JSON гаралттай Syslog-ийн жишээнүүд

User activity-ийн жишээ

Энэ JSON гаралт нь гаралтын нэг жишээг харуулна.

{
"user": "auditlogtest@example.com",
"action": "UserInvited",
"date": "04 15 2021 15:00:03 UTC"
}

Энэ JSON жишээнд мөр таслалт (linefeed) байхгүй, жишээ нь:

{"user":"useractivity@example.com","action":"UserLogin 192.0.2.0","date":"04 15 2021 06:52:45 UTC"}
{"user":"auditlogtest@example.com","action":"User Logout (192.0.2.0)","date":"04 15 2021 06:11:06 UTC"}
{"user":"auditlogtest@example.com","action":"User Login Failed (192.0.2.0)","date":"04 15 2021 06:12:04 UTC"}
{"user":"auditlogtest@example.com","action":"User Updated (useractivity@example.com)","date":"04 15 2021 06:13:01 UTC"}
{"user":"mtd-policy","action":"Privacy Published (Device1)","date":"04 15 2021 05:22:48 UTC"}
{"user":"mtd-policy","action":"Policy Published (Device1)","date":"04 15 2021 05:22:48 UTC"}
{"user":"auditlogtest@example.com","action":"Policy Published (Device1)","date":"04 15 2021 05:23:06 UTC"}
{"user":"auditlogtest@example.com","action":"Privacy Published (Device1)","date":"04 15 2021 05:23:41 UTC"}

Энэ жишээнд syslog толгой (header) мэдээлэл багтсан:

Date: 2021-06-02T14:47:01+00:00
Facility: local0
Level: emerg
Msg: {"user":"admin@example.com","action":"UserLogin 192.0.2.0","date":"06 02 2021 14:47:01 UTC"}
Date: 2021-06-02T14:51:36+00:00
Facility: local0
Level: crit
Msg: {"user":"upgradetest@example.com","action":"User Login Failed (192.0.2.0)","date":"06 02 2021 14:51:36 UTC"}
Date: 2021-06-02T14:51:38+00:00
Facility: local0
Level: crit
Msg: {"user":"upgradetest@example.com","action":"UserLogin 192.0.2.0","date":"06 02 2021 14:51:38 UTC"}
Date: 2021-06-02T15:13:53+00:00
Facility: syslog
Level: err
Msg: Error processing log message: <133>1 2021-06-02T15:13:53.191Z not found dataexport ->@< AUDIT - {"user":"user@example.com","action":"UserLogin 192.0.2.0","date":"06 02 2021 15:13:52 UTC"}
Date: 2021-06-02T15:26:52+00:00
Facility: syslog
Level: err
Msg: Error processing log message: <133>1 2021-06-02T15:26:52.325Z not found dataexport ->@< AUDIT - {"user":"user":"user@example.com","action":"UserLogin 192.0.2.0","date":"06 02 2021 15:26:51 UTC"}

Threat Activity Concise Mode-ийн жишээ

Энэ JSON гаралт нь concise mode гаралтын жишээг харуулна. Товч болгохын тулд жишээний зарим агуулгыг (жишээ нь массивын давталтыг) хассан.

Дан аюулын (singular threat) жишээ

{
"system_token": "export demo",
"severity": 1,
"event_id": "19fb0e4e-164c-4b7e-a4ff-84ced7934cf5",
"mitigated": false,
"location": null,
"eventtimestamp": "02 24 2021 10:11:10 UTC",
"user_info": {
"user_id": "0baa981e-0e66-45c4-86c8-e45f3c843211",
"user_group": "TestGroup",
"user_role": "End User",
"user_email": "jon@example.com",
"employee_name": "anonymous user"
},
"device_info": {
"zdid": "1128481a-6f00-4407-975e-ed4dff65f181",
"zapp_instance_id": "231b0fb2-2e18-41ac-963c-e5360eb54bf1",
"device_time": "02 24 2021 10:11:10 UTC",
"tag1": "TrackingID1",
"tag2": "",
"imei": "467a44e7-cf00-4a4d-aa52-89cd667a6711",
"device_id": "467a55e7-cf00-4a4d-aa52-89cd667a6711",
"mdm_id": null,
"mam_id": null,
"type": "iPhone10,6",
"app": "Bitdefender",
"jailbroken": false,
"os_version": "10.0",
"operator": "AT&T",
"model": "iPhoneX",
"app_version": "4.14.0",
"os": "iOS",
"usb_debugging_enabled": false,
"developer_options_on": false,
"disk_not_encrypted": false,
"lock_screen_unprotected": false,
"stagefright_vulnerable": false
},
"threat": {
"story": "Unsecured WiFi Network",
"name": "Unsecured WiFi Network",
"category": [
"Singular"
],
"mitre_tactics": [
"Initial Access",
"Collection",
"Exfiltration",
"Network Effects"
],
"threat_uuid": "b2ce1f27-5e49-47ff-ac3a-c2670fa6e503",
"child_threat_uuids": [],
"general": {
"time_interval": "0",
"threat_type": "Unsecured WiFi Network",
"device_ip": "192.0.2.0",
"network": "AUTOMATION",
"network_bssid": "00:00:4E:00:00:00",
"network_interface": "lo0",
"action_triggered": "Alert User",
"external_ip": "192.0.2.24",
"gateway_mac": "00:00:5E:00:00:00",
"gateway_ip": "192.0.2.23",
"device_time": "02 24 2021 10:11:08 UTC",
"malware_list": "{}"
}
}
}

Нийлмэл аюулын (composite threat) жишээ

{
"system_token": "export composite demo",
"severity": 3,
"event_id": "881e062d-62eb-40a5-a5c4-522a6ebca18b",
"mitigated": false,
"location": null,
"eventtimestamp": "02 24 2021 10:11:17 UTC",
"user_info": {
"user_id": "0baa981e-0e66-45c4-86c8-e45f3c843211",
"user_group": "TestGroup",
"user_role": "End User",
"user_email": "jon@example.com",
"employee_name": "anonymous user"
},
"device_info": {
"zdid": "1128481a-6f00-4407-975e-ed4dff65f181",
"zapp_instance_id": "231b0fb2-2e18-41ac-963c-e5360eb54bf1",
"device_time": "04 07 2021 20:28:05 UTC",
"tag1": "TrackingID1",
"tag2": "",
"imei": "467a44e7-cf00-4a4d-aa52-89cd667a6711",
"device_id": "467a55e7-cf00-4a4d-aa52-89cd667a6711",
"mdm_id": null,
"mam_id": null,
"type": "iPhone11,8",
"app": "Bitdefender",
"jailbroken": false,
"os_version": "14.4.3",
"operator": "AT&T",
"model": "iPhoneX",
"app_version": "4.17.0",
"os": "iOS",
"usb_debugging_enabled": false,
"developer_options_on": false,
"disk_not_encrypted": false,
"lock_screen_unprotected": false,
"stagefright_vulnerable": false
},
"threat": {
"story": "Compromised Network",
"name": "Compromised Network",
"category": [
"Composite"
],
"mitre_tactics": [
"Initial Access",
"Collection",
"Exfiltration",
"Network Effects"
],
"threat_uuid": "d9c1d239-6abc-4762-b2bb-663ca74dc7f8",
"child_threat_uuids": [
"336e4163-9970-42ec-ba71-da919c32c817",
"6d9d6509-ec9a-45c2-bcca-aa602400e77a",
"b2ce1f27-5e49-47ff-ac3a-c2670fa6e503"
],
"general": {
"time_interval": "0",
"threat_type": "Compromised Network",
"device_ip": "192.0.2.21",
"network": "AUTOMATION",
"network_bssid": "00:00:4E:00:00:00",
"network_interface": "lo0",
"action_triggered": "Alert User",
"external_ip": "192.0.2.18",
"gateway_mac": "00:00:5E:00:00:00",
"gateway_ip": "192.0.2.16",
"device_time": "02 24 2021 10:11:15 UTC",
"malware_list": "{}"
}
}
}

Threat activity verbose mode-ийн жишээ

Энэ JSON гаралт нь verbose гаралтын жишээг харуулна. Массивын давталтаас болж жишээний зарим агуулгыг хассан.

{
"system_token": "demo verbose",
"severity": 3,
"event_id": "f443cb3f-bf7d-432e-a308-10c3b19bff61",
"forensics": {
"os": 1,
"SSID": "AUTOMATION",
"type": 38,
"BSSID": "00:00:5E:00:00:00",
"os_forensics": {
"expected_security_patch": "20220101",
"vulnerable_security_patch": "2021-08-01",
"expected_os_version": "11",
"device_model": "SM-M025F",
"vulnerable_os_version": "11",
"build_information": "RP1A.200720.012",
"device_manufacturer": "samsung"
},
"general": [
{
"val": "20",
"name": "Time Interval",
"type": "interval"
},
{
"val": "Rogue Access Point",
"name": "Threat Type"
},
{
"val": "192.0.2.0",
"name": "Device IP"
},
{
"val": "\"Planet\"",
"name": "Attacker SSID"
},
{
"val": "00:00:5E:00:00:00",
"name": "Attacker BSSID"
},
{
"val": "AUTOMATION",
"name": "Network"
},
{
"val": "00:00:5E:00:00:00",
"name": "Network BSSID"
},
{
"val": "wlan0",
"name": "Network Interface"
},
{
"val": "Alert User",
"name": "Action Triggered"
},
{
"val": "192.0.2.24",
"name": "External IP"
},
{
"val": "00:00:5E:00:00:00",
"name": "Gateway MAC"
},
{
"val": "192.0.2.23",
"name": "Gateway IP"
},
{
"val": "{\"mnc\":260,\"psc\":251,\"type\":\"WCDMA\",\"cid\":124989446,\"mcc\":310,\"lac\":45991}",
"name": "BaseStation",
"type": "json_str"
},
{
"val": "02 24 2021 10:25:16 UTC",
"name": "Device Time"
},
{
"val": "11",
"name": "Vulnerable Os Version"
},
{
"val": "11",
"name": "Expected Os Version"
},
{
"val": "2021-08-01",
"name": "Vulnerable Security Patch"
},
{
"val": "20220101",
"name": "Expected Security Patch"
},
{
"val": "samsung",
"name": "Device Manufacturer"
},
{
"val": "SM-M025F",
"name": "Device Model"
},
{
"val": "RP1A.200720.012",
"name": "Build Information"
}
],
"severity": 3,
"responses": [
0
],
"attack_time": {
"$date": 1614162316000
},
"threat_uuid": "a0fa1162-6582-46a2-b9ad-9dfcf5972e68",
"process_list": [
{
"User": "root",
"Service": "u:r:init:s0",
"Process Name": "/init",
"Process ID(PID)": "1",
"Parent process(PPID)": "0"
},
{
"User": "root",
"Service": "u:r:kernel:s0",
"Process Name": "kthreadd",
"Process ID(PID)": "2",
"Parent process(PPID)": "0"
},
{
"User": "root",
"Service": "u:r:kernel:s0",
"Process Name": "ksoftirqd/0",
"Process ID(PID)": "3",
"Parent process(PPID)": "2"
},
{
"User": "u0_a21",
"Service": "u:r:untrusted_app:s0",
"Process Name": "com.google.android.apps.walletnfcrel",
"Process ID(PID)": "26737",
"Parent process(PPID)": "179"
}
],
"routing_table": [
{
"use": 31,
"refs": 0,
"flags": "0",
"netif": "wlan0",
"gateway": "192.168.43.1",
"destination": "192.168.43.1"
},
{
"use": 31,
"refs": 0,
"flags": "84000000",
"netif": "lo",
"gateway": "192.168.43.199",
"destination": "192.168.43.199"
},
{
"use": 7,
"refs": 0,
"flags": "0",
"netif": "wlan0",
"gateway": "192.168.43.1",
"destination": "8.8.8.8"
}
],
"time_interval": 20,
"close_networks": [
{
"SSID": "AUTOMATION",
"BSSID": "00:00:5E:00:00:00",
"level": 0,
"frequency": 0,
"capabilities": "N/A"
}
],
"network_threat": {
"gw_ip": "192.0.2.0",
"my_ip": "192.0.2.2",
"gw_mac": "00:00:5E:00:00:00",
"my_mac": "00:00:5E:00:00:00",
"net_stat": [
{
"Proto": "TCP",
"State": "LAST_ACK",
"Recv-Q": "root",
"Send-Q": "0",
"Local Address": "192.0.2.0:37002",
"Foreign Address": "192.0.2.0:443"
}
],
"interface": "wlan0",
"arp_tables": {
"after": {
"table": [
{
"ip": "192.0.2.0",
"mac": "00:00:5E:00:00:00"
}
]
},
"before": {
"table": [
{
"ip": "192.0.2.0",
"mac": "00:c0:ca:aa:bb:cc"
}
]
},
"initial": {
"table": [
{
"ip": "192.0.2.0",
"mac": "00:00:5E:00:00:00"
}
]
}
},
"basestation": "{\"mnc\":260,\"psc\":251,\"type\":\"WCDMA\",\"cid\":124989446,\"mcc\":310,\"lac\":45991}",
"routing_table": [
{
"Use": "31",
"Refs": "0",
"Flags": "84000000",
"Netif": "lo",
"Gateway": "192.168.43.199",
"Destination": "192.168.43.199"
},
{
"Use": "7",
"Refs": "0",
"Flags": "0",
"Netif": "wlan0",
"Gateway": "192.168.43.1",
"Destination": "8.8.8.8"
}
]
},
"rogue_access_point": {
"SSID": "\"Planet\"",
"BSSID": "00:00:5E:00:00:00",
"frequency": -1
}
},
"mitigated": false,
"location": null,
"eventtimestamp": "02 24 2021 10:25:20 UTC",
"user_info": {
"user_id": "0baa981e-0e66-45c4-86c8-e45f3c843211",
"user_group": "TestGroup",
"user_role": "End User",
"user_email": "reshma@example.com",
"employee_name": "anonymous user"
},
"device_info": {
"zdid": "000b731a-b152-4fd1-84f4-3de685eb9d72",
"zapp_instance_id": "575cbcb7-e1b3-47ff-b56e-6b495ab7c938",
"device_time": "02 24 2021 10:25:20 UTC",
"tag1": "tag id one",
"tag2": "tag id two",
"imei": "68a9591f-cb6b-4d48-8244-96f484f678b6",
"device_id": "68a9591f-cb6b-4d48-8244-96f484f678b6",
"mdm_id": null,
"mam_id": null,
"type": "Pixel XL",
"app": "Bitdefender",
"jailbroken": false,
"os_version": "8.0",
"operator": "AT&T",
"model": "Pixel XL",
"app_version": "4.14.0",
"os": "Android",
"usb_debugging_enabled": false,
"developer_options_on": false,
"disk_not_encrypted": false,
"lock_screen_unprotected": false,
"stagefright_vulnerable": false
},
"threat": {
"story": "Rogue Access Point",
"name": "Rogue Access Point",
"category": [
"Singular"
],
"mitre_tactics": [
"Initial Access",
"Credential Access",
"Network Effects"
],
"threat_uuid": "a0fa1162-6582-46a2-b9ad-9dfcf5972e68",
"child_threat_uuids": [],
"general": {
"time_interval": "20",
"threat_type": "Rogue Access Point",
"device_ip": "192.0.2.0",
"attacker_ssid": "\"Planet\"",
"attacker_bssid": "00:00:5E:00:00:00",
"network": "AUTOMATION",
"network_bssid": "00:00:5E:00:00:00",
"network_interface": "wlan0",
"action_triggered": "Alert User",
"external_ip": "192.0.2.4",
"gateway_mac": "00:c0:ca:aa:bb:cc",
"gateway_ip": "192.0.2.4",
"basestation": "{\"mnc\":260,\"psc\":251,\"type\":\"WCDMA\",\"cid\":124989446,\"mcc\":310,\"lac\":45991}",
"device_time": "02 24 2021 10:25:16 UTC"
}
}
}