.0-21-amd64",
2294
+ cluster_name: "socfortress",
2295
+ data_source_bytes: "71",
2296
+ gl2_processing_error:
2297
+ 'Replaced invalid timestamp value in message <e41411e1-3813-11f0-91aa-8600007a2218> with current time - Value <2025-05-23T20:24:08.281+0000> caused exception: Invalid format: "2025-05-23T20:24:08.281+0000" is malformed at "T20:24:08.281+0000".',
2298
+ data_dns_opt_do: "true",
2299
+ data_dns_authorities_count: "0",
2300
+ data_dns_question_name: "192071-ipv4.gr.global.aa-rt.sharepoint.com",
2301
+ message:
2302
+ '{"true":1748031848.283055,"timestamp":"2025-05-23T20:24:08.281+0000","rule":{"level":3,"description":"Linux: DNS Query to 192071-ipv4.gr.global.aa-rt.sharepoint.com","id":"200300","mitre":{"id":["T1071"],"tactic":["Command and Control"],"technique":["Application Layer Protocol"]},"firedtimes":282,"mail":false,"groups":["linux","packetbeat","dns"]},"agent":{"id":"032","name":"piHole","ip":"192.168.100.3","labels":{"customer":"00001"}},"manager":{"name":"ASHWZHMA"},"id":"1748031848.83748458","cluster":{"name":"socfortress","node":"ASHWZHMA.socfortress.local"},"decoder":{"name":"json"},"data":{"status":"OK","@timestamp":"2025-05-23T20:24:05.925Z","@metadata":{"beat":"packetbeat","type":"_doc","version":"8.7.1"},"server":{"bytes":"130","ip":"1.1.1.3","port":"53"},"event":{"category":["network"],"type":["connection","protocol"],"dataset":"dns","duration":"54290460","start":"2025-05-23T20:24:05.925Z","end":"2025-05-23T20:24:05.980Z","kind":"event"},"method":"QUERY","related":{"ip":["192.168.100.3","1.1.1.3","52.104.26.41"]},"query":"class IN, type A, 192071-ipv4.gr.global.aa-rt.sharepoint.com","host":{"ip":["192.168.100.3","fe80::20c:29ff:fe09:d59b"],"mac":["00-0C-29-09-D5-9B"],"name":"piHole","hostname":"piHole","architecture":"x86_64","os":{"platform":"debian","version":"11 (bullseye)","family":"debian","name":"Debian GNU/Linux","kernel":"5.10.0-21-amd64","codename":"bullseye","type":"linux"},"id":"8986bcccef884a1ebe34f1ccd31b4f50","containerized":"false"},"source":{"port":"36086","bytes":"71","ip":"192.168.100.3"},"destination":{"ip":"1.1.1.3","port":"53","bytes":"130"},"network":{"transport":"udp","protocol":"dns","direction":"egress","community_id":"1:5iZvTrF7flgUj6breYQizRYkGeA=","bytes":"201","type":"ipv4"},"dns":{"answers":[{"name":"192071-ipv4.gr.global.aa-rt.sharepoint.com","type":"CNAME","class":"IN","ttl":"59","data":"192071-ipv4.farm.dprodmgd105.aa-rt.sharepoint.com"},{"type":"A","class":"IN","ttl":"3599","data":"52.104.26.41","name":"192071-ipv4.farm.dprodmgd105.aa-rt.sharepoint.com"}],"resolved_ip":["52.104.26.41"],"question":{"registered_domain":"sharepoint.com","top_level_domain":"com","subdomain":"192071-ipv4.gr.global.aa-rt","name":"192071-ipv4.gr.global.aa-rt.sharepoint.com","type":"A","class":"IN","etld_plus_one":"sharepoint.com"},"answers_count":"2","additionals_count":"0","flags":{"authoritative":"false","truncated_response":"false","recursion_desired":"true","recursion_available":"true","authentic_data":"false","checking_disabled":"false"},"type":"answer","op_code":"QUERY","header_flags":["RD","RA","DO"],"id":"17463","response_code":"NOERROR","opt":{"do":"true","version":"0","udp_size":"1232","ext_rcode":"NOERROR"},"authorities_count":"0"},"client":{"ip":"192.168.100.3","port":"36086","bytes":"71"},"resource":"192071-ipv4.gr.global.aa-rt.sharepoint.com","agent":{"type":"packetbeat","version":"8.7.1","ephemeral_id":"f64f34f9-15e3-4717-8349-bc5e342d07c3","id":"9d8db289-3bc9-40d3-92cb-2bd2d9f9434b","name":"piHole"},"ecs":{"version":"8.0.0"},"type":"dns"},"location":"/tmp/packetbeat/packetbeat-20250523-90.ndjson"}',
2303
+ dns_answer: "52.104.26.41",
2304
+ data_dns_id: "17463",
2305
+ src_port: "36086",
2306
+ manager_name: "ASHWZHMA",
2307
+ data_network_direction: "egress",
2308
+ data_dns_question_top_level_domain: "com",
2309
+ data_event_end: "2025-05-23T20:24:05.980Z",
2310
+ data_agent_name: "piHole",
2311
+ data_server_bytes: "130",
2312
+ data_dns_flags_authoritative: "false",
2313
+ data_client_ip: "192.168.100.3",
2314
+ data_dns_header_flags: "RD, RA, DO",
2315
+ data_type: "dns",
2316
+ data_dns_flags_checking_disabled: "false",
2317
+ location: "/tmp/packetbeat/packetbeat-20250523-90.ndjson",
2318
+ "data_@metadata_version": "8.7.1",
2319
+ data_host_os_name: "Debian GNU/Linux",
2320
+ rule_group3: "dns",
2321
+ msg_timestamp: "2025-05-23T20:24:08.281Z",
2322
+ rule_group2: "packetbeat",
2323
+ rule_group1: "linux"
2324
+ },
2325
+ {
2326
+ data_source_ip: "192.168.100.3",
2327
+ data_host_architecture: "x86_64",
2328
+ agent_id: "032",
2329
+ agent_name: "piHole",
2330
+ gl2_remote_ip: "10.255.255.13",
2331
+ data_resource: "192071-ipv4.farm.dprodmgd105.aa-rt.sharepoint.com",
2332
+ agent_labels_customer: "00001",
2333
+ data_ecs_version: "8.0.0",
2334
+ timestamp_utc: "2025-05-23T20:24:05.980Z",
2335
+ data_host_os_codename: "bullseye",
2336
+ syslog_type: "wazuh",
2337
+ gl2_source_node: "3b68efa4-3319-4885-a38f-c944f0fcf191",
2338
+ id: "1748031848.83754595",
2339
+ data_dns_question_etld_plus_one: "sharepoint.com",
2340
+ data_server_port: "53",
2341
+ rule_mitre_tactic: "Command and Control",
2342
+ gl2_accounted_message_size: 6493,
2343
+ data_agent_type: "packetbeat",
2344
+ streams: ["660320f176ca320e8393f057"],
2345
+ rule_mitre_id: "T1071",
2346
+ data_destination_bytes: "94",
2347
+ data_event_dataset: "dns",
2348
+ "data_@metadata_beat": "packetbeat",
2349
+ agent_ip: "192.168.100.3",
2350
+ data_source_port: "33365",
2351
+ data_host_id: "8986bcccef884a1ebe34f1ccd31b4f50",
2352
+ data_event_kind: "event",
2353
+ data_network_protocol: "dns",
2354
+ dns_response_code: "NOERROR",
2355
+ dns_query: "192071-ipv4.farm.dprodmgd105.aa-rt.sharepoint.com",
2356
+ data_dns_response_code: "NOERROR",
2357
+ data_network_community_id: "1:8sjmsqnhAWFl5tsJDVLyv/9bmRA=",
2358
+ data_dns_flags_truncated_response: "false",
2359
+ rule_mail: false,
2360
+ data_dns_opt_udp_size: "1232",
2361
+ data_event_category: "network",
2362
+ data_dns_flags_recursion_available: "true",
2363
+ data_dns_opt_version: "0",
2364
+ timestamp: "2025-05-23 20:24:13.532",
2365
+ data_host_mac: "00-0C-29-09-D5-9B",
2366
+ data_agent_id: "9d8db289-3bc9-40d3-92cb-2bd2d9f9434b",
2367
+ data_destination_port: "53",
2368
+ data_dns_type: "answer",
2369
+ traffic_direction: "egress",
2370
+ rule_id: "200300",
2371
+ data_dns_question_class: "IN",
2372
+ cluster_node: "ASHWZHMA.socfortress.local",
2373
+ dst_port: "53",
2374
+ "data_@timestamp": "2025-05-23T20:24:05.980Z",
2375
+ data_event_duration: "44621509",
2376
+ data_host_os_platform: "debian",
2377
+ data_dns_flags_recursion_desired: "true",
2378
+ data_host_name: "piHole",
2379
+ data_dns_question_subdomain: "192071-ipv4.farm.dprodmgd105.aa-rt",
2380
+ gl2_remote_port: 53306,
2381
+ data_host_os_type: "linux",
2382
+ source: "10.255.255.13",
2383
+ gl2_source_input: "660320f176ca320e8393f030",
2384
+ rule_level: 3,
2385
+ data_event_type: "connection, protocol",
2386
+ data_host_os_family: "debian",
2387
+ data_dns_additionals_count: "0",
2388
+ data_dns_flags_authentic_data: "false",
2389
+ protocol: "udp",
2390
+ data_dns_answers:
2391
+ "{name=192071-ipv4.farm.dprodmgd105.aa-rt.sharepoint.com, type=A, class=IN, ttl=3600, data=52.104.26.41}",
2392
+ data_agent_ephemeral_id: "f64f34f9-15e3-4717-8349-bc5e342d07c3",
2393
+ data_event_start: "2025-05-23T20:24:05.980Z",
2394
+ rule_description: "Linux: DNS Query to 192071-ipv4.farm.dprodmgd105.aa-rt.sharepoint.com",
2395
+ data_related_ip: "192.168.100.3, 1.1.1.3, 52.104.26.41",
2396
+ data_agent_version: "8.7.1",
2397
+ data_status: "OK",
2398
+ data_query: "class IN, type A, 192071-ipv4.farm.dprodmgd105.aa-rt.sharepoint.com",
2399
+ "data_@metadata_type": "_doc",
2400
+ data_method: "QUERY",
2401
+ data_dns_question_registered_domain: "sharepoint.com",
2402
+ data_server_ip: "1.1.1.3",
2403
+ gl2_message_id: "01JVZD2MYW83NXNFSK6RC1FV7V",
2404
+ data_dns_answers_count: "1",
2405
+ data_network_type: "ipv4",
2406
+ data_dns_opt_ext_rcode: "NOERROR",
2407
+ data_client_port: "33365",
2408
+ data_network_bytes: "172",
2409
+ data_dns_resolved_ip: "52.104.26.41",
2410
+ data_host_containerized: "false",
2411
+ true: 1748031848.951426,
2412
+ data_host_hostname: "piHole",
2413
+ rule_groups: "linux, packetbeat, dns",
2414
+ data_client_bytes: "78",
2415
+ data_dns_question_type: "A",
2416
+ data_host_ip: "192.168.100.3, fe80::20c:29ff:fe09:d59b",
2417
+ data_destination_ip: "1.1.1.3",
2418
+ rule_mitre_technique: "Application Layer Protocol",
2419
+ rule_firedtimes: 283,
2420
+ data_network_transport: "udp",
2421
+ dst_ip: "1.1.1.3",
2422
+ src_ip: "192.168.100.3",
2423
+ decoder_name: "json",
2424
+ syslog_level: "INFO",
2425
+ data_dns_op_code: "QUERY",
2426
+ data_host_os_version: "11 (bullseye)",
2427
+ data_host_os_kernel: "5.10.0-21-amd64",
2428
+ cluster_name: "socfortress",
2429
+ data_source_bytes: "78",
2430
+ gl2_processing_error:
2431
+ 'Replaced invalid timestamp value in message <e41438f0-3813-11f0-91aa-8600007a2218> with current time - Value <2025-05-23T20:24:08.282+0000> caused exception: Invalid format: "2025-05-23T20:24:08.282+0000" is malformed at "T20:24:08.282+0000".',
2432
+ data_dns_opt_do: "true",
2433
+ data_dns_authorities_count: "0",
2434
+ data_dns_question_name: "192071-ipv4.farm.dprodmgd105.aa-rt.sharepoint.com",
2435
+ message:
2436
+ '{"true":1748031848.951426,"timestamp":"2025-05-23T20:24:08.282+0000","rule":{"level":3,"description":"Linux: DNS Query to 192071-ipv4.farm.dprodmgd105.aa-rt.sharepoint.com","id":"200300","mitre":{"id":["T1071"],"tactic":["Command and Control"],"technique":["Application Layer Protocol"]},"firedtimes":283,"mail":false,"groups":["linux","packetbeat","dns"]},"agent":{"id":"032","name":"piHole","ip":"192.168.100.3","labels":{"customer":"00001"}},"manager":{"name":"ASHWZHMA"},"id":"1748031848.83754595","cluster":{"name":"socfortress","node":"ASHWZHMA.socfortress.local"},"decoder":{"name":"json"},"data":{"status":"OK","@timestamp":"2025-05-23T20:24:05.980Z","@metadata":{"beat":"packetbeat","type":"_doc","version":"8.7.1"},"source":{"bytes":"78","ip":"192.168.100.3","port":"33365"},"method":"QUERY","query":"class IN, type A, 192071-ipv4.farm.dprodmgd105.aa-rt.sharepoint.com","dns":{"answers_count":"1","answers":[{"name":"192071-ipv4.farm.dprodmgd105.aa-rt.sharepoint.com","type":"A","class":"IN","ttl":"3600","data":"52.104.26.41"}],"response_code":"NOERROR","authorities_count":"0","additionals_count":"0","type":"answer","id":"60845","resolved_ip":["52.104.26.41"],"flags":{"recursion_available":"true","authentic_data":"false","checking_disabled":"false","authoritative":"false","truncated_response":"false","recursion_desired":"true"},"question":{"class":"IN","etld_plus_one":"sharepoint.com","registered_domain":"sharepoint.com","top_level_domain":"com","subdomain":"192071-ipv4.farm.dprodmgd105.aa-rt","name":"192071-ipv4.farm.dprodmgd105.aa-rt.sharepoint.com","type":"A"},"opt":{"version":"0","udp_size":"1232","ext_rcode":"NOERROR","do":"true"},"op_code":"QUERY","header_flags":["RD","RA","DO"]},"related":{"ip":["192.168.100.3","1.1.1.3","52.104.26.41"]},"client":{"ip":"192.168.100.3","port":"33365","bytes":"78"},"network":{"type":"ipv4","transport":"udp","protocol":"dns","direction":"egress","community_id":"1:8sjmsqnhAWFl5tsJDVLyv/9bmRA=","bytes":"172"},"agent":{"ephemeral_id":"f64f34f9-15e3-4717-8349-bc5e342d07c3","id":"9d8db289-3bc9-40d3-92cb-2bd2d9f9434b","name":"piHole","type":"packetbeat","version":"8.7.1"},"ecs":{"version":"8.0.0"},"event":{"end":"2025-05-23T20:24:06.025Z","kind":"event","category":["network"],"type":["connection","protocol"],"dataset":"dns","duration":"44621509","start":"2025-05-23T20:24:05.980Z"},"type":"dns","server":{"port":"53","bytes":"94","ip":"1.1.1.3"},"host":{"hostname":"piHole","architecture":"x86_64","os":{"version":"11 (bullseye)","family":"debian","name":"Debian GNU/Linux","kernel":"5.10.0-21-amd64","codename":"bullseye","type":"linux","platform":"debian"},"id":"8986bcccef884a1ebe34f1ccd31b4f50","containerized":"false","ip":["192.168.100.3","fe80::20c:29ff:fe09:d59b"],"mac":["00-0C-29-09-D5-9B"],"name":"piHole"},"destination":{"ip":"1.1.1.3","port":"53","bytes":"94"},"resource":"192071-ipv4.farm.dprodmgd105.aa-rt.sharepoint.com"},"location":"/tmp/packetbeat/packetbeat-20250523-90.ndjson"}',
2437
+ dns_answer: "52.104.26.41",
2438
+ data_dns_id: "60845",
2439
+ src_port: "33365",
2440
+ manager_name: "ASHWZHMA",
2441
+ data_dns_question_top_level_domain: "com",
2442
+ data_network_direction: "egress",
2443
+ data_event_end: "2025-05-23T20:24:06.025Z",
2444
+ data_agent_name: "piHole",
2445
+ data_dns_flags_authoritative: "false",
2446
+ data_client_ip: "192.168.100.3",
2447
+ data_server_bytes: "94",
2448
+ data_dns_header_flags: "RD, RA, DO",
2449
+ data_type: "dns",
2450
+ data_dns_flags_checking_disabled: "false",
2451
+ location: "/tmp/packetbeat/packetbeat-20250523-90.ndjson",
2452
+ "data_@metadata_version": "8.7.1",
2453
+ data_host_os_name: "Debian GNU/Linux",
2454
+ rule_group3: "dns",
2455
+ msg_timestamp: "2025-05-23T20:24:08.282Z",
2456
+ rule_group2: "packetbeat",
2457
+ rule_group1: "linux"
2458
+ },
2459
+ {
2460
+ data_source_ip: "192.168.100.1",
2461
+ data_host_architecture: "x86_64",
2462
+ agent_id: "032",
2463
+ agent_name: "piHole",
2464
+ gl2_remote_ip: "10.255.255.13",
2465
+ data_resource: "browser-intake-datadoghq.com",
2466
+ agent_labels_customer: "00001",
2467
+ data_ecs_version: "8.0.0",
2468
+ timestamp_utc: "2025-05-23T20:24:05.363Z",
2469
+ data_host_os_codename: "bullseye",
2470
+ syslog_type: "wazuh",
2471
+ gl2_source_node: "3b68efa4-3319-4885-a38f-c944f0fcf191",
2472
+ id: "1748031848.83745642",
2473
+ data_dns_question_etld_plus_one: "browser-intake-datadoghq.com",
2474
+ data_server_port: "53",
2475
+ rule_mitre_tactic: "Command and Control",
2476
+ gl2_accounted_message_size: 6213,
2477
+ data_agent_type: "packetbeat",
2478
+ streams: ["660320f176ca320e8393f057"],
2479
+ rule_mitre_id: "T1071",
2480
+ data_destination_bytes: "73",
2481
+ data_event_dataset: "dns",
2482
+ "data_@metadata_beat": "packetbeat",
2483
+ agent_ip: "192.168.100.3",
2484
+ data_source_port: "62861",
2485
+ data_host_id: "8986bcccef884a1ebe34f1ccd31b4f50",
2486
+ data_event_kind: "event",
2487
+ data_network_protocol: "dns",
2488
+ dns_response_code: "NOERROR",
2489
+ dns_query: "browser-intake-datadoghq.com",
2490
+ data_dns_response_code: "NOERROR",
2491
+ data_network_community_id: "1:I5jTWyK/ZK6S56G3s+cDVNVF6+s=",
2492
+ data_dns_flags_truncated_response: "false",
2493
+ rule_mail: false,
2494
+ data_dns_opt_udp_size: "1232",
2495
+ data_event_category: "network",
2496
+ data_dns_flags_recursion_available: "true",
2497
+ data_dns_opt_version: "0",
2498
+ timestamp: "2025-05-23 20:24:13.532",
2499
+ data_host_mac: "00-0C-29-09-D5-9B",
2500
+ data_agent_id: "9d8db289-3bc9-40d3-92cb-2bd2d9f9434b",
2501
+ data_destination_port: "53",
2502
+ data_dns_type: "answer",
2503
+ traffic_direction: "ingress",
2504
+ rule_id: "200300",
2505
+ data_dns_question_class: "IN",
2506
+ cluster_node: "ASHWZHMA.socfortress.local",
2507
+ dst_port: "53",
2508
+ "data_@timestamp": "2025-05-23T20:24:05.363Z",
2509
+ data_event_duration: "119080",
2510
+ data_host_os_platform: "debian",
2511
+ data_dns_flags_recursion_desired: "true",
2512
+ data_host_name: "piHole",
2513
+ gl2_remote_port: 53306,
2514
+ data_host_os_type: "linux",
2515
+ source: "10.255.255.13",
2516
+ gl2_source_input: "660320f176ca320e8393f030",
2517
+ rule_level: 3,
2518
+ data_event_type: "connection, protocol",
2519
+ data_host_os_family: "debian",
2520
+ data_dns_additionals_count: "0",
2521
+ data_dns_flags_authentic_data: "false",
2522
+ protocol: "udp",
2523
+ data_dns_answers: "{name=browser-intake-datadoghq.com, type=A, class=IN, ttl=2, data=0.0.0.0}",
2524
+ data_event_start: "2025-05-23T20:24:05.363Z",
2525
+ data_agent_ephemeral_id: "f64f34f9-15e3-4717-8349-bc5e342d07c3",
2526
+ rule_description: "Linux: DNS Query to browser-intake-datadoghq.com",
2527
+ data_related_ip: "192.168.100.1, 192.168.100.3, 0.0.0.0",
2528
+ data_agent_version: "8.7.1",
2529
+ data_status: "OK",
2530
+ data_query: "class IN, type A, browser-intake-datadoghq.com",
2531
+ "data_@metadata_type": "_doc",
2532
+ data_dns_question_registered_domain: "browser-intake-datadoghq.com",
2533
+ data_method: "QUERY",
2534
+ data_server_ip: "192.168.100.3",
2535
+ gl2_message_id: "01JVZD2MYW05N49ASCDWBHBBM2",
2536
+ data_dns_answers_count: "1",
2537
+ data_network_type: "ipv4",
2538
+ data_dns_opt_ext_rcode: "NOERROR",
2539
+ data_client_port: "62861",
2540
+ data_network_bytes: "130",
2541
+ data_dns_resolved_ip: "0.0.0.0",
2542
+ data_host_containerized: "false",
2543
+ true: 1748031848.282895,
2544
+ data_host_hostname: "piHole",
2545
+ rule_groups: "linux, packetbeat, dns",
2546
+ data_client_bytes: "57",
2547
+ data_dns_question_type: "A",
2548
+ data_destination_ip: "192.168.100.3",
2549
+ data_host_ip: "192.168.100.3, fe80::20c:29ff:fe09:d59b",
2550
+ rule_mitre_technique: "Application Layer Protocol",
2551
+ rule_firedtimes: 280,
2552
+ data_network_transport: "udp",
2553
+ dst_ip: "192.168.100.3",
2554
+ src_ip: "192.168.100.1",
2555
+ decoder_name: "json",
2556
+ syslog_level: "INFO",
2557
+ data_dns_op_code: "QUERY",
2558
+ data_host_os_version: "11 (bullseye)",
2559
+ data_host_os_kernel: "5.10.0-21-amd64",
2560
+ cluster_name: "socfortress",
2561
+ data_source_bytes: "57",
2562
+ gl2_processing_error:
2563
+ 'Replaced invalid timestamp value in message <e41411e0-3813-11f0-91aa-8600007a2218> with current time - Value <2025-05-23T20:24:08.240+0000> caused exception: Invalid format: "2025-05-23T20:24:08.240+0000" is malformed at "T20:24:08.240+0000".',
2564
+ data_dns_opt_do: "true",
2565
+ data_dns_authorities_count: "0",
2566
+ data_dns_question_name: "browser-intake-datadoghq.com",
2567
+ message:
2568
+ '{"true":1748031848.282895,"timestamp":"2025-05-23T20:24:08.240+0000","rule":{"level":3,"description":"Linux: DNS Query to browser-intake-datadoghq.com","id":"200300","mitre":{"id":["T1071"],"tactic":["Command and Control"],"technique":["Application Layer Protocol"]},"firedtimes":280,"mail":false,"groups":["linux","packetbeat","dns"]},"agent":{"id":"032","name":"piHole","ip":"192.168.100.3","labels":{"customer":"00001"}},"manager":{"name":"ASHWZHMA"},"id":"1748031848.83745642","cluster":{"name":"socfortress","node":"ASHWZHMA.socfortress.local"},"decoder":{"name":"json"},"data":{"status":"OK","@timestamp":"2025-05-23T20:24:05.363Z","@metadata":{"beat":"packetbeat","type":"_doc","version":"8.7.1"},"client":{"ip":"192.168.100.1","port":"62861","bytes":"57"},"network":{"transport":"udp","protocol":"dns","direction":"ingress","community_id":"1:I5jTWyK/ZK6S56G3s+cDVNVF6+s=","bytes":"130","type":"ipv4"},"event":{"duration":"119080","start":"2025-05-23T20:24:05.363Z","end":"2025-05-23T20:24:05.364Z","kind":"event","category":["network"],"type":["connection","protocol"],"dataset":"dns"},"type":"dns","ecs":{"version":"8.0.0"},"dns":{"additionals_count":"0","flags":{"authoritative":"true","truncated_response":"false","recursion_desired":"true","recursion_available":"true","authentic_data":"false","checking_disabled":"false"},"id":"4301","response_code":"NOERROR","resolved_ip":["0.0.0.0"],"header_flags":["AA","RD","RA","DO"],"answers_count":"1","op_code":"QUERY","question":{"class":"IN","etld_plus_one":"browser-intake-datadoghq.com","registered_domain":"browser-intake-datadoghq.com","top_level_domain":"com","name":"browser-intake-datadoghq.com","type":"A"},"opt":{"do":"true","version":"0","udp_size":"1232","ext_rcode":"NOERROR"},"answers":[{"name":"browser-intake-datadoghq.com","type":"A","class":"IN","ttl":"2","data":"0.0.0.0"}],"authorities_count":"0","type":"answer"},"source":{"ip":"192.168.100.1","port":"62861","bytes":"57"},"query":"class IN, type A, browser-intake-datadoghq.com","resource":"browser-intake-datadoghq.com","destination":{"port":"53","bytes":"73","ip":"192.168.100.3"},"method":"QUERY","host":{"architecture":"x86_64","os":{"family":"debian","name":"Debian GNU/Linux","kernel":"5.10.0-21-amd64","codename":"bullseye","type":"linux","platform":"debian","version":"11 (bullseye)"},"id":"8986bcccef884a1ebe34f1ccd31b4f50","containerized":"false","ip":["192.168.100.3","fe80::20c:29ff:fe09:d59b"],"mac":["00-0C-29-09-D5-9B"],"hostname":"piHole","name":"piHole"},"related":{"ip":["192.168.100.1","192.168.100.3","0.0.0.0"]},"server":{"ip":"192.168.100.3","port":"53","bytes":"73"},"agent":{"id":"9d8db289-3bc9-40d3-92cb-2bd2d9f9434b","name":"piHole","type":"packetbeat","version":"8.7.1","ephemeral_id":"f64f34f9-15e3-4717-8349-bc5e342d07c3"}},"location":"/tmp/packetbeat/packetbeat-20250523-90.ndjson"}',
2569
+ dns_answer: "0.0.0.0",
2570
+ data_dns_id: "4301",
2571
+ src_port: "62861",
2572
+ manager_name: "ASHWZHMA",
2573
+ data_network_direction: "ingress",
2574
+ data_dns_question_top_level_domain: "com",
2575
+ data_event_end: "2025-05-23T20:24:05.364Z",
2576
+ data_agent_name: "piHole",
2577
+ data_client_ip: "192.168.100.1",
2578
+ data_dns_flags_authoritative: "true",
2579
+ data_server_bytes: "73",
2580
+ data_type: "dns",
2581
+ data_dns_header_flags: "AA, RD, RA, DO",
2582
+ data_dns_flags_checking_disabled: "false",
2583
+ location: "/tmp/packetbeat/packetbeat-20250523-90.ndjson",
2584
+ "data_@metadata_version": "8.7.1",
2585
+ data_host_os_name: "Debian GNU/Linux",
2586
+ rule_group3: "dns",
2587
+ msg_timestamp: "2025-05-23T20:24:08.240Z",
2588
+ rule_group2: "packetbeat",
2589
+ rule_group1: "linux"
2590
+ },
2591
+ {
2592
+ data_source_ip: "192.168.100.1",
2593
+ data_host_architecture: "x86_64",
2594
+ agent_id: "032",
2595
+ agent_name: "piHole",
2596
+ gl2_remote_ip: "10.255.255.13",
2597
+ data_resource: "www.tm.v4.a.prd.aadg.akadns.net",
2598
+ agent_labels_customer: "00001",
2599
+ data_ecs_version: "8.0.0",
2600
+ timestamp_utc: "2025-05-23T20:24:05.033Z",
2601
+ data_host_os_codename: "bullseye",
2602
+ syslog_type: "wazuh",
2603
+ gl2_source_node: "3b68efa4-3319-4885-a38f-c944f0fcf191",
2604
+ id: "1748031846.83734359",
2605
+ data_server_port: "53",
2606
+ data_dns_question_etld_plus_one: "akadns.net",
2607
+ rule_mitre_tactic: "Command and Control",
2608
+ gl2_accounted_message_size: 8100,
2609
+ data_agent_type: "packetbeat",
2610
+ streams: ["660320f176ca320e8393f057"],
2611
+ rule_mitre_id: "T1071",
2612
+ data_destination_bytes: "188",
2613
+ data_event_dataset: "dns",
2614
+ "data_@metadata_beat": "packetbeat",
2615
+ agent_ip: "192.168.100.3",
2616
+ data_source_port: "38616",
2617
+ data_host_id: "8986bcccef884a1ebe34f1ccd31b4f50",
2618
+ data_event_kind: "event",
2619
+ data_network_protocol: "dns",
2620
+ dns_response_code: "NOERROR",
2621
+ dns_query: "www.tm.v4.a.prd.aadg.akadns.net",
2622
+ data_dns_response_code: "NOERROR",
2623
+ data_network_community_id: "1:d5Hlw2X6vZE+Qn/Ex1rZR9GqtxA=",
2624
+ data_dns_flags_truncated_response: "false",
2625
+ rule_mail: false,
2626
+ data_dns_opt_udp_size: "1232",
2627
+ data_event_category: "network",
2628
+ data_dns_flags_recursion_available: "true",
2629
+ data_dns_opt_version: "0",
2630
+ timestamp: "2025-05-23 20:24:09.408",
2631
+ data_host_mac: "00-0C-29-09-D5-9B",
2632
+ data_agent_id: "9d8db289-3bc9-40d3-92cb-2bd2d9f9434b",
2633
+ data_destination_port: "53",
2634
+ data_dns_type: "answer",
2635
+ traffic_direction: "ingress",
2636
+ rule_id: "200300",
2637
+ data_dns_question_class: "IN",
2638
+ cluster_node: "ASHWZHMA.socfortress.local",
2639
+ dst_port: "53",
2640
+ "data_@timestamp": "2025-05-23T20:24:05.033Z",
2641
+ data_host_os_platform: "debian",
2642
+ data_event_duration: "63234444",
2643
+ data_host_name: "piHole",
2644
+ data_dns_flags_recursion_desired: "true",
2645
+ data_dns_question_subdomain: "www.tm.v4.a.prd.aadg",
2646
+ gl2_remote_port: 53290,
2647
+ data_host_os_type: "linux",
2648
+ source: "10.255.255.13",
2649
+ gl2_source_input: "660320f176ca320e8393f030",
2650
+ rule_level: 3,
2651
+ data_event_type: "connection, protocol",
2652
+ data_host_os_family: "debian",
2653
+ data_dns_additionals_count: "0",
2654
+ data_dns_flags_authentic_data: "false",
2655
+ protocol: "udp",
2656
+ data_dns_answers:
2657
+ "{data=20.190.135.17, name=www.tm.v4.a.prd.aadg.akadns.net, type=A, class=IN, ttl=93}, {class=IN, ttl=93, data=20.190.135.6, name=www.tm.v4.a.prd.aadg.akadns.net, type=A}, {type=A, class=IN, ttl=93, data=40.126.7.35, name=www.tm.v4.a.prd.aadg.akadns.net}, {ttl=93, data=40.126.28.23, name=www.tm.v4.a.prd.aadg.akadns.net, type=A, class=IN}, {class=IN, ttl=93, data=40.126.28.19, name=www.tm.v4.a.prd.aadg.akadns.net, type=A}, {type=A, class=IN, ttl=93, data=20.190.135.16, name=www.tm.v4.a.prd.aadg.akadns.net}, {data=40.126.28.11, name=www.tm.v4.a.prd.aadg.akadns.net, type=A, class=IN, ttl=93}, {name=www.tm.v4.a.prd.aadg.akadns.net, type=A, class=IN, ttl=93, data=20.190.135.7}",
2658
+ data_event_start: "2025-05-23T20:24:05.033Z",
2659
+ data_agent_ephemeral_id: "f64f34f9-15e3-4717-8349-bc5e342d07c3",
2660
+ rule_description: "Linux: DNS Query to www.tm.v4.a.prd.aadg.akadns.net",
2661
+ data_related_ip:
2662
+ "192.168.100.1, 192.168.100.3, 20.190.135.17, 20.190.135.6, 40.126.7.35, 40.126.28.23, 40.126.28.19, 20.190.135.16, 40.126.28.11, 20.190.135.7",
2663
+ data_agent_version: "8.7.1",
2664
+ data_status: "OK",
2665
+ data_query: "class IN, type A, www.tm.v4.a.prd.aadg.akadns.net",
2666
+ "data_@metadata_type": "_doc",
2667
+ data_server_ip: "192.168.100.3",
2668
+ data_method: "QUERY",
2669
+ data_dns_question_registered_domain: "akadns.net",
2670
+ gl2_message_id: "01JVZD2GY0JG6V9D7S7RB24AKN",
2671
+ data_dns_answers_count: "8",
2672
+ data_network_type: "ipv4",
2673
+ data_dns_opt_ext_rcode: "NOERROR",
2674
+ data_client_port: "38616",
2675
+ data_network_bytes: "248",
2676
+ data_dns_resolved_ip:
2677
+ "20.190.135.17, 20.190.135.6, 40.126.7.35, 40.126.28.23, 40.126.28.19, 20.190.135.16, 40.126.28.11, 20.190.135.7",
2678
+ data_host_containerized: "false",
2679
+ true: 1748031846.313782,
2680
+ data_host_hostname: "piHole",
2681
+ rule_groups: "linux, packetbeat, dns",
2682
+ data_client_bytes: "60",
2683
+ data_dns_question_type: "A",
2684
+ data_destination_ip: "192.168.100.3",
2685
+ data_host_ip: "192.168.100.3, fe80::20c:29ff:fe09:d59b",
2686
+ rule_mitre_technique: "Application Layer Protocol",
2687
+ rule_firedtimes: 278,
2688
+ data_network_transport: "udp",
2689
+ dst_ip: "192.168.100.3",
2690
+ src_ip: "192.168.100.1",
2691
+ decoder_name: "json",
2692
+ syslog_level: "INFO",
2693
+ data_dns_op_code: "QUERY",
2694
+ data_host_os_version: "11 (bullseye)",
2695
+ data_host_os_kernel: "5.10.0-21-amd64",
2696
+ cluster_name: "socfortress",
2697
+ data_source_bytes: "60",
2698
+ gl2_processing_error:
2699
+ 'Replaced invalid timestamp value in message <e18f89e0-3813-11f0-91aa-8600007a2218> with current time - Value <2025-05-23T20:24:06.312+0000> caused exception: Invalid format: "2025-05-23T20:24:06.312+0000" is malformed at "T20:24:06.312+0000".',
2700
+ data_dns_opt_do: "true",
2701
+ data_dns_authorities_count: "0",
2702
+ data_dns_question_name: "www.tm.v4.a.prd.aadg.akadns.net",
2703
+ message:
2704
+ '{"true":1748031846.313782,"timestamp":"2025-05-23T20:24:06.312+0000","rule":{"level":3,"description":"Linux: DNS Query to www.tm.v4.a.prd.aadg.akadns.net","id":"200300","mitre":{"id":["T1071"],"tactic":["Command and Control"],"technique":["Application Layer Protocol"]},"firedtimes":278,"mail":false,"groups":["linux","packetbeat","dns"]},"agent":{"id":"032","name":"piHole","ip":"192.168.100.3","labels":{"customer":"00001"}},"manager":{"name":"ASHWZHMA"},"id":"1748031846.83734359","cluster":{"name":"socfortress","node":"ASHWZHMA.socfortress.local"},"decoder":{"name":"json"},"data":{"status":"OK","@timestamp":"2025-05-23T20:24:05.033Z","@metadata":{"beat":"packetbeat","type":"_doc","version":"8.7.1"},"network":{"bytes":"248","type":"ipv4","transport":"udp","protocol":"dns","direction":"ingress","community_id":"1:d5Hlw2X6vZE+Qn/Ex1rZR9GqtxA="},"destination":{"bytes":"188","ip":"192.168.100.3","port":"53"},"ecs":{"version":"8.0.0"},"client":{"ip":"192.168.100.1","port":"38616","bytes":"60"},"query":"class IN, type A, www.tm.v4.a.prd.aadg.akadns.net","host":{"name":"piHole","architecture":"x86_64","os":{"codename":"bullseye","type":"linux","platform":"debian","version":"11 (bullseye)","family":"debian","name":"Debian GNU/Linux","kernel":"5.10.0-21-amd64"},"id":"8986bcccef884a1ebe34f1ccd31b4f50","containerized":"false","ip":["192.168.100.3","fe80::20c:29ff:fe09:d59b"],"mac":["00-0C-29-09-D5-9B"],"hostname":"piHole"},"server":{"ip":"192.168.100.3","port":"53","bytes":"188"},"method":"QUERY","related":{"ip":["192.168.100.1","192.168.100.3","20.190.135.17","20.190.135.6","40.126.7.35","40.126.28.23","40.126.28.19","20.190.135.16","40.126.28.11","20.190.135.7"]},"event":{"category":["network"],"type":["connection","protocol"],"dataset":"dns","duration":"63234444","start":"2025-05-23T20:24:05.033Z","end":"2025-05-23T20:24:05.096Z","kind":"event"},"type":"dns","source":{"ip":"192.168.100.1","port":"38616","bytes":"60"},"dns":{"op_code":"QUERY","authorities_count":"0","additionals_count":"0","question":{"name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A","class":"IN","etld_plus_one":"akadns.net","registered_domain":"akadns.net","top_level_domain":"net","subdomain":"www.tm.v4.a.prd.aadg"},"header_flags":["RD","RA","DO"],"opt":{"udp_size":"1232","ext_rcode":"NOERROR","do":"true","version":"0"},"resolved_ip":["20.190.135.17","20.190.135.6","40.126.7.35","40.126.28.23","40.126.28.19","20.190.135.16","40.126.28.11","20.190.135.7"],"id":"1767","flags":{"authoritative":"false","truncated_response":"false","recursion_desired":"true","recursion_available":"true","authentic_data":"false","checking_disabled":"false"},"response_code":"NOERROR","answers":[{"data":"20.190.135.17","name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A","class":"IN","ttl":"93"},{"class":"IN","ttl":"93","data":"20.190.135.6","name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A"},{"type":"A","class":"IN","ttl":"93","data":"40.126.7.35","name":"www.tm.v4.a.prd.aadg.akadns.net"},{"ttl":"93","data":"40.126.28.23","name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A","class":"IN"},{"class":"IN","ttl":"93","data":"40.126.28.19","name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A"},{"type":"A","class":"IN","ttl":"93","data":"20.190.135.16","name":"www.tm.v4.a.prd.aadg.akadns.net"},{"data":"40.126.28.11","name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A","class":"IN","ttl":"93"},{"name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A","class":"IN","ttl":"93","data":"20.190.135.7"}],"type":"answer","answers_count":"8"},"resource":"www.tm.v4.a.prd.aadg.akadns.net","agent":{"version":"8.7.1","ephemeral_id":"f64f34f9-15e3-4717-8349-bc5e342d07c3","id":"9d8db289-3bc9-40d3-92cb-2bd2d9f9434b","name":"piHole","type":"packetbeat"}},"location":"/tmp/packetbeat/packetbeat-20250523-90.ndjson"}',
2705
+ dns_answer:
2706
+ "20.190.135.17, 20.190.135.6, 40.126.7.35, 40.126.28.23, 40.126.28.19, 20.190.135.16, 40.126.28.11, 20.190.135.7",
2707
+ data_dns_id: "1767",
2708
+ src_port: "38616",
2709
+ manager_name: "ASHWZHMA",
2710
+ data_network_direction: "ingress",
2711
+ data_dns_question_top_level_domain: "net",
2712
+ data_event_end: "2025-05-23T20:24:05.096Z",
2713
+ data_agent_name: "piHole",
2714
+ data_client_ip: "192.168.100.1",
2715
+ data_server_bytes: "188",
2716
+ data_dns_flags_authoritative: "false",
2717
+ data_type: "dns",
2718
+ data_dns_header_flags: "RD, RA, DO",
2719
+ data_dns_flags_checking_disabled: "false",
2720
+ location: "/tmp/packetbeat/packetbeat-20250523-90.ndjson",
2721
+ "data_@metadata_version": "8.7.1",
2722
+ data_host_os_name: "Debian GNU/Linux",
2723
+ rule_group3: "dns",
2724
+ msg_timestamp: "2025-05-23T20:24:06.312Z",
2725
+ rule_group2: "packetbeat",
2726
+ rule_group1: "linux"
2727
+ },
2728
+ {
2729
+ data_source_ip: "192.168.100.3",
2730
+ data_host_architecture: "x86_64",
2731
+ agent_id: "032",
2732
+ agent_name: "piHole",
2733
+ gl2_remote_ip: "10.255.255.13",
2734
+ data_resource: "www.tm.v4.a.prd.aadg.akadns.net",
2735
+ agent_labels_customer: "00001",
2736
+ data_ecs_version: "8.0.0",
2737
+ timestamp_utc: "2025-05-23T20:24:05.033Z",
2738
+ data_host_os_codename: "bullseye",
2739
+ syslog_type: "wazuh",
2740
+ gl2_source_node: "3b68efa4-3319-4885-a38f-c944f0fcf191",
2741
+ id: "1748031846.83738118",
2742
+ data_dns_question_etld_plus_one: "akadns.net",
2743
+ data_server_port: "53",
2744
+ rule_mitre_tactic: "Command and Control",
2745
+ gl2_accounted_message_size: 8057,
2746
+ data_agent_type: "packetbeat",
2747
+ streams: ["660320f176ca320e8393f057"],
2748
+ rule_mitre_id: "T1071",
2749
+ data_destination_bytes: "188",
2750
+ data_event_dataset: "dns",
2751
+ "data_@metadata_beat": "packetbeat",
2752
+ agent_ip: "192.168.100.3",
2753
+ data_source_port: "35015",
2754
+ data_host_id: "8986bcccef884a1ebe34f1ccd31b4f50",
2755
+ data_event_kind: "event",
2756
+ data_network_protocol: "dns",
2757
+ dns_response_code: "NOERROR",
2758
+ dns_query: "www.tm.v4.a.prd.aadg.akadns.net",
2759
+ data_dns_response_code: "NOERROR",
2760
+ data_network_community_id: "1:oWVDnNzsSDgmenqSFSwrd2TfgeM=",
2761
+ data_dns_flags_truncated_response: "false",
2762
+ rule_mail: false,
2763
+ data_dns_opt_udp_size: "1232",
2764
+ data_event_category: "network",
2765
+ data_dns_flags_recursion_available: "true",
2766
+ data_dns_opt_version: "0",
2767
+ timestamp: "2025-05-23 20:24:09.408",
2768
+ data_host_mac: "00-0C-29-09-D5-9B",
2769
+ data_agent_id: "9d8db289-3bc9-40d3-92cb-2bd2d9f9434b",
2770
+ data_destination_port: "53",
2771
+ data_dns_type: "answer",
2772
+ traffic_direction: "egress",
2773
+ rule_id: "200300",
2774
+ data_dns_question_class: "IN",
2775
+ cluster_node: "ASHWZHMA.socfortress.local",
2776
+ dst_port: "53",
2777
+ "data_@timestamp": "2025-05-23T20:24:05.033Z",
2778
+ data_host_os_platform: "debian",
2779
+ data_event_duration: "63064417",
2780
+ data_dns_flags_recursion_desired: "true",
2781
+ data_host_name: "piHole",
2782
+ data_dns_question_subdomain: "www.tm.v4.a.prd.aadg",
2783
+ gl2_remote_port: 53290,
2784
+ data_host_os_type: "linux",
2785
+ source: "10.255.255.13",
2786
+ gl2_source_input: "660320f176ca320e8393f030",
2787
+ rule_level: 3,
2788
+ data_event_type: "connection, protocol",
2789
+ data_host_os_family: "debian",
2790
+ data_dns_additionals_count: "0",
2791
+ data_dns_flags_authentic_data: "false",
2792
+ protocol: "udp",
2793
+ data_dns_answers:
2794
+ "{name=www.tm.v4.a.prd.aadg.akadns.net, type=A, class=IN, ttl=93, data=20.190.135.17}, {name=www.tm.v4.a.prd.aadg.akadns.net, type=A, class=IN, ttl=93, data=20.190.135.6}, {ttl=93, data=40.126.7.35, name=www.tm.v4.a.prd.aadg.akadns.net, type=A, class=IN}, {data=40.126.28.23, name=www.tm.v4.a.prd.aadg.akadns.net, type=A, class=IN, ttl=93}, {ttl=93, data=40.126.28.19, name=www.tm.v4.a.prd.aadg.akadns.net, type=A, class=IN}, {data=20.190.135.16, name=www.tm.v4.a.prd.aadg.akadns.net, type=A, class=IN, ttl=93}, {type=A, class=IN, ttl=93, data=40.126.28.11, name=www.tm.v4.a.prd.aadg.akadns.net}, {ttl=93, data=20.190.135.7, name=www.tm.v4.a.prd.aadg.akadns.net, type=A, class=IN}",
2795
+ data_event_start: "2025-05-23T20:24:05.033Z",
2796
+ data_agent_ephemeral_id: "f64f34f9-15e3-4717-8349-bc5e342d07c3",
2797
+ rule_description: "Linux: DNS Query to www.tm.v4.a.prd.aadg.akadns.net",
2798
+ data_related_ip:
2799
+ "192.168.100.3, 1.1.1.3, 20.190.135.17, 20.190.135.6, 40.126.7.35, 40.126.28.23, 40.126.28.19, 20.190.135.16, 40.126.28.11, 20.190.135.7",
2800
+ data_agent_version: "8.7.1",
2801
+ data_status: "OK",
2802
+ data_query: "class IN, type A, www.tm.v4.a.prd.aadg.akadns.net",
2803
+ "data_@metadata_type": "_doc",
2804
+ data_dns_question_registered_domain: "akadns.net",
2805
+ data_method: "QUERY",
2806
+ data_server_ip: "1.1.1.3",
2807
+ gl2_message_id: "01JVZD2GY0QX7GK1F7ZY7JBJTR",
2808
+ data_dns_answers_count: "8",
2809
+ data_network_type: "ipv4",
2810
+ data_dns_opt_ext_rcode: "NOERROR",
2811
+ data_client_port: "35015",
2812
+ data_network_bytes: "248",
2813
+ data_dns_resolved_ip:
2814
+ "20.190.135.17, 20.190.135.6, 40.126.7.35, 40.126.28.23, 40.126.28.19, 20.190.135.16, 40.126.28.11, 20.190.135.7",
2815
+ data_host_containerized: "false",
2816
+ true: 1748031846.950923,
2817
+ data_host_hostname: "piHole",
2818
+ rule_groups: "linux, packetbeat, dns",
2819
+ data_client_bytes: "60",
2820
+ data_dns_question_type: "A",
2821
+ data_host_ip: "192.168.100.3, fe80::20c:29ff:fe09:d59b",
2822
+ data_destination_ip: "1.1.1.3",
2823
+ rule_mitre_technique: "Application Layer Protocol",
2824
+ rule_firedtimes: 279,
2825
+ data_network_transport: "udp",
2826
+ dst_ip: "1.1.1.3",
2827
+ src_ip: "192.168.100.3",
2828
+ decoder_name: "json",
2829
+ syslog_level: "INFO",
2830
+ data_dns_op_code: "QUERY",
2831
+ data_host_os_version: "11 (bullseye)",
2832
+ data_host_os_kernel: "5.10.0-21-amd64",
2833
+ cluster_name: "socfortress",
2834
+ data_source_bytes: "60",
2835
+ gl2_processing_error:
2836
+ 'Replaced invalid timestamp value in message <e18fd800-3813-11f0-91aa-8600007a2218> with current time - Value <2025-05-23T20:24:06.312+0000> caused exception: Invalid format: "2025-05-23T20:24:06.312+0000" is malformed at "T20:24:06.312+0000".',
2837
+ data_dns_opt_do: "true",
2838
+ data_dns_authorities_count: "0",
2839
+ data_dns_question_name: "www.tm.v4.a.prd.aadg.akadns.net",
2840
+ message:
2841
+ '{"true":1748031846.950923,"timestamp":"2025-05-23T20:24:06.312+0000","rule":{"level":3,"description":"Linux: DNS Query to www.tm.v4.a.prd.aadg.akadns.net","id":"200300","mitre":{"id":["T1071"],"tactic":["Command and Control"],"technique":["Application Layer Protocol"]},"firedtimes":279,"mail":false,"groups":["linux","packetbeat","dns"]},"agent":{"id":"032","name":"piHole","ip":"192.168.100.3","labels":{"customer":"00001"}},"manager":{"name":"ASHWZHMA"},"id":"1748031846.83738118","cluster":{"name":"socfortress","node":"ASHWZHMA.socfortress.local"},"decoder":{"name":"json"},"data":{"status":"OK","@timestamp":"2025-05-23T20:24:05.033Z","@metadata":{"beat":"packetbeat","type":"_doc","version":"8.7.1"},"client":{"port":"35015","bytes":"60","ip":"192.168.100.3"},"dns":{"op_code":"QUERY","answers":[{"name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A","class":"IN","ttl":"93","data":"20.190.135.17"},{"name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A","class":"IN","ttl":"93","data":"20.190.135.6"},{"ttl":"93","data":"40.126.7.35","name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A","class":"IN"},{"data":"40.126.28.23","name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A","class":"IN","ttl":"93"},{"ttl":"93","data":"40.126.28.19","name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A","class":"IN"},{"data":"20.190.135.16","name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A","class":"IN","ttl":"93"},{"type":"A","class":"IN","ttl":"93","data":"40.126.28.11","name":"www.tm.v4.a.prd.aadg.akadns.net"},{"ttl":"93","data":"20.190.135.7","name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A","class":"IN"}],"additionals_count":"0","question":{"class":"IN","etld_plus_one":"akadns.net","registered_domain":"akadns.net","top_level_domain":"net","subdomain":"www.tm.v4.a.prd.aadg","name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A"},"opt":{"do":"true","version":"0","udp_size":"1232","ext_rcode":"NOERROR"},"type":"answer","id":"11576","answers_count":"8","resolved_ip":["20.190.135.17","20.190.135.6","40.126.7.35","40.126.28.23","40.126.28.19","20.190.135.16","40.126.28.11","20.190.135.7"],"authorities_count":"0","flags":{"authentic_data":"false","checking_disabled":"false","authoritative":"false","truncated_response":"false","recursion_desired":"true","recursion_available":"true"},"response_code":"NOERROR","header_flags":["RD","RA","DO"]},"host":{"name":"piHole","mac":["00-0C-29-09-D5-9B"],"hostname":"piHole","architecture":"x86_64","os":{"version":"11 (bullseye)","family":"debian","name":"Debian GNU/Linux","kernel":"5.10.0-21-amd64","codename":"bullseye","type":"linux","platform":"debian"},"id":"8986bcccef884a1ebe34f1ccd31b4f50","containerized":"false","ip":["192.168.100.3","fe80::20c:29ff:fe09:d59b"]},"destination":{"bytes":"188","ip":"1.1.1.3","port":"53"},"event":{"end":"2025-05-23T20:24:05.096Z","kind":"event","category":["network"],"type":["connection","protocol"],"dataset":"dns","duration":"63064417","start":"2025-05-23T20:24:05.033Z"},"method":"QUERY","query":"class IN, type A, www.tm.v4.a.prd.aadg.akadns.net","server":{"ip":"1.1.1.3","port":"53","bytes":"188"},"related":{"ip":["192.168.100.3","1.1.1.3","20.190.135.17","20.190.135.6","40.126.7.35","40.126.28.23","40.126.28.19","20.190.135.16","40.126.28.11","20.190.135.7"]},"resource":"www.tm.v4.a.prd.aadg.akadns.net","agent":{"ephemeral_id":"f64f34f9-15e3-4717-8349-bc5e342d07c3","id":"9d8db289-3bc9-40d3-92cb-2bd2d9f9434b","name":"piHole","type":"packetbeat","version":"8.7.1"},"type":"dns","source":{"ip":"192.168.100.3","port":"35015","bytes":"60"},"network":{"direction":"egress","community_id":"1:oWVDnNzsSDgmenqSFSwrd2TfgeM=","bytes":"248","type":"ipv4","transport":"udp","protocol":"dns"},"ecs":{"version":"8.0.0"}},"location":"/tmp/packetbeat/packetbeat-20250523-90.ndjson"}',
2842
+ dns_answer:
2843
+ "20.190.135.17, 20.190.135.6, 40.126.7.35, 40.126.28.23, 40.126.28.19, 20.190.135.16, 40.126.28.11, 20.190.135.7",
2844
+ data_dns_id: "11576",
2845
+ src_port: "35015",
2846
+ manager_name: "ASHWZHMA",
2847
+ data_dns_question_top_level_domain: "net",
2848
+ data_network_direction: "egress",
2849
+ data_event_end: "2025-05-23T20:24:05.096Z",
2850
+ data_agent_name: "piHole",
2851
+ data_client_ip: "192.168.100.3",
2852
+ data_dns_flags_authoritative: "false",
2853
+ data_server_bytes: "188",
2854
+ data_dns_header_flags: "RD, RA, DO",
2855
+ data_type: "dns",
2856
+ data_dns_flags_checking_disabled: "false",
2857
+ location: "/tmp/packetbeat/packetbeat-20250523-90.ndjson",
2858
+ "data_@metadata_version": "8.7.1",
2859
+ data_host_os_name: "Debian GNU/Linux",
2860
+ rule_group3: "dns",
2861
+ msg_timestamp: "2025-05-23T20:24:06.312Z",
2862
+ rule_group2: "packetbeat",
2863
+ rule_group1: "linux"
2864
+ },
2865
+ {
2866
+ data_source_ip: "192.168.100.1",
2867
+ data_host_architecture: "x86_64",
2868
+ agent_id: "032",
2869
+ agent_name: "piHole",
2870
+ gl2_remote_ip: "10.255.255.13",
2871
+ data_resource: "www.tm.lg.prod.aadmsa.trafficmanager.net",
2872
+ agent_labels_customer: "00001",
2873
+ data_ecs_version: "8.0.0",
2874
+ timestamp_utc: "2025-05-23T20:24:04.870Z",
2875
+ data_host_os_codename: "bullseye",
2876
+ syslog_type: "wazuh",
2877
+ gl2_source_node: "3b68efa4-3319-4885-a38f-c944f0fcf191",
2878
+ id: "1748031846.83726440",
2879
+ data_dns_question_etld_plus_one: "trafficmanager.net",
2880
+ data_server_port: "53",
2881
+ rule_mitre_tactic: "Command and Control",
2882
+ gl2_accounted_message_size: 8706,
2883
+ data_agent_type: "packetbeat",
2884
+ streams: ["660320f176ca320e8393f057"],
2885
+ rule_mitre_id: "T1071",
2886
+ data_destination_bytes: "279",
2887
+ data_event_dataset: "dns",
2888
+ "data_@metadata_beat": "packetbeat",
2889
+ agent_ip: "192.168.100.3",
2890
+ data_source_port: "10699",
2891
+ data_host_id: "8986bcccef884a1ebe34f1ccd31b4f50",
2892
+ data_event_kind: "event",
2893
+ data_network_protocol: "dns",
2894
+ dns_response_code: "NOERROR",
2895
+ dns_query: "www.tm.lg.prod.aadmsa.trafficmanager.net",
2896
+ data_dns_response_code: "NOERROR",
2897
+ data_network_community_id: "1:rRbPmhPceaU7J6cD1EfgYg23n5U=",
2898
+ data_dns_flags_truncated_response: "false",
2899
+ rule_mail: false,
2900
+ data_dns_opt_udp_size: "1232",
2901
+ data_event_category: "network",
2902
+ data_dns_flags_recursion_available: "true",
2903
+ data_dns_opt_version: "0",
2904
+ timestamp: "2025-05-23 20:24:09.407",
2905
+ data_host_mac: "00-0C-29-09-D5-9B",
2906
+ data_agent_id: "9d8db289-3bc9-40d3-92cb-2bd2d9f9434b",
2907
+ data_destination_port: "53",
2908
+ data_dns_type: "answer",
2909
+ traffic_direction: "ingress",
2910
+ rule_id: "200300",
2911
+ data_dns_question_class: "IN",
2912
+ cluster_node: "ASHWZHMA.socfortress.local",
2913
+ dst_port: "53",
2914
+ "data_@timestamp": "2025-05-23T20:24:04.870Z",
2915
+ data_event_duration: "50793434",
2916
+ data_host_os_platform: "debian",
2917
+ data_dns_flags_recursion_desired: "true",
2918
+ data_host_name: "piHole",
2919
+ data_dns_question_subdomain: "www.tm.lg.prod.aadmsa",
2920
+ gl2_remote_port: 53290,
2921
+ data_host_os_type: "linux",
2922
+ source: "10.255.255.13",
2923
+ gl2_source_input: "660320f176ca320e8393f030",
2924
+ rule_level: 3,
2925
+ data_event_type: "connection, protocol",
2926
+ data_host_os_family: "debian",
2927
+ data_dns_additionals_count: "0",
2928
+ data_dns_flags_authentic_data: "false",
2929
+ protocol: "udp",
2930
+ data_dns_answers:
2931
+ "{ttl=271, data=prdv4a.aadg.msidentity.com, name=www.tm.lg.prod.aadmsa.trafficmanager.net, type=CNAME, class=IN}, {class=IN, ttl=271, data=www.tm.v4.a.prd.aadg.akadns.net, name=prdv4a.aadg.msidentity.com, type=CNAME}, {name=www.tm.v4.a.prd.aadg.akadns.net, type=A, class=IN, ttl=271, data=40.126.29.10}, {ttl=271, data=40.126.29.7, name=www.tm.v4.a.prd.aadg.akadns.net, type=A, class=IN}, {name=www.tm.v4.a.prd.aadg.akadns.net, type=A, class=IN, ttl=271, data=20.190.157.14}, {class=IN, ttl=271, data=20.190.157.12, name=www.tm.v4.a.prd.aadg.akadns.net, type=A}, {data=20.190.157.1, name=www.tm.v4.a.prd.aadg.akadns.net, type=A, class=IN, ttl=271}, {data=20.190.157.11, name=www.tm.v4.a.prd.aadg.akadns.net, type=A, class=IN, ttl=271}, {data=20.190.157.4, name=www.tm.v4.a.prd.aadg.akadns.net, type=A, class=IN, ttl=271}, {ttl=271, data=40.126.29.11, name=www.tm.v4.a.prd.aadg.akadns.net, type=A, class=IN}",
2932
+ data_event_start: "2025-05-23T20:24:04.870Z",
2933
+ data_agent_ephemeral_id: "f64f34f9-15e3-4717-8349-bc5e342d07c3",
2934
+ rule_description: "Linux: DNS Query to www.tm.lg.prod.aadmsa.trafficmanager.net",
2935
+ data_agent_version: "8.7.1",
2936
+ data_related_ip:
2937
+ "192.168.100.1, 192.168.100.3, 40.126.29.10, 40.126.29.7, 20.190.157.14, 20.190.157.12, 20.190.157.1, 20.190.157.11, 20.190.157.4, 40.126.29.11",
2938
+ data_status: "OK",
2939
+ data_query: "class IN, type A, www.tm.lg.prod.aadmsa.trafficmanager.net",
2940
+ "data_@metadata_type": "_doc",
2941
+ data_dns_question_registered_domain: "trafficmanager.net",
2942
+ data_server_ip: "192.168.100.3",
2943
+ data_method: "QUERY",
2944
+ gl2_message_id: "01JVZD2GXZZKVQKRG4WAY9N6VG",
2945
+ data_dns_answers_count: "10",
2946
+ data_network_type: "ipv4",
2947
+ data_dns_opt_ext_rcode: "NOERROR",
2948
+ data_client_port: "10699",
2949
+ data_network_bytes: "348",
2950
+ data_dns_resolved_ip:
2951
+ "40.126.29.10, 40.126.29.7, 20.190.157.14, 20.190.157.12, 20.190.157.1, 20.190.157.11, 20.190.157.4, 40.126.29.11",
2952
+ data_host_containerized: "false",
2953
+ true: 1748031846.313229,
2954
+ data_host_hostname: "piHole",
2955
+ rule_groups: "linux, packetbeat, dns",
2956
+ data_client_bytes: "69",
2957
+ data_dns_question_type: "A",
2958
+ data_host_ip: "192.168.100.3, fe80::20c:29ff:fe09:d59b",
2959
+ data_destination_ip: "192.168.100.3",
2960
+ rule_mitre_technique: "Application Layer Protocol",
2961
+ rule_firedtimes: 276,
2962
+ data_network_transport: "udp",
2963
+ dst_ip: "192.168.100.3",
2964
+ src_ip: "192.168.100.1",
2965
+ decoder_name: "json",
2966
+ syslog_level: "INFO",
2967
+ data_dns_op_code: "QUERY",
2968
+ data_host_os_version: "11 (bullseye)",
2969
+ data_host_os_kernel: "5.10.0-21-amd64",
2970
+ cluster_name: "socfortress",
2971
+ data_source_bytes: "69",
2972
+ gl2_processing_error:
2973
+ 'Replaced invalid timestamp value in message <e18f62d1-3813-11f0-91aa-8600007a2218> with current time - Value <2025-05-23T20:24:06.276+0000> caused exception: Invalid format: "2025-05-23T20:24:06.276+0000" is malformed at "T20:24:06.276+0000".',
2974
+ data_dns_opt_do: "true",
2975
+ data_dns_authorities_count: "0",
2976
+ data_dns_question_name: "www.tm.lg.prod.aadmsa.trafficmanager.net",
2977
+ message:
2978
+ '{"true":1748031846.313229,"timestamp":"2025-05-23T20:24:06.276+0000","rule":{"level":3,"description":"Linux: DNS Query to www.tm.lg.prod.aadmsa.trafficmanager.net","id":"200300","mitre":{"id":["T1071"],"tactic":["Command and Control"],"technique":["Application Layer Protocol"]},"firedtimes":276,"mail":false,"groups":["linux","packetbeat","dns"]},"agent":{"id":"032","name":"piHole","ip":"192.168.100.3","labels":{"customer":"00001"}},"manager":{"name":"ASHWZHMA"},"id":"1748031846.83726440","cluster":{"name":"socfortress","node":"ASHWZHMA.socfortress.local"},"decoder":{"name":"json"},"data":{"status":"OK","@timestamp":"2025-05-23T20:24:04.870Z","@metadata":{"beat":"packetbeat","type":"_doc","version":"8.7.1"},"client":{"port":"10699","bytes":"69","ip":"192.168.100.1"},"dns":{"additionals_count":"0","op_code":"QUERY","response_code":"NOERROR","resolved_ip":["40.126.29.10","40.126.29.7","20.190.157.14","20.190.157.12","20.190.157.1","20.190.157.11","20.190.157.4","40.126.29.11"],"authorities_count":"0","type":"answer","id":"17026","flags":{"checking_disabled":"false","authoritative":"false","truncated_response":"false","recursion_desired":"true","recursion_available":"true","authentic_data":"false"},"opt":{"do":"true","version":"0","udp_size":"1232","ext_rcode":"NOERROR"},"header_flags":["RD","RA","DO"],"answers":[{"ttl":"271","data":"prdv4a.aadg.msidentity.com","name":"www.tm.lg.prod.aadmsa.trafficmanager.net","type":"CNAME","class":"IN"},{"class":"IN","ttl":"271","data":"www.tm.v4.a.prd.aadg.akadns.net","name":"prdv4a.aadg.msidentity.com","type":"CNAME"},{"name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A","class":"IN","ttl":"271","data":"40.126.29.10"},{"ttl":"271","data":"40.126.29.7","name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A","class":"IN"},{"name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A","class":"IN","ttl":"271","data":"20.190.157.14"},{"class":"IN","ttl":"271","data":"20.190.157.12","name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A"},{"data":"20.190.157.1","name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A","class":"IN","ttl":"271"},{"data":"20.190.157.11","name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A","class":"IN","ttl":"271"},{"data":"20.190.157.4","name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A","class":"IN","ttl":"271"},{"ttl":"271","data":"40.126.29.11","name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A","class":"IN"}],"answers_count":"10","question":{"name":"www.tm.lg.prod.aadmsa.trafficmanager.net","type":"A","class":"IN","etld_plus_one":"trafficmanager.net","registered_domain":"trafficmanager.net","top_level_domain":"net","subdomain":"www.tm.lg.prod.aadmsa"}},"server":{"bytes":"279","ip":"192.168.100.3","port":"53"},"resource":"www.tm.lg.prod.aadmsa.trafficmanager.net","ecs":{"version":"8.0.0"},"event":{"dataset":"dns","duration":"50793434","start":"2025-05-23T20:24:04.870Z","end":"2025-05-23T20:24:04.921Z","kind":"event","category":["network"],"type":["connection","protocol"]},"host":{"mac":["00-0C-29-09-D5-9B"],"hostname":"piHole","architecture":"x86_64","name":"piHole","os":{"kernel":"5.10.0-21-amd64","codename":"bullseye","type":"linux","platform":"debian","version":"11 (bullseye)","family":"debian","name":"Debian GNU/Linux"},"id":"8986bcccef884a1ebe34f1ccd31b4f50","containerized":"false","ip":["192.168.100.3","fe80::20c:29ff:fe09:d59b"]},"agent":{"name":"piHole","type":"packetbeat","version":"8.7.1","ephemeral_id":"f64f34f9-15e3-4717-8349-bc5e342d07c3","id":"9d8db289-3bc9-40d3-92cb-2bd2d9f9434b"},"related":{"ip":["192.168.100.1","192.168.100.3","40.126.29.10","40.126.29.7","20.190.157.14","20.190.157.12","20.190.157.1","20.190.157.11","20.190.157.4","40.126.29.11"]},"network":{"direction":"ingress","community_id":"1:rRbPmhPceaU7J6cD1EfgYg23n5U=","bytes":"348","type":"ipv4","transport":"udp","protocol":"dns"},"type":"dns","query":"class IN, type A, www.tm.lg.prod.aadmsa.trafficmanager.net","source":{"port":"10699","bytes":"69","ip":"192.168.100.1"},"method":"QUERY","destination":{"ip":"192.168.100.3","port":"53","bytes":"279"}},"location":"/tmp/packetbeat/packetbeat-20250523-90.ndjson"}',
2979
+ dns_answer:
2980
+ "40.126.29.10, 40.126.29.7, 20.190.157.14, 20.190.157.12, 20.190.157.1, 20.190.157.11, 20.190.157.4, 40.126.29.11",
2981
+ data_dns_id: "17026",
2982
+ src_port: "10699",
2983
+ manager_name: "ASHWZHMA",
2984
+ data_dns_question_top_level_domain: "net",
2985
+ data_network_direction: "ingress",
2986
+ data_event_end: "2025-05-23T20:24:04.921Z",
2987
+ data_agent_name: "piHole",
2988
+ data_client_ip: "192.168.100.1",
2989
+ data_dns_flags_authoritative: "false",
2990
+ data_server_bytes: "279",
2991
+ data_dns_header_flags: "RD, RA, DO",
2992
+ data_type: "dns",
2993
+ data_dns_flags_checking_disabled: "false",
2994
+ location: "/tmp/packetbeat/packetbeat-20250523-90.ndjson",
2995
+ "data_@metadata_version": "8.7.1",
2996
+ data_host_os_name: "Debian GNU/Linux",
2997
+ rule_group3: "dns",
2998
+ msg_timestamp: "2025-05-23T20:24:06.276Z",
2999
+ rule_group2: "packetbeat",
3000
+ rule_group1: "linux"
3001
+ },
3002
+ {
3003
+ data_source_ip: "192.168.100.3",
3004
+ data_host_architecture: "x86_64",
3005
+ agent_id: "032",
3006
+ agent_name: "piHole",
3007
+ gl2_remote_ip: "10.255.255.13",
3008
+ data_resource: "login.msa.msidentity.com",
3009
+ agent_labels_customer: "00001",
3010
+ data_ecs_version: "8.0.0",
3011
+ timestamp_utc: "2025-05-23T20:24:04.842Z",
3012
+ data_host_os_codename: "bullseye",
3013
+ syslog_type: "wazuh",
3014
+ gl2_source_node: "3b68efa4-3319-4885-a38f-c944f0fcf191",
3015
+ id: "1748031846.83718115",
3016
+ data_server_port: "53",
3017
+ data_dns_question_etld_plus_one: "msidentity.com",
3018
+ rule_mitre_tactic: "Command and Control",
3019
+ gl2_accounted_message_size: 8828,
3020
+ data_agent_type: "packetbeat",
3021
+ streams: ["660320f176ca320e8393f057"],
3022
+ rule_mitre_id: "T1071",
3023
+ data_destination_bytes: "296",
3024
+ data_event_dataset: "dns",
3025
+ "data_@metadata_beat": "packetbeat",
3026
+ agent_ip: "192.168.100.3",
3027
+ data_source_port: "43412",
3028
+ data_host_id: "8986bcccef884a1ebe34f1ccd31b4f50",
3029
+ data_event_kind: "event",
3030
+ data_network_protocol: "dns",
3031
+ dns_response_code: "NOERROR",
3032
+ dns_query: "login.msa.msidentity.com",
3033
+ data_dns_response_code: "NOERROR",
3034
+ data_network_community_id: "1:wrZWjvynVtKm0XboVC0Mpa+kPsA=",
3035
+ data_dns_flags_truncated_response: "false",
3036
+ rule_mail: false,
3037
+ data_dns_opt_udp_size: "1232",
3038
+ data_event_category: "network",
3039
+ data_dns_flags_recursion_available: "true",
3040
+ data_dns_opt_version: "0",
3041
+ timestamp: "2025-05-23 20:24:09.328",
3042
+ data_host_mac: "00-0C-29-09-D5-9B",
3043
+ data_agent_id: "9d8db289-3bc9-40d3-92cb-2bd2d9f9434b",
3044
+ data_destination_port: "53",
3045
+ data_dns_type: "answer",
3046
+ traffic_direction: "egress",
3047
+ rule_id: "200300",
3048
+ data_dns_question_class: "IN",
3049
+ cluster_node: "ASHWZHMA.socfortress.local",
3050
+ dst_port: "53",
3051
+ "data_@timestamp": "2025-05-23T20:24:04.842Z",
3052
+ data_host_os_platform: "debian",
3053
+ data_event_duration: "27378247",
3054
+ data_host_name: "piHole",
3055
+ data_dns_flags_recursion_desired: "true",
3056
+ data_dns_question_subdomain: "login.msa",
3057
+ gl2_remote_port: 53290,
3058
+ data_host_os_type: "linux",
3059
+ source: "10.255.255.13",
3060
+ gl2_source_input: "660320f176ca320e8393f030",
3061
+ rule_level: 3,
3062
+ data_event_type: "connection, protocol",
3063
+ data_host_os_family: "debian",
3064
+ data_dns_additionals_count: "0",
3065
+ data_dns_flags_authentic_data: "false",
3066
+ protocol: "udp",
3067
+ data_dns_answers:
3068
+ "{class=IN, ttl=88, data=www.tm.lg.prod.aadmsa.trafficmanager.net, name=login.msa.msidentity.com, type=CNAME}, {type=CNAME, class=IN, ttl=88, data=prdv4a.aadg.msidentity.com, name=www.tm.lg.prod.aadmsa.trafficmanager.net}, {data=www.tm.v4.a.prd.aadg.trafficmanager.net, name=prdv4a.aadg.msidentity.com, type=CNAME, class=IN, ttl=88}, {data=40.126.28.20, name=www.tm.v4.a.prd.aadg.trafficmanager.net, type=A, class=IN, ttl=88}, {class=IN, ttl=88, data=40.126.28.23, name=www.tm.v4.a.prd.aadg.trafficmanager.net, type=A}, {ttl=88, data=20.190.135.16, name=www.tm.v4.a.prd.aadg.trafficmanager.net, type=A, class=IN}, {class=IN, ttl=88, data=20.190.135.3, name=www.tm.v4.a.prd.aadg.trafficmanager.net, type=A}, {name=www.tm.v4.a.prd.aadg.trafficmanager.net, type=A, class=IN, ttl=88, data=40.126.28.18}, {type=A, class=IN, ttl=88, data=20.190.135.19, name=www.tm.v4.a.prd.aadg.trafficmanager.net}, {data=40.126.28.13, name=www.tm.v4.a.prd.aadg.trafficmanager.net, type=A, class=IN, ttl=88}, {ttl=88, data=40.126.7.32, name=www.tm.v4.a.prd.aadg.trafficmanager.net, type=A, class=IN}",
3069
+ data_agent_ephemeral_id: "f64f34f9-15e3-4717-8349-bc5e342d07c3",
3070
+ data_event_start: "2025-05-23T20:24:04.842Z",
3071
+ rule_description: "Linux: DNS Query to login.msa.msidentity.com",
3072
+ data_related_ip:
3073
+ "192.168.100.3, 1.1.1.3, 40.126.28.20, 40.126.28.23, 20.190.135.16, 20.190.135.3, 40.126.28.18, 20.190.135.19, 40.126.28.13, 40.126.7.32",
3074
+ data_agent_version: "8.7.1",
3075
+ data_status: "OK",
3076
+ data_query: "class IN, type A, login.msa.msidentity.com",
3077
+ "data_@metadata_type": "_doc",
3078
+ data_method: "QUERY",
3079
+ data_server_ip: "1.1.1.3",
3080
+ data_dns_question_registered_domain: "msidentity.com",
3081
+ gl2_message_id: "01JVZD2GVGY1C7C1BJ4D9YJ6CY",
3082
+ data_dns_answers_count: "11",
3083
+ data_network_type: "ipv4",
3084
+ data_dns_opt_ext_rcode: "NOERROR",
3085
+ data_client_port: "43412",
3086
+ data_network_bytes: "349",
3087
+ data_dns_resolved_ip:
3088
+ "40.126.28.20, 40.126.28.23, 20.190.135.16, 20.190.135.3, 40.126.28.18, 20.190.135.19, 40.126.28.13, 40.126.7.32",
3089
+ data_host_containerized: "false",
3090
+ true: 1748031846.27769,
3091
+ data_host_hostname: "piHole",
3092
+ rule_groups: "linux, packetbeat, dns",
3093
+ data_client_bytes: "53",
3094
+ data_dns_question_type: "A",
3095
+ data_host_ip: "192.168.100.3, fe80::20c:29ff:fe09:d59b",
3096
+ data_destination_ip: "1.1.1.3",
3097
+ rule_mitre_technique: "Application Layer Protocol",
3098
+ rule_firedtimes: 274,
3099
+ data_network_transport: "udp",
3100
+ dst_ip: "1.1.1.3",
3101
+ src_ip: "192.168.100.3",
3102
+ decoder_name: "json",
3103
+ syslog_level: "INFO",
3104
+ data_dns_op_code: "QUERY",
3105
+ data_host_os_version: "11 (bullseye)",
3106
+ data_host_os_kernel: "5.10.0-21-amd64",
3107
+ cluster_name: "socfortress",
3108
+ data_source_bytes: "53",
3109
+ gl2_processing_error:
3110
+ 'Replaced invalid timestamp value in message <e13c87e2-3813-11f0-91aa-8600007a2218> with current time - Value <2025-05-23T20:24:06.276+0000> caused exception: Invalid format: "2025-05-23T20:24:06.276+0000" is malformed at "T20:24:06.276+0000".',
3111
+ data_dns_opt_do: "true",
3112
+ data_dns_authorities_count: "0",
3113
+ data_dns_question_name: "login.msa.msidentity.com",
3114
+ message:
3115
+ '{"true":1748031846.27769,"timestamp":"2025-05-23T20:24:06.276+0000","rule":{"level":3,"description":"Linux: DNS Query to login.msa.msidentity.com","id":"200300","mitre":{"id":["T1071"],"tactic":["Command and Control"],"technique":["Application Layer Protocol"]},"firedtimes":274,"mail":false,"groups":["linux","packetbeat","dns"]},"agent":{"id":"032","name":"piHole","ip":"192.168.100.3","labels":{"customer":"00001"}},"manager":{"name":"ASHWZHMA"},"id":"1748031846.83718115","cluster":{"name":"socfortress","node":"ASHWZHMA.socfortress.local"},"decoder":{"name":"json"},"data":{"status":"OK","@timestamp":"2025-05-23T20:24:04.842Z","@metadata":{"beat":"packetbeat","type":"_doc","version":"8.7.1"},"method":"QUERY","related":{"ip":["192.168.100.3","1.1.1.3","40.126.28.20","40.126.28.23","20.190.135.16","20.190.135.3","40.126.28.18","20.190.135.19","40.126.28.13","40.126.7.32"]},"ecs":{"version":"8.0.0"},"source":{"bytes":"53","ip":"192.168.100.3","port":"43412"},"host":{"hostname":"piHole","architecture":"x86_64","os":{"family":"debian","name":"Debian GNU/Linux","kernel":"5.10.0-21-amd64","codename":"bullseye","type":"linux","platform":"debian","version":"11 (bullseye)"},"id":"8986bcccef884a1ebe34f1ccd31b4f50","name":"piHole","containerized":"false","ip":["192.168.100.3","fe80::20c:29ff:fe09:d59b"],"mac":["00-0C-29-09-D5-9B"]},"query":"class IN, type A, login.msa.msidentity.com","resource":"login.msa.msidentity.com","client":{"port":"43412","bytes":"53","ip":"192.168.100.3"},"server":{"ip":"1.1.1.3","port":"53","bytes":"296"},"agent":{"type":"packetbeat","version":"8.7.1","ephemeral_id":"f64f34f9-15e3-4717-8349-bc5e342d07c3","id":"9d8db289-3bc9-40d3-92cb-2bd2d9f9434b","name":"piHole"},"type":"dns","destination":{"ip":"1.1.1.3","port":"53","bytes":"296"},"event":{"end":"2025-05-23T20:24:04.869Z","kind":"event","category":["network"],"type":["connection","protocol"],"dataset":"dns","duration":"27378247","start":"2025-05-23T20:24:04.842Z"},"dns":{"answers":[{"class":"IN","ttl":"88","data":"www.tm.lg.prod.aadmsa.trafficmanager.net","name":"login.msa.msidentity.com","type":"CNAME"},{"type":"CNAME","class":"IN","ttl":"88","data":"prdv4a.aadg.msidentity.com","name":"www.tm.lg.prod.aadmsa.trafficmanager.net"},{"data":"www.tm.v4.a.prd.aadg.trafficmanager.net","name":"prdv4a.aadg.msidentity.com","type":"CNAME","class":"IN","ttl":"88"},{"data":"40.126.28.20","name":"www.tm.v4.a.prd.aadg.trafficmanager.net","type":"A","class":"IN","ttl":"88"},{"class":"IN","ttl":"88","data":"40.126.28.23","name":"www.tm.v4.a.prd.aadg.trafficmanager.net","type":"A"},{"ttl":"88","data":"20.190.135.16","name":"www.tm.v4.a.prd.aadg.trafficmanager.net","type":"A","class":"IN"},{"class":"IN","ttl":"88","data":"20.190.135.3","name":"www.tm.v4.a.prd.aadg.trafficmanager.net","type":"A"},{"name":"www.tm.v4.a.prd.aadg.trafficmanager.net","type":"A","class":"IN","ttl":"88","data":"40.126.28.18"},{"type":"A","class":"IN","ttl":"88","data":"20.190.135.19","name":"www.tm.v4.a.prd.aadg.trafficmanager.net"},{"data":"40.126.28.13","name":"www.tm.v4.a.prd.aadg.trafficmanager.net","type":"A","class":"IN","ttl":"88"},{"ttl":"88","data":"40.126.7.32","name":"www.tm.v4.a.prd.aadg.trafficmanager.net","type":"A","class":"IN"}],"resolved_ip":["40.126.28.20","40.126.28.23","20.190.135.16","20.190.135.3","40.126.28.18","20.190.135.19","40.126.28.13","40.126.7.32"],"op_code":"QUERY","id":"21047","answers_count":"11","additionals_count":"0","flags":{"checking_disabled":"false","authoritative":"false","truncated_response":"false","recursion_desired":"true","recursion_available":"true","authentic_data":"false"},"header_flags":["RD","RA","DO"],"question":{"registered_domain":"msidentity.com","top_level_domain":"com","subdomain":"login.msa","name":"login.msa.msidentity.com","type":"A","class":"IN","etld_plus_one":"msidentity.com"},"opt":{"version":"0","udp_size":"1232","ext_rcode":"NOERROR","do":"true"},"response_code":"NOERROR","authorities_count":"0","type":"answer"},"network":{"protocol":"dns","direction":"egress","community_id":"1:wrZWjvynVtKm0XboVC0Mpa+kPsA=","bytes":"349","type":"ipv4","transport":"udp"}},"location":"/tmp/packetbeat/packetbeat-20250523-90.ndjson"}',
3116
+ dns_answer:
3117
+ "40.126.28.20, 40.126.28.23, 20.190.135.16, 20.190.135.3, 40.126.28.18, 20.190.135.19, 40.126.28.13, 40.126.7.32",
3118
+ data_dns_id: "21047",
3119
+ src_port: "43412",
3120
+ manager_name: "ASHWZHMA",
3121
+ data_dns_question_top_level_domain: "com",
3122
+ data_network_direction: "egress",
3123
+ data_event_end: "2025-05-23T20:24:04.869Z",
3124
+ data_agent_name: "piHole",
3125
+ data_client_ip: "192.168.100.3",
3126
+ data_server_bytes: "296",
3127
+ data_dns_flags_authoritative: "false",
3128
+ data_type: "dns",
3129
+ data_dns_header_flags: "RD, RA, DO",
3130
+ data_dns_flags_checking_disabled: "false",
3131
+ location: "/tmp/packetbeat/packetbeat-20250523-90.ndjson",
3132
+ "data_@metadata_version": "8.7.1",
3133
+ data_host_os_name: "Debian GNU/Linux",
3134
+ rule_group3: "dns",
3135
+ msg_timestamp: "2025-05-23T20:24:06.276Z",
3136
+ rule_group2: "packetbeat",
3137
+ rule_group1: "linux"
3138
+ },
3139
+ {
3140
+ data_source_ip: "192.168.100.1",
3141
+ data_host_architecture: "x86_64",
3142
+ agent_id: "032",
3143
+ agent_name: "piHole",
3144
+ gl2_remote_ip: "10.255.255.13",
3145
+ data_resource: "login.msa.msidentity.com",
3146
+ agent_labels_customer: "00001",
3147
+ data_ecs_version: "8.0.0",
3148
+ timestamp_utc: "2025-05-23T20:24:04.842Z",
3149
+ data_host_os_codename: "bullseye",
3150
+ syslog_type: "wazuh",
3151
+ gl2_source_node: "3b68efa4-3319-4885-a38f-c944f0fcf191",
3152
+ id: "1748031846.83722268",
3153
+ data_server_port: "53",
3154
+ data_dns_question_etld_plus_one: "msidentity.com",
3155
+ rule_mitre_tactic: "Command and Control",
3156
+ gl2_accounted_message_size: 8874,
3157
+ data_agent_type: "packetbeat",
3158
+ streams: ["660320f176ca320e8393f057"],
3159
+ rule_mitre_id: "T1071",
3160
+ data_destination_bytes: "296",
3161
+ data_event_dataset: "dns",
3162
+ "data_@metadata_beat": "packetbeat",
3163
+ agent_ip: "192.168.100.3",
3164
+ data_source_port: "28861",
3165
+ data_host_id: "8986bcccef884a1ebe34f1ccd31b4f50",
3166
+ data_event_kind: "event",
3167
+ data_network_protocol: "dns",
3168
+ dns_response_code: "NOERROR",
3169
+ dns_query: "login.msa.msidentity.com",
3170
+ data_dns_response_code: "NOERROR",
3171
+ data_network_community_id: "1:BnSWks/M1fOeIzHRcaJbP28aEFM=",
3172
+ data_dns_flags_truncated_response: "false",
3173
+ rule_mail: false,
3174
+ data_dns_opt_udp_size: "1232",
3175
+ data_event_category: "network",
3176
+ data_dns_flags_recursion_available: "true",
3177
+ data_dns_opt_version: "0",
3178
+ timestamp: "2025-05-23 20:24:09.328",
3179
+ data_host_mac: "00-0C-29-09-D5-9B",
3180
+ data_agent_id: "9d8db289-3bc9-40d3-92cb-2bd2d9f9434b",
3181
+ data_destination_port: "53",
3182
+ data_dns_type: "answer",
3183
+ traffic_direction: "ingress",
3184
+ rule_id: "200300",
3185
+ data_dns_question_class: "IN",
3186
+ cluster_node: "ASHWZHMA.socfortress.local",
3187
+ dst_port: "53",
3188
+ "data_@timestamp": "2025-05-23T20:24:04.842Z",
3189
+ data_host_os_platform: "debian",
3190
+ data_event_duration: "27608350",
3191
+ data_host_name: "piHole",
3192
+ data_dns_flags_recursion_desired: "true",
3193
+ data_dns_question_subdomain: "login.msa",
3194
+ gl2_remote_port: 53290,
3195
+ data_host_os_type: "linux",
3196
+ source: "10.255.255.13",
3197
+ gl2_source_input: "660320f176ca320e8393f030",
3198
+ rule_level: 3,
3199
+ data_event_type: "connection, protocol",
3200
+ data_host_os_family: "debian",
3201
+ data_dns_additionals_count: "0",
3202
+ data_dns_flags_authentic_data: "false",
3203
+ protocol: "udp",
3204
+ data_dns_answers:
3205
+ "{ttl=88, data=www.tm.lg.prod.aadmsa.trafficmanager.net, name=login.msa.msidentity.com, type=CNAME, class=IN}, {name=www.tm.lg.prod.aadmsa.trafficmanager.net, type=CNAME, class=IN, ttl=88, data=prdv4a.aadg.msidentity.com}, {type=CNAME, class=IN, ttl=88, data=www.tm.v4.a.prd.aadg.trafficmanager.net, name=prdv4a.aadg.msidentity.com}, {class=IN, ttl=88, data=40.126.28.20, name=www.tm.v4.a.prd.aadg.trafficmanager.net, type=A}, {name=www.tm.v4.a.prd.aadg.trafficmanager.net, type=A, class=IN, ttl=88, data=40.126.28.23}, {class=IN, ttl=88, data=20.190.135.16, name=www.tm.v4.a.prd.aadg.trafficmanager.net, type=A}, {name=www.tm.v4.a.prd.aadg.trafficmanager.net, type=A, class=IN, ttl=88, data=20.190.135.3}, {data=40.126.28.18, name=www.tm.v4.a.prd.aadg.trafficmanager.net, type=A, class=IN, ttl=88}, {data=20.190.135.19, name=www.tm.v4.a.prd.aadg.trafficmanager.net, type=A, class=IN, ttl=88}, {data=40.126.28.13, name=www.tm.v4.a.prd.aadg.trafficmanager.net, type=A, class=IN, ttl=88}, {data=40.126.7.32, name=www.tm.v4.a.prd.aadg.trafficmanager.net, type=A, class=IN, ttl=88}",
3206
+ data_event_start: "2025-05-23T20:24:04.842Z",
3207
+ data_agent_ephemeral_id: "f64f34f9-15e3-4717-8349-bc5e342d07c3",
3208
+ rule_description: "Linux: DNS Query to login.msa.msidentity.com",
3209
+ data_related_ip:
3210
+ "192.168.100.1, 192.168.100.3, 40.126.28.20, 40.126.28.23, 20.190.135.16, 20.190.135.3, 40.126.28.18, 20.190.135.19, 40.126.28.13, 40.126.7.32",
3211
+ data_agent_version: "8.7.1",
3212
+ data_status: "OK",
3213
+ data_query: "class IN, type A, login.msa.msidentity.com",
3214
+ "data_@metadata_type": "_doc",
3215
+ data_method: "QUERY",
3216
+ data_server_ip: "192.168.100.3",
3217
+ data_dns_question_registered_domain: "msidentity.com",
3218
+ gl2_message_id: "01JVZD2GVGJB77P3V6563YFA75",
3219
+ data_dns_answers_count: "11",
3220
+ data_network_type: "ipv4",
3221
+ data_dns_opt_ext_rcode: "NOERROR",
3222
+ data_client_port: "28861",
3223
+ data_network_bytes: "349",
3224
+ data_dns_resolved_ip:
3225
+ "40.126.28.20, 40.126.28.23, 20.190.135.16, 20.190.135.3, 40.126.28.18, 20.190.135.19, 40.126.28.13, 40.126.7.32",
3226
+ data_host_containerized: "false",
3227
+ true: 1748031846.277803,
3228
+ data_host_hostname: "piHole",
3229
+ rule_groups: "linux, packetbeat, dns",
3230
+ data_client_bytes: "53",
3231
+ data_dns_question_type: "A",
3232
+ data_host_ip: "192.168.100.3, fe80::20c:29ff:fe09:d59b",
3233
+ data_destination_ip: "192.168.100.3",
3234
+ rule_mitre_technique: "Application Layer Protocol",
3235
+ rule_firedtimes: 275,
3236
+ data_network_transport: "udp",
3237
+ dst_ip: "192.168.100.3",
3238
+ src_ip: "192.168.100.1",
3239
+ decoder_name: "json",
3240
+ syslog_level: "INFO",
3241
+ data_dns_op_code: "QUERY",
3242
+ data_host_os_version: "11 (bullseye)",
3243
+ data_host_os_kernel: "5.10.0-21-amd64",
3244
+ cluster_name: "socfortress",
3245
+ data_source_bytes: "53",
3246
+ gl2_processing_error:
3247
+ 'Replaced invalid timestamp value in message <e18f62d0-3813-11f0-91aa-8600007a2218> with current time - Value <2025-05-23T20:24:06.276+0000> caused exception: Invalid format: "2025-05-23T20:24:06.276+0000" is malformed at "T20:24:06.276+0000".',
3248
+ data_dns_opt_do: "true",
3249
+ data_dns_authorities_count: "0",
3250
+ data_dns_question_name: "login.msa.msidentity.com",
3251
+ message:
3252
+ '{"true":1748031846.277803,"timestamp":"2025-05-23T20:24:06.276+0000","rule":{"level":3,"description":"Linux: DNS Query to login.msa.msidentity.com","id":"200300","mitre":{"id":["T1071"],"tactic":["Command and Control"],"technique":["Application Layer Protocol"]},"firedtimes":275,"mail":false,"groups":["linux","packetbeat","dns"]},"agent":{"id":"032","name":"piHole","ip":"192.168.100.3","labels":{"customer":"00001"}},"manager":{"name":"ASHWZHMA"},"id":"1748031846.83722268","cluster":{"name":"socfortress","node":"ASHWZHMA.socfortress.local"},"decoder":{"name":"json"},"data":{"status":"OK","@timestamp":"2025-05-23T20:24:04.842Z","@metadata":{"beat":"packetbeat","type":"_doc","version":"8.7.1"},"host":{"architecture":"x86_64","os":{"name":"Debian GNU/Linux","kernel":"5.10.0-21-amd64","codename":"bullseye","type":"linux","platform":"debian","version":"11 (bullseye)","family":"debian"},"id":"8986bcccef884a1ebe34f1ccd31b4f50","containerized":"false","ip":["192.168.100.3","fe80::20c:29ff:fe09:d59b"],"mac":["00-0C-29-09-D5-9B"],"name":"piHole","hostname":"piHole"},"destination":{"ip":"192.168.100.3","port":"53","bytes":"296"},"method":"QUERY","related":{"ip":["192.168.100.1","192.168.100.3","40.126.28.20","40.126.28.23","20.190.135.16","20.190.135.3","40.126.28.18","20.190.135.19","40.126.28.13","40.126.7.32"]},"resource":"login.msa.msidentity.com","client":{"ip":"192.168.100.1","port":"28861","bytes":"53"},"event":{"kind":"event","category":["network"],"type":["connection","protocol"],"dataset":"dns","duration":"27608350","start":"2025-05-23T20:24:04.842Z","end":"2025-05-23T20:24:04.869Z"},"type":"dns","query":"class IN, type A, login.msa.msidentity.com","network":{"direction":"ingress","community_id":"1:BnSWks/M1fOeIzHRcaJbP28aEFM=","bytes":"349","type":"ipv4","transport":"udp","protocol":"dns"},"agent":{"name":"piHole","type":"packetbeat","version":"8.7.1","ephemeral_id":"f64f34f9-15e3-4717-8349-bc5e342d07c3","id":"9d8db289-3bc9-40d3-92cb-2bd2d9f9434b"},"ecs":{"version":"8.0.0"},"server":{"ip":"192.168.100.3","port":"53","bytes":"296"},"dns":{"flags":{"authentic_data":"false","checking_disabled":"false","authoritative":"false","truncated_response":"false","recursion_desired":"true","recursion_available":"true"},"header_flags":["RD","RA","DO"],"resolved_ip":["40.126.28.20","40.126.28.23","20.190.135.16","20.190.135.3","40.126.28.18","20.190.135.19","40.126.28.13","40.126.7.32"],"response_code":"NOERROR","answers":[{"ttl":"88","data":"www.tm.lg.prod.aadmsa.trafficmanager.net","name":"login.msa.msidentity.com","type":"CNAME","class":"IN"},{"name":"www.tm.lg.prod.aadmsa.trafficmanager.net","type":"CNAME","class":"IN","ttl":"88","data":"prdv4a.aadg.msidentity.com"},{"type":"CNAME","class":"IN","ttl":"88","data":"www.tm.v4.a.prd.aadg.trafficmanager.net","name":"prdv4a.aadg.msidentity.com"},{"class":"IN","ttl":"88","data":"40.126.28.20","name":"www.tm.v4.a.prd.aadg.trafficmanager.net","type":"A"},{"name":"www.tm.v4.a.prd.aadg.trafficmanager.net","type":"A","class":"IN","ttl":"88","data":"40.126.28.23"},{"class":"IN","ttl":"88","data":"20.190.135.16","name":"www.tm.v4.a.prd.aadg.trafficmanager.net","type":"A"},{"name":"www.tm.v4.a.prd.aadg.trafficmanager.net","type":"A","class":"IN","ttl":"88","data":"20.190.135.3"},{"data":"40.126.28.18","name":"www.tm.v4.a.prd.aadg.trafficmanager.net","type":"A","class":"IN","ttl":"88"},{"data":"20.190.135.19","name":"www.tm.v4.a.prd.aadg.trafficmanager.net","type":"A","class":"IN","ttl":"88"},{"data":"40.126.28.13","name":"www.tm.v4.a.prd.aadg.trafficmanager.net","type":"A","class":"IN","ttl":"88"},{"data":"40.126.7.32","name":"www.tm.v4.a.prd.aadg.trafficmanager.net","type":"A","class":"IN","ttl":"88"}],"authorities_count":"0","answers_count":"11","type":"answer","opt":{"udp_size":"1232","ext_rcode":"NOERROR","do":"true","version":"0"},"additionals_count":"0","id":"33835","op_code":"QUERY","question":{"registered_domain":"msidentity.com","top_level_domain":"com","subdomain":"login.msa","name":"login.msa.msidentity.com","type":"A","class":"IN","etld_plus_one":"msidentity.com"}},"source":{"port":"28861","bytes":"53","ip":"192.168.100.1"}},"location":"/tmp/packetbeat/packetbeat-20250523-90.ndjson"}',
3253
+ dns_answer:
3254
+ "40.126.28.20, 40.126.28.23, 20.190.135.16, 20.190.135.3, 40.126.28.18, 20.190.135.19, 40.126.28.13, 40.126.7.32",
3255
+ data_dns_id: "33835",
3256
+ src_port: "28861",
3257
+ manager_name: "ASHWZHMA",
3258
+ data_network_direction: "ingress",
3259
+ data_dns_question_top_level_domain: "com",
3260
+ data_event_end: "2025-05-23T20:24:04.869Z",
3261
+ data_agent_name: "piHole",
3262
+ data_client_ip: "192.168.100.1",
3263
+ data_server_bytes: "296",
3264
+ data_dns_flags_authoritative: "false",
3265
+ data_type: "dns",
3266
+ data_dns_header_flags: "RD, RA, DO",
3267
+ data_dns_flags_checking_disabled: "false",
3268
+ location: "/tmp/packetbeat/packetbeat-20250523-90.ndjson",
3269
+ "data_@metadata_version": "8.7.1",
3270
+ data_host_os_name: "Debian GNU/Linux",
3271
+ rule_group3: "dns",
3272
+ msg_timestamp: "2025-05-23T20:24:06.276Z",
3273
+ rule_group2: "packetbeat",
3274
+ rule_group1: "linux"
3275
+ },
3276
+ {
3277
+ data_source_ip: "192.168.100.3",
3278
+ data_host_architecture: "x86_64",
3279
+ agent_id: "032",
3280
+ agent_name: "piHole",
3281
+ gl2_remote_ip: "10.255.255.13",
3282
+ data_resource: "prdv4a.aadg.msidentity.com",
3283
+ agent_labels_customer: "00001",
3284
+ data_ecs_version: "8.0.0",
3285
+ timestamp_utc: "2025-05-23T20:24:04.995Z",
3286
+ data_host_os_codename: "bullseye",
3287
+ syslog_type: "wazuh",
3288
+ gl2_source_node: "3b68efa4-3319-4885-a38f-c944f0fcf191",
3289
+ id: "1748031846.83730512",
3290
+ data_dns_question_etld_plus_one: "msidentity.com",
3291
+ data_server_port: "53",
3292
+ rule_mitre_tactic: "Command and Control",
3293
+ gl2_accounted_message_size: 8249,
3294
+ data_agent_type: "packetbeat",
3295
+ streams: ["660320f176ca320e8393f057"],
3296
+ rule_mitre_id: "T1071",
3297
+ data_destination_bytes: "228",
3298
+ data_event_dataset: "dns",
3299
+ "data_@metadata_beat": "packetbeat",
3300
+ agent_ip: "192.168.100.3",
3301
+ data_source_port: "38863",
3302
+ data_host_id: "8986bcccef884a1ebe34f1ccd31b4f50",
3303
+ data_event_kind: "event",
3304
+ data_network_protocol: "dns",
3305
+ dns_response_code: "NOERROR",
3306
+ dns_query: "prdv4a.aadg.msidentity.com",
3307
+ data_dns_response_code: "NOERROR",
3308
+ data_network_community_id: "1:owkn6wop0ljZlI813Huqub9Sj0A=",
3309
+ data_dns_flags_truncated_response: "false",
3310
+ rule_mail: false,
3311
+ data_dns_opt_udp_size: "1232",
3312
+ data_event_category: "network",
3313
+ data_dns_flags_recursion_available: "true",
3314
+ data_dns_opt_version: "0",
3315
+ timestamp: "2025-05-23 20:24:08.831",
3316
+ data_host_mac: "00-0C-29-09-D5-9B",
3317
+ data_agent_id: "9d8db289-3bc9-40d3-92cb-2bd2d9f9434b",
3318
+ data_destination_port: "53",
3319
+ data_dns_type: "answer",
3320
+ traffic_direction: "egress",
3321
+ rule_id: "200300",
3322
+ data_dns_question_class: "IN",
3323
+ cluster_node: "ASHWZHMA.socfortress.local",
3324
+ dst_port: "53",
3325
+ "data_@timestamp": "2025-05-23T20:24:04.995Z",
3326
+ data_host_os_platform: "debian",
3327
+ data_event_duration: "36713343",
3328
+ data_host_name: "piHole",
3329
+ data_dns_flags_recursion_desired: "true",
3330
+ data_dns_question_subdomain: "prdv4a.aadg",
3331
+ gl2_remote_port: 53290,
3332
+ data_host_os_type: "linux",
3333
+ source: "10.255.255.13",
3334
+ gl2_source_input: "660320f176ca320e8393f030",
3335
+ rule_level: 3,
3336
+ data_event_type: "connection, protocol",
3337
+ data_host_os_family: "debian",
3338
+ data_dns_additionals_count: "0",
3339
+ data_dns_flags_authentic_data: "false",
3340
+ protocol: "udp",
3341
+ data_dns_answers:
3342
+ "{ttl=251, data=www.tm.v4.a.prd.aadg.akadns.net, name=prdv4a.aadg.msidentity.com, type=CNAME, class=IN}, {type=A, class=IN, ttl=251, data=40.126.29.8, name=www.tm.v4.a.prd.aadg.akadns.net}, {data=40.126.29.7, name=www.tm.v4.a.prd.aadg.akadns.net, type=A, class=IN, ttl=251}, {data=40.126.29.11, name=www.tm.v4.a.prd.aadg.akadns.net, type=A, class=IN, ttl=251}, {data=40.126.29.12, name=www.tm.v4.a.prd.aadg.akadns.net, type=A, class=IN, ttl=251}, {ttl=251, data=20.190.157.12, name=www.tm.v4.a.prd.aadg.akadns.net, type=A, class=IN}, {type=A, class=IN, ttl=251, data=20.190.157.11, name=www.tm.v4.a.prd.aadg.akadns.net}, {ttl=251, data=20.190.157.14, name=www.tm.v4.a.prd.aadg.akadns.net, type=A, class=IN}, {name=www.tm.v4.a.prd.aadg.akadns.net, type=A, class=IN, ttl=251, data=20.190.157.4}",
3343
+ data_event_start: "2025-05-23T20:24:04.995Z",
3344
+ data_agent_ephemeral_id: "f64f34f9-15e3-4717-8349-bc5e342d07c3",
3345
+ rule_description: "Linux: DNS Query to prdv4a.aadg.msidentity.com",
3346
+ data_related_ip:
3347
+ "192.168.100.3, 1.1.1.3, 40.126.29.8, 40.126.29.7, 40.126.29.11, 40.126.29.12, 20.190.157.12, 20.190.157.11, 20.190.157.14, 20.190.157.4",
3348
+ data_agent_version: "8.7.1",
3349
+ data_status: "OK",
3350
+ data_query: "class IN, type A, prdv4a.aadg.msidentity.com",
3351
+ "data_@metadata_type": "_doc",
3352
+ data_dns_question_registered_domain: "msidentity.com",
3353
+ data_method: "QUERY",
3354
+ data_server_ip: "1.1.1.3",
3355
+ gl2_message_id: "01JVZD2GBZBZKK1FQWFEC4ATJ6",
3356
+ data_dns_answers_count: "9",
3357
+ data_network_type: "ipv4",
3358
+ data_dns_opt_ext_rcode: "NOERROR",
3359
+ data_client_port: "38863",
3360
+ data_network_bytes: "283",
3361
+ data_dns_resolved_ip:
3362
+ "40.126.29.8, 40.126.29.7, 40.126.29.11, 40.126.29.12, 20.190.157.12, 20.190.157.11, 20.190.157.14, 20.190.157.4",
3363
+ data_host_containerized: "false",
3364
+ true: 1748031846.313568,
3365
+ data_host_hostname: "piHole",
3366
+ rule_groups: "linux, packetbeat, dns",
3367
+ data_client_bytes: "55",
3368
+ data_dns_question_type: "A",
3369
+ data_destination_ip: "1.1.1.3",
3370
+ data_host_ip: "192.168.100.3, fe80::20c:29ff:fe09:d59b",
3371
+ rule_mitre_technique: "Application Layer Protocol",
3372
+ rule_firedtimes: 277,
3373
+ data_network_transport: "udp",
3374
+ dst_ip: "1.1.1.3",
3375
+ src_ip: "192.168.100.3",
3376
+ decoder_name: "json",
3377
+ syslog_level: "INFO",
3378
+ data_dns_op_code: "QUERY",
3379
+ data_host_os_version: "11 (bullseye)",
3380
+ data_host_os_kernel: "5.10.0-21-amd64",
3381
+ cluster_name: "socfortress",
3382
+ data_source_bytes: "55",
3383
+ gl2_processing_error:
3384
+ 'Replaced invalid timestamp value in message <e18f62d2-3813-11f0-91aa-8600007a2218> with current time - Value <2025-05-23T20:24:06.312+0000> caused exception: Invalid format: "2025-05-23T20:24:06.312+0000" is malformed at "T20:24:06.312+0000".',
3385
+ data_dns_opt_do: "true",
3386
+ data_dns_authorities_count: "0",
3387
+ data_dns_question_name: "prdv4a.aadg.msidentity.com",
3388
+ message:
3389
+ '{"true":1748031846.313568,"timestamp":"2025-05-23T20:24:06.312+0000","rule":{"level":3,"description":"Linux: DNS Query to prdv4a.aadg.msidentity.com","id":"200300","mitre":{"id":["T1071"],"tactic":["Command and Control"],"technique":["Application Layer Protocol"]},"firedtimes":277,"mail":false,"groups":["linux","packetbeat","dns"]},"agent":{"id":"032","name":"piHole","ip":"192.168.100.3","labels":{"customer":"00001"}},"manager":{"name":"ASHWZHMA"},"id":"1748031846.83730512","cluster":{"name":"socfortress","node":"ASHWZHMA.socfortress.local"},"decoder":{"name":"json"},"data":{"status":"OK","@timestamp":"2025-05-23T20:24:04.995Z","@metadata":{"beat":"packetbeat","type":"_doc","version":"8.7.1"},"resource":"prdv4a.aadg.msidentity.com","destination":{"ip":"1.1.1.3","port":"53","bytes":"228"},"ecs":{"version":"8.0.0"},"host":{"mac":["00-0C-29-09-D5-9B"],"hostname":"piHole","architecture":"x86_64","name":"piHole","os":{"type":"linux","platform":"debian","version":"11 (bullseye)","family":"debian","name":"Debian GNU/Linux","kernel":"5.10.0-21-amd64","codename":"bullseye"},"id":"8986bcccef884a1ebe34f1ccd31b4f50","containerized":"false","ip":["192.168.100.3","fe80::20c:29ff:fe09:d59b"]},"client":{"ip":"192.168.100.3","port":"38863","bytes":"55"},"network":{"type":"ipv4","transport":"udp","protocol":"dns","direction":"egress","community_id":"1:owkn6wop0ljZlI813Huqub9Sj0A=","bytes":"283"},"dns":{"opt":{"do":"true","version":"0","udp_size":"1232","ext_rcode":"NOERROR"},"type":"answer","flags":{"truncated_response":"false","recursion_desired":"true","recursion_available":"true","authentic_data":"false","checking_disabled":"false","authoritative":"false"},"op_code":"QUERY","additionals_count":"0","id":"60335","header_flags":["RD","RA","DO"],"question":{"class":"IN","etld_plus_one":"msidentity.com","registered_domain":"msidentity.com","top_level_domain":"com","subdomain":"prdv4a.aadg","name":"prdv4a.aadg.msidentity.com","type":"A"},"answers_count":"9","resolved_ip":["40.126.29.8","40.126.29.7","40.126.29.11","40.126.29.12","20.190.157.12","20.190.157.11","20.190.157.14","20.190.157.4"],"response_code":"NOERROR","answers":[{"ttl":"251","data":"www.tm.v4.a.prd.aadg.akadns.net","name":"prdv4a.aadg.msidentity.com","type":"CNAME","class":"IN"},{"type":"A","class":"IN","ttl":"251","data":"40.126.29.8","name":"www.tm.v4.a.prd.aadg.akadns.net"},{"data":"40.126.29.7","name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A","class":"IN","ttl":"251"},{"data":"40.126.29.11","name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A","class":"IN","ttl":"251"},{"data":"40.126.29.12","name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A","class":"IN","ttl":"251"},{"ttl":"251","data":"20.190.157.12","name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A","class":"IN"},{"type":"A","class":"IN","ttl":"251","data":"20.190.157.11","name":"www.tm.v4.a.prd.aadg.akadns.net"},{"ttl":"251","data":"20.190.157.14","name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A","class":"IN"},{"name":"www.tm.v4.a.prd.aadg.akadns.net","type":"A","class":"IN","ttl":"251","data":"20.190.157.4"}],"authorities_count":"0"},"type":"dns","source":{"ip":"192.168.100.3","port":"38863","bytes":"55"},"query":"class IN, type A, prdv4a.aadg.msidentity.com","event":{"dataset":"dns","duration":"36713343","start":"2025-05-23T20:24:04.995Z","end":"2025-05-23T20:24:05.032Z","kind":"event","category":["network"],"type":["connection","protocol"]},"related":{"ip":["192.168.100.3","1.1.1.3","40.126.29.8","40.126.29.7","40.126.29.11","40.126.29.12","20.190.157.12","20.190.157.11","20.190.157.14","20.190.157.4"]},"method":"QUERY","server":{"ip":"1.1.1.3","port":"53","bytes":"228"},"agent":{"version":"8.7.1","ephemeral_id":"f64f34f9-15e3-4717-8349-bc5e342d07c3","id":"9d8db289-3bc9-40d3-92cb-2bd2d9f9434b","name":"piHole","type":"packetbeat"}},"location":"/tmp/packetbeat/packetbeat-20250523-90.ndjson"}',
3390
+ dns_answer:
3391
+ "40.126.29.8, 40.126.29.7, 40.126.29.11, 40.126.29.12, 20.190.157.12, 20.190.157.11, 20.190.157.14, 20.190.157.4",
3392
+ data_dns_id: "60335",
3393
+ src_port: "38863",
3394
+ manager_name: "ASHWZHMA",
3395
+ data_network_direction: "egress",
3396
+ data_dns_question_top_level_domain: "com",
3397
+ data_event_end: "2025-05-23T20:24:05.032Z",
3398
+ data_agent_name: "piHole",
3399
+ data_client_ip: "192.168.100.3",
3400
+ data_dns_flags_authoritative: "false",
3401
+ data_server_bytes: "228",
3402
+ data_dns_header_flags: "RD, RA, DO",
3403
+ data_type: "dns",
3404
+ data_dns_flags_checking_disabled: "false",
3405
+ location: "/tmp/packetbeat/packetbeat-20250523-90.ndjson",
3406
+ "data_@metadata_version": "8.7.1",
3407
+ data_host_os_name: "Debian GNU/Linux",
3408
+ rule_group3: "dns",
3409
+ msg_timestamp: "2025-05-23T20:24:06.312Z",
3410
+ rule_group2: "packetbeat",
3411
+ rule_group1: "linux"
3412
+ },
3413
+ {
3414
+ data_source_ip: "192.168.100.3",
3415
+ data_host_architecture: "x86_64",
3416
+ agent_id: "032",
3417
+ agent_name: "piHole",
3418
+ gl2_remote_ip: "10.255.255.13",
3419
+ data_resource: "login.live.com",
3420
+ agent_labels_customer: "00001",
3421
+ data_ecs_version: "8.0.0",
3422
+ timestamp_utc: "2025-05-23T20:24:04.815Z",
3423
+ data_host_os_codename: "bullseye",
3424
+ syslog_type: "wazuh",
3425
+ gl2_source_node: "3b68efa4-3319-4885-a38f-c944f0fcf191",
3426
+ id: "1748031846.83713929",
3427
+ data_dns_question_etld_plus_one: "live.com",
3428
+ data_server_port: "53",
3429
+ rule_mitre_tactic: "Command and Control",
3430
+ gl2_accounted_message_size: 8868,
3431
+ data_agent_type: "packetbeat",
3432
+ streams: ["660320f176ca320e8393f057"],
3433
+ rule_mitre_id: "T1071",
3434
+ data_destination_bytes: "328",
3435
+ data_event_dataset: "dns",
3436
+ "data_@metadata_beat": "packetbeat",
3437
+ agent_ip: "192.168.100.3",
3438
+ data_source_port: "60286",
3439
+ data_host_id: "8986bcccef884a1ebe34f1ccd31b4f50",
3440
+ data_event_kind: "event",
3441
+ data_network_protocol: "dns",
3442
+ dns_response_code: "NOERROR",
3443
+ dns_query: "login.live.com",
3444
+ data_dns_response_code: "NOERROR",
3445
+ data_network_community_id: "1:1GvoZkkegqS2kWj0nbkXnzAb1QQ=",
3446
+ data_dns_flags_truncated_response: "false",
3447
+ rule_mail: false,
3448
+ data_dns_opt_udp_size: "1232",
3449
+ data_event_category: "network",
3450
+ data_dns_flags_recursion_available: "true",
3451
+ data_dns_opt_version: "0",
3452
+ timestamp: "2025-05-23 20:24:08.830",
3453
+ data_host_mac: "00-0C-29-09-D5-9B",
3454
+ data_agent_id: "9d8db289-3bc9-40d3-92cb-2bd2d9f9434b",
3455
+ data_destination_port: "53",
3456
+ data_dns_type: "answer",
3457
+ traffic_direction: "egress",
3458
+ rule_id: "200300",
3459
+ data_dns_question_class: "IN",
3460
+ cluster_node: "ASHWZHMA.socfortress.local",
3461
+ dst_port: "53",
3462
+ "data_@timestamp": "2025-05-23T20:24:04.815Z",
3463
+ data_host_os_platform: "debian",
3464
+ data_event_duration: "25965908",
3465
+ data_dns_flags_recursion_desired: "true",
3466
+ data_host_name: "piHole",
3467
+ data_dns_question_subdomain: "login",
3468
+ gl2_remote_port: 53290,
3469
+ data_host_os_type: "linux",
3470
+ source: "10.255.255.13",
3471
+ gl2_source_input: "660320f176ca320e8393f030",
3472
+ rule_level: 3,
3473
+ data_event_type: "connection, protocol",
3474
+ data_host_os_family: "debian",
3475
+ data_dns_additionals_count: "0",
3476
+ data_dns_flags_authentic_data: "false",
3477
+ protocol: "udp",
3478
+ data_dns_answers:
3479
+ "{class=IN, ttl=295, data=login.msa.msidentity.com, name=login.live.com, type=CNAME}, {data=www.tm.lg.prod.aadmsa.akadns.net, name=login.msa.msidentity.com, type=CNAME, class=IN, ttl=295}, {class=IN, ttl=295, data=prdv4a.aadg.msidentity.com, name=www.tm.lg.prod.aadmsa.akadns.net, type=CNAME}, {type=CNAME, class=IN, ttl=295, data=www.tm.v4.a.prd.aadg.trafficmanager.net, name=prdv4a.aadg.msidentity.com}, {data=40.126.29.7, name=www.tm.v4.a.prd.aadg.trafficmanager.net, type=A, class=IN, ttl=295}, {class=IN, ttl=295, data=40.126.29.15, name=www.tm.v4.a.prd.aadg.trafficmanager.net, type=A}, {data=40.126.29.10, name=www.tm.v4.a.prd.aadg.trafficmanager.net, type=A, class=IN, ttl=295}, {type=A, class=IN, ttl=295, data=20.190.157.14, name=www.tm.v4.a.prd.aadg.trafficmanager.net}, {data=20.190.157.9, name=www.tm.v4.a.prd.aadg.trafficmanager.net, type=A, class=IN, ttl=295}, {name=www.tm.v4.a.prd.aadg.trafficmanager.net, type=A, class=IN, ttl=295, data=40.126.29.5}, {data=20.190.157.4, name=www.tm.v4.a.prd.aadg.trafficmanager.net, type=A, class=IN, ttl=295}, {name=www.tm.v4.a.prd.aadg.trafficmanager.net, type=A, class=IN, ttl=295, data=20.190.157.0}",
3480
+ data_agent_ephemeral_id: "f64f34f9-15e3-4717-8349-bc5e342d07c3",
3481
+ data_event_start: "2025-05-23T20:24:04.815Z",
3482
+ rule_description: "Linux: DNS Query to login.live.com",
3483
+ data_related_ip:
3484
+ "192.168.100.3, 1.1.1.3, 40.126.29.7, 40.126.29.15, 40.126.29.10, 20.190.157.14, 20.190.157.9, 40.126.29.5, 20.190.157.4, 20.190.157.0",
3485
+ data_agent_version: "8.7.1",
3486
+ data_status: "OK",
3487
+ data_query: "class IN, type A, login.live.com",
3488
+ "data_@metadata_type": "_doc",
3489
+ data_method: "QUERY",
3490
+ data_dns_question_registered_domain: "live.com",
3491
+ data_server_ip: "1.1.1.3",
3492
+ gl2_message_id: "01JVZD2GBY1TFG35WJZT5ME05R",
3493
+ data_dns_answers_count: "12",
3494
+ data_network_type: "ipv4",
3495
+ data_dns_opt_ext_rcode: "NOERROR",
3496
+ data_client_port: "60286",
3497
+ data_network_bytes: "371",
3498
+ data_dns_resolved_ip:
3499
+ "40.126.29.7, 40.126.29.15, 40.126.29.10, 20.190.157.14, 20.190.157.9, 40.126.29.5, 20.190.157.4, 20.190.157.0",
3500
+ data_host_containerized: "false",
3501
+ true: 1748031846.277626,
3502
+ data_host_hostname: "piHole",
3503
+ rule_groups: "linux, packetbeat, dns",
3504
+ data_client_bytes: "43",
3505
+ data_dns_question_type: "A",
3506
+ data_host_ip: "192.168.100.3, fe80::20c:29ff:fe09:d59b",
3507
+ data_destination_ip: "1.1.1.3",
3508
+ rule_mitre_technique: "Application Layer Protocol",
3509
+ rule_firedtimes: 273,
3510
+ data_network_transport: "udp",
3511
+ dst_ip: "1.1.1.3",
3512
+ src_ip: "192.168.100.3",
3513
+ decoder_name: "json",
3514
+ syslog_level: "INFO",
3515
+ data_dns_op_code: "QUERY",
3516
+ data_host_os_version: "11 (bullseye)",
3517
+ data_host_os_kernel: "5.10.0-21-amd64",
3518
+ cluster_name: "socfortress",
3519
+ data_source_bytes: "43",
3520
+ gl2_processing_error:
3521
+ 'Replaced invalid timestamp value in message <e13c87e1-3813-11f0-91aa-8600007a2218> with current time - Value <2025-05-23T20:24:06.276+0000> caused exception: Invalid format: "2025-05-23T20:24:06.276+0000" is malformed at "T20:24:06.276+0000".',
3522
+ data_dns_opt_do: "true",
3523
+ data_dns_authorities_count: "0",
3524
+ data_dns_question_name: "login.live.com",
3525
+ message:
3526
+ '{"true":1748031846.277626,"timestamp":"2025-05-23T20:24:06.276+0000","rule":{"level":3,"description":"Linux: DNS Query to login.live.com","id":"200300","mitre":{"id":["T1071"],"tactic":["Command and Control"],"technique":["Application Layer Protocol"]},"firedtimes":273,"mail":false,"groups":["linux","packetbeat","dns"]},"agent":{"id":"032","name":"piHole","ip":"192.168.100.3","labels":{"customer":"00001"}},"manager":{"name":"ASHWZHMA"},"id":"1748031846.83713929","cluster":{"name":"socfortress","node":"ASHWZHMA.socfortress.local"},"decoder":{"name":"json"},"data":{"status":"OK","@timestamp":"2025-05-23T20:24:04.815Z","@metadata":{"beat":"packetbeat","type":"_doc","version":"8.7.1"},"client":{"bytes":"43","ip":"192.168.100.3","port":"60286"},"method":"QUERY","related":{"ip":["192.168.100.3","1.1.1.3","40.126.29.7","40.126.29.15","40.126.29.10","20.190.157.14","20.190.157.9","40.126.29.5","20.190.157.4","20.190.157.0"]},"dns":{"flags":{"recursion_available":"true","authentic_data":"false","checking_disabled":"false","authoritative":"false","truncated_response":"false","recursion_desired":"true"},"authorities_count":"0","header_flags":["RD","RA","DO"],"resolved_ip":["40.126.29.7","40.126.29.15","40.126.29.10","20.190.157.14","20.190.157.9","40.126.29.5","20.190.157.4","20.190.157.0"],"op_code":"QUERY","opt":{"do":"true","version":"0","udp_size":"1232","ext_rcode":"NOERROR"},"id":"56796","response_code":"NOERROR","question":{"name":"login.live.com","type":"A","class":"IN","etld_plus_one":"live.com","registered_domain":"live.com","top_level_domain":"com","subdomain":"login"},"answers_count":"12","answers":[{"class":"IN","ttl":"295","data":"login.msa.msidentity.com","name":"login.live.com","type":"CNAME"},{"data":"www.tm.lg.prod.aadmsa.akadns.net","name":"login.msa.msidentity.com","type":"CNAME","class":"IN","ttl":"295"},{"class":"IN","ttl":"295","data":"prdv4a.aadg.msidentity.com","name":"www.tm.lg.prod.aadmsa.akadns.net","type":"CNAME"},{"type":"CNAME","class":"IN","ttl":"295","data":"www.tm.v4.a.prd.aadg.trafficmanager.net","name":"prdv4a.aadg.msidentity.com"},{"data":"40.126.29.7","name":"www.tm.v4.a.prd.aadg.trafficmanager.net","type":"A","class":"IN","ttl":"295"},{"class":"IN","ttl":"295","data":"40.126.29.15","name":"www.tm.v4.a.prd.aadg.trafficmanager.net","type":"A"},{"data":"40.126.29.10","name":"www.tm.v4.a.prd.aadg.trafficmanager.net","type":"A","class":"IN","ttl":"295"},{"type":"A","class":"IN","ttl":"295","data":"20.190.157.14","name":"www.tm.v4.a.prd.aadg.trafficmanager.net"},{"data":"20.190.157.9","name":"www.tm.v4.a.prd.aadg.trafficmanager.net","type":"A","class":"IN","ttl":"295"},{"name":"www.tm.v4.a.prd.aadg.trafficmanager.net","type":"A","class":"IN","ttl":"295","data":"40.126.29.5"},{"data":"20.190.157.4","name":"www.tm.v4.a.prd.aadg.trafficmanager.net","type":"A","class":"IN","ttl":"295"},{"name":"www.tm.v4.a.prd.aadg.trafficmanager.net","type":"A","class":"IN","ttl":"295","data":"20.190.157.0"}],"type":"answer","additionals_count":"0"},"host":{"os":{"codename":"bullseye","type":"linux","platform":"debian","version":"11 (bullseye)","family":"debian","name":"Debian GNU/Linux","kernel":"5.10.0-21-amd64"},"id":"8986bcccef884a1ebe34f1ccd31b4f50","containerized":"false","ip":["192.168.100.3","fe80::20c:29ff:fe09:d59b"],"mac":["00-0C-29-09-D5-9B"],"hostname":"piHole","name":"piHole","architecture":"x86_64"},"agent":{"id":"9d8db289-3bc9-40d3-92cb-2bd2d9f9434b","name":"piHole","type":"packetbeat","version":"8.7.1","ephemeral_id":"f64f34f9-15e3-4717-8349-bc5e342d07c3"},"resource":"login.live.com","query":"class IN, type A, login.live.com","network":{"type":"ipv4","transport":"udp","protocol":"dns","direction":"egress","community_id":"1:1GvoZkkegqS2kWj0nbkXnzAb1QQ=","bytes":"371"},"server":{"ip":"1.1.1.3","port":"53","bytes":"328"},"event":{"end":"2025-05-23T20:24:04.841Z","kind":"event","category":["network"],"type":["connection","protocol"],"dataset":"dns","duration":"25965908","start":"2025-05-23T20:24:04.815Z"},"type":"dns","destination":{"ip":"1.1.1.3","port":"53","bytes":"328"},"ecs":{"version":"8.0.0"},"source":{"ip":"192.168.100.3","port":"60286","bytes":"43"}},"location":"/tmp/packetbeat/packetbeat-20250523-90.ndjson"}',
3527
+ dns_answer:
3528
+ "40.126.29.7, 40.126.29.15, 40.126.29.10, 20.190.157.14, 20.190.157.9, 40.126.29.5, 20.190.157.4, 20.190.157.0",
3529
+ data_dns_id: "56796",
3530
+ src_port: "60286",
3531
+ manager_name: "ASHWZHMA",
3532
+ data_dns_question_top_level_domain: "com",
3533
+ data_network_direction: "egress",
3534
+ data_event_end: "2025-05-23T20:24:04.841Z",
3535
+ data_agent_name: "piHole",
3536
+ data_client_ip: "192.168.100.3",
3537
+ data_dns_flags_authoritative: "false",
3538
+ data_server_bytes: "328",
3539
+ data_dns_header_flags: "RD, RA, DO",
3540
+ data_type: "dns",
3541
+ data_dns_flags_checking_disabled: "false",
3542
+ location: "/tmp/packetbeat/packetbeat-20250523-90.ndjson",
3543
+ "data_@metadata_version": "8.7.1",
3544
+ data_host_os_name: "Debian GNU/Linux",
3545
+ rule_group3: "dns",
3546
+ msg_timestamp: "2025-05-23T20:24:06.276Z",
3547
+ rule_group2: "packetbeat",
3548
+ rule_group1: "linux"
3549
+ },
3550
+ {
3551
+ data_source_ip: "192.168.100.1",
3552
+ data_host_architecture: "x86_64",
3553
+ agent_id: "032",
3554
+ agent_name: "piHole",
3555
+ gl2_remote_ip: "10.255.255.13",
3556
+ data_resource: "wns.notify.trafficmanager.net",
3557
+ agent_labels_customer: "00001",
3558
+ data_ecs_version: "8.0.0",
3559
+ timestamp_utc: "2025-05-23T20:24:04.324Z",
3560
+ data_host_os_codename: "bullseye",
3561
+ syslog_type: "wazuh",
3562
+ gl2_source_node: "3b68efa4-3319-4885-a38f-c944f0fcf191",
3563
+ id: "1748031846.83705408",
3564
+ data_dns_question_etld_plus_one: "trafficmanager.net",
3565
+ data_server_port: "53",
3566
+ rule_mitre_tactic: "Command and Control",
3567
+ gl2_accounted_message_size: 6296,
3568
+ data_agent_type: "packetbeat",
3569
+ streams: ["660320f176ca320e8393f057"],
3570
+ rule_mitre_id: "T1071",
3571
+ data_destination_bytes: "74",
3572
+ data_event_dataset: "dns",
3573
+ "data_@metadata_beat": "packetbeat",
3574
+ agent_ip: "192.168.100.3",
3575
+ data_source_port: "10467",
3576
+ data_host_id: "8986bcccef884a1ebe34f1ccd31b4f50",
3577
+ data_event_kind: "event",
3578
+ data_network_protocol: "dns",
3579
+ dns_response_code: "NOERROR",
3580
+ dns_query: "wns.notify.trafficmanager.net",
3581
+ data_dns_response_code: "NOERROR",
3582
+ data_network_community_id: "1:RAgDkVIAbVNgcEH1gw0uw34FTTc=",
3583
+ data_dns_flags_truncated_response: "false",
3584
+ rule_mail: false,
3585
+ data_dns_opt_udp_size: "1232",
3586
+ data_event_category: "network",
3587
+ data_dns_flags_recursion_available: "true",
3588
+ data_dns_opt_version: "0",
3589
+ timestamp: "2025-05-23 20:24:08.829",
3590
+ data_host_mac: "00-0C-29-09-D5-9B",
3591
+ data_agent_id: "9d8db289-3bc9-40d3-92cb-2bd2d9f9434b",
3592
+ data_destination_port: "53",
3593
+ data_dns_type: "answer",
3594
+ traffic_direction: "ingress",
3595
+ rule_id: "200300",
3596
+ data_dns_question_class: "IN",
3597
+ cluster_node: "ASHWZHMA.socfortress.local",
3598
+ dst_port: "53",
3599
+ "data_@timestamp": "2025-05-23T20:24:04.324Z",
3600
+ data_event_duration: "8268226",
3601
+ data_host_os_platform: "debian",
3602
+ data_dns_flags_recursion_desired: "true",
3603
+ data_host_name: "piHole",
3604
+ data_dns_question_subdomain: "wns.notify",
3605
+ gl2_remote_port: 53290,
3606
+ data_host_os_type: "linux",
3607
+ source: "10.255.255.13",
3608
+ gl2_source_input: "660320f176ca320e8393f030",
3609
+ rule_level: 3,
3610
+ data_event_type: "connection, protocol",
3611
+ data_host_os_family: "debian",
3612
+ data_dns_additionals_count: "0",
3613
+ data_dns_flags_authentic_data: "false",
3614
+ protocol: "udp",
3615
+ data_dns_answers: "{data=104.208.203.90, name=wns.notify.trafficmanager.net, type=A, class=IN, ttl=100}",
3616
+ data_agent_ephemeral_id: "f64f34f9-15e3-4717-8349-bc5e342d07c3",
3617
+ data_event_start: "2025-05-23T20:24:04.324Z",
3618
+ rule_description: "Linux: DNS Query to wns.notify.trafficmanager.net",
3619
+ data_agent_version: "8.7.1",
3620
+ data_related_ip: "192.168.100.1, 192.168.100.3, 104.208.203.90",
3621
+ data_status: "OK",
3622
+ data_query: "class IN, type A, wns.notify.trafficmanager.net",
3623
+ "data_@metadata_type": "_doc",
3624
+ data_dns_question_registered_domain: "trafficmanager.net",
3625
+ data_method: "QUERY",
3626
+ data_server_ip: "192.168.100.3",
3627
+ gl2_message_id: "01JVZD2GBXAENHVG3BRH7X6GJF",
3628
+ data_dns_answers_count: "1",
3629
+ data_network_type: "ipv4",
3630
+ data_dns_opt_ext_rcode: "NOERROR",
3631
+ data_client_port: "10467",
3632
+ data_network_bytes: "132",
3633
+ data_dns_resolved_ip: "104.208.203.90",
3634
+ data_host_containerized: "false",
3635
+ true: 1748031846.242808,
3636
+ data_host_hostname: "piHole",
3637
+ rule_groups: "linux, packetbeat, dns",
3638
+ data_client_bytes: "58",
3639
+ data_dns_question_type: "A",
3640
+ data_destination_ip: "192.168.100.3",
3641
+ data_host_ip: "192.168.100.3, fe80::20c:29ff:fe09:d59b",
3642
+ rule_mitre_technique: "Application Layer Protocol",
3643
+ rule_firedtimes: 270,
3644
+ data_network_transport: "udp",
3645
+ dst_ip: "192.168.100.3",
3646
+ src_ip: "192.168.100.1",
3647
+ decoder_name: "json",
3648
+ syslog_level: "INFO",
3649
+ data_dns_op_code: "QUERY",
3650
+ data_host_os_version: "11 (bullseye)",
3651
+ data_host_os_kernel: "5.10.0-21-amd64",
3652
+ cluster_name: "socfortress",
3653
+ data_source_bytes: "58",
3654
+ gl2_processing_error:
3655
+ 'Replaced invalid timestamp value in message <e13c12b0-3813-11f0-91aa-8600007a2218> with current time - Value <2025-05-23T20:24:06.242+0000> caused exception: Invalid format: "2025-05-23T20:24:06.242+0000" is malformed at "T20:24:06.242+0000".',
3656
+ data_dns_opt_do: "true",
3657
+ data_dns_authorities_count: "0",
3658
+ data_dns_question_name: "wns.notify.trafficmanager.net",
3659
+ message:
3660
+ '{"true":1748031846.242808,"timestamp":"2025-05-23T20:24:06.242+0000","rule":{"level":3,"description":"Linux: DNS Query to wns.notify.trafficmanager.net","id":"200300","mitre":{"id":["T1071"],"tactic":["Command and Control"],"technique":["Application Layer Protocol"]},"firedtimes":270,"mail":false,"groups":["linux","packetbeat","dns"]},"agent":{"id":"032","name":"piHole","ip":"192.168.100.3","labels":{"customer":"00001"}},"manager":{"name":"ASHWZHMA"},"id":"1748031846.83705408","cluster":{"name":"socfortress","node":"ASHWZHMA.socfortress.local"},"decoder":{"name":"json"},"data":{"status":"OK","@timestamp":"2025-05-23T20:24:04.324Z","@metadata":{"beat":"packetbeat","type":"_doc","version":"8.7.1"},"agent":{"ephemeral_id":"f64f34f9-15e3-4717-8349-bc5e342d07c3","id":"9d8db289-3bc9-40d3-92cb-2bd2d9f9434b","name":"piHole","type":"packetbeat","version":"8.7.1"},"dns":{"additionals_count":"0","id":"36071","answers_count":"1","authorities_count":"0","type":"answer","op_code":"QUERY","resolved_ip":["104.208.203.90"],"response_code":"NOERROR","header_flags":["RD","RA","DO"],"question":{"subdomain":"wns.notify","name":"wns.notify.trafficmanager.net","type":"A","class":"IN","etld_plus_one":"trafficmanager.net","registered_domain":"trafficmanager.net","top_level_domain":"net"},"flags":{"authentic_data":"false","checking_disabled":"false","authoritative":"false","truncated_response":"false","recursion_desired":"true","recursion_available":"true"},"opt":{"version":"0","udp_size":"1232","ext_rcode":"NOERROR","do":"true"},"answers":[{"data":"104.208.203.90","name":"wns.notify.trafficmanager.net","type":"A","class":"IN","ttl":"100"}]},"method":"QUERY","event":{"start":"2025-05-23T20:24:04.324Z","end":"2025-05-23T20:24:04.332Z","kind":"event","category":["network"],"type":["connection","protocol"],"dataset":"dns","duration":"8268226"},"source":{"ip":"192.168.100.1","port":"10467","bytes":"58"},"destination":{"ip":"192.168.100.3","port":"53","bytes":"74"},"client":{"ip":"192.168.100.1","port":"10467","bytes":"58"},"type":"dns","related":{"ip":["192.168.100.1","192.168.100.3","104.208.203.90"]},"host":{"ip":["192.168.100.3","fe80::20c:29ff:fe09:d59b"],"mac":["00-0C-29-09-D5-9B"],"hostname":"piHole","architecture":"x86_64","name":"piHole","os":{"name":"Debian GNU/Linux","kernel":"5.10.0-21-amd64","codename":"bullseye","type":"linux","platform":"debian","version":"11 (bullseye)","family":"debian"},"id":"8986bcccef884a1ebe34f1ccd31b4f50","containerized":"false"},"network":{"type":"ipv4","transport":"udp","protocol":"dns","direction":"ingress","community_id":"1:RAgDkVIAbVNgcEH1gw0uw34FTTc=","bytes":"132"},"resource":"wns.notify.trafficmanager.net","server":{"ip":"192.168.100.3","port":"53","bytes":"74"},"query":"class IN, type A, wns.notify.trafficmanager.net","ecs":{"version":"8.0.0"}},"location":"/tmp/packetbeat/packetbeat-20250523-90.ndjson"}',
3661
+ dns_answer: "104.208.203.90",
3662
+ data_dns_id: "36071",
3663
+ src_port: "10467",
3664
+ manager_name: "ASHWZHMA",
3665
+ data_dns_question_top_level_domain: "net",
3666
+ data_network_direction: "ingress",
3667
+ data_event_end: "2025-05-23T20:24:04.332Z",
3668
+ data_agent_name: "piHole",
3669
+ data_dns_flags_authoritative: "false",
3670
+ data_client_ip: "192.168.100.1",
3671
+ data_server_bytes: "74",
3672
+ data_dns_header_flags: "RD, RA, DO",
3673
+ data_type: "dns",
3674
+ data_dns_flags_checking_disabled: "false",
3675
+ location: "/tmp/packetbeat/packetbeat-20250523-90.ndjson",
3676
+ "data_@metadata_version": "8.7.1",
3677
+ data_host_os_name: "Debian GNU/Linux",
3678
+ rule_group3: "dns",
3679
+ msg_timestamp: "2025-05-23T20:24:06.242Z",
3680
+ rule_group2: "packetbeat",
3681
+ rule_group1: "linux"
3682
+ }
3683
+ ] as unknown as MitreEventDetails[],
3684
+ field_used: "rule_mitre_id",
3685
+ time_range: "now-24h",
3686
+ page: 1,
3687
+ page_size: 25,
3688
+ total_pages: 678
3689
+}